1. Azure Active Directory (AD) logs, including audit logs and sign-in logs
   
2. Azure Application Gateway logs
   
3. Azure Monitor logs
   
4. Azure SQL Database logs
   
5. Microsoft Defender Advanced Threat Protection (ATP) logs
   
6. Microsoft Intune logs
   

Stream Logs to Azure Event Hubs

To stream logs to Azure Event Hubs

1. Log in to the Azure portal.
2. Create an event hub. See Microsoft Azure Quickstart: Create an event hub using Azure portal for instructions.
3. Go to the event hub you just created and click Shared Access Policies in the sidebar.
4. Create or edit a policy, and then select Manage, Send, and Listen. Streaming to Event Hubs requires these permissions.

5. Copy the connection string listed in the policy under Connection String–Primary Key.

   Note: You will need to enter this string when configuring the Event Hubs connection in USM Anywhere.

6. Configure streaming for the logs you want to collect. For example:

   Note: Make sure to enable Stream to an event hub and select the Event Hub you just created as the destination.

   • Azure AD logs: See Stream Azure Active Directory Logs to an Azure Event Hub for instructions from Microsoft.
   • Azure Application Gateway logs: See Enable Logging for Application Gateway for instructions from Microsoft.
   • Azure Monitor logs: See Create Diagnostic Settings to Send Logs for instructions from Microsoft.
   • Azure SQL Database logs: See Set up auditing for your database for instructions from Microsoft. Make sure to select Event Hub as the destination.
   • Microsoft Defender ATP logs: See Configure Microsoft Defender ATP to stream Advanced Hunting events to your Azure Event Hubs for instructions from Microsoft.
   • Microsoft Intune logs: See Send log data to storage, event hubs, or log analytics in Intune for instructions from Microsoft.

Set Up Azure Event Hubs Connection in USM Anywhere

To enable Azure Event Hubs in USM Anywhere

1. Go to Data Sources > Sensors, and then open the Azure Sensor.

2. Click the Configuration tab.

   

3. Complete the three fields:

   • Event Hub Name: The name of the event hub created during initial setup.

     

   • Event Hub Connection String: A string containing unique configuration data about your Azure Event Hubs implementation. This is the connection string that was copied under Connection String–Primary Key in the Stream Logs to Azure Event Hubs procedure.
   • Event Hub Consumer Group: The name of your Event Hubs consumer group. You can locate this name by opening your Event Hubs overview in the Azure portal and scrolling to the bottom of the page.
4. (Optional.) Select Process Generic Events to collect events for which USM Anywhere currently does not have a parser. These events will display as "GENERIC event" under Activity > Events.
5. Click Save.
6. Click the Event Hub tab to check the connection status and the number of events processed by each data source.

Viewing Azure Event Hubs Connectivity in USM Anywhere

To view your Azure Event Hubs connection

1. Go to the Sensors page, and then open your Azure Sensor.
2. Click the Event Hub tab.

These are the connectivity statuses you may see:

• Connecting: Azure Event Hubs is currently connecting to the sensor.
• Processing: Azure Event Hubs is successfully connected.
• Shutting Down: Azure Event Hubs has begun the shutdown process to allow a different event hub to connect to the sensor.
• Shutdown: The sensor is not currently connected to an event hub.
• Error: The connection has experienced an error.