Exporting sign-in and audit logs to a third-party SIEM

Azure Monitor is the Azure solution that most Azure services utilize for activity, event, and security logging. Azure AD, Azure Resource Manager, Azure Firewall, and Microsoft Defender for Cloud all utilize integration with Azure Monitor for monitoring and managing activity within Azure. The previous section discussed how to use and connect Microsoft Sentinel for monitoring, managing, and alerting on security activity based on these logs through Azure Monitor and Log Analytics. Companies that currently have a third-party SIEM and/or SOAR solution can also connect to Azure Monitor to monitor Azure AD activity. Azure Monitor routes the logs through Azure Event Hubs to deliver the log data to external applications.

More information on connecting Azure Monitor to third-party SIEM solutions for Azure AD logs can be found at this link: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-monitoring...