How to filter security events only from Event Hub and send to SIEM

Question

One of my customer is trying to integrate IBM QRADAR SIEM with Azure. They would like to send all data from various sources to Event Hub and the data would be related to Azure AD, Azure VMs, Key Vault etc.

But my customer only wants to send Security related data from Event Hubs and discard all the other data and then send only the security related data to IBM QRADAR. What is the method to filter this data from Event Hub so that the SIEM solution doesn't get too much data which are not security related and choke the system.

tal_rosler · Answer

Hi&nbsp;palchak&nbsp;,
Your customer can use Microsoft Graph connector for QRadar to send Azure Security Center data easier to QRadar. Please read more details here:&nbsp;
https://techcommunity.microsoft.com/t5/azure-security-center/accessing-azure-security-center-alerts-in-splunk-using-graph/ba-p/938228
&nbsp;
Thanks,
Tal Rosler,
Azure Security Center.

Forum Discussion

How to filter security events only from Event Hub and send to SIEM

1 Reply

Resources