Enabling and integrating Azure AD diagnostic logs with Log Analytics and Microsoft Sentinel

In the previous chapter, we discussed how to access and use activity logs and audit logs to review user activity and filter that activity for monitoring, reporting, and managing potential vulnerabilities and threats. In this chapter, we will discuss how we can use this information within Microsoft Sentinel and third-party SIEM solutions to provide an integration of these logs to handle security operations more efficiently in one location.

This section will provide guidance on how to export logs to Microsoft Sentinel. The next section will discuss how to export logs to third-party security tools, if you are not utilizing Microsoft Sentinel. Let's start by explaining Microsoft Sentinel and what SIEM and security orchestration automated response (SOAR) solutions are.

A SIEM is a solution within a security operations center that gathers logs and events from various appliances and software...