Regarding the on-premises SIEM log linkage

Hello

We would like to link Azure WAF to on-premise SIEM for security control.

I have a few inquiries regarding this.

1. Should I send the log through event hub?

2. If I send the log through the event hub, it will be blocked by our firewall.

Can you tell me the domain of the api that event hub uses?

If I have to use a solution other than the event hub, could you tell me the domain of the solution api?

Thank you.