Forum Discussion

daniyal2021's avatar
daniyal2021
Copper Contributor
Jan 27, 2021

Azure Sentinel Alerts forward into Event HUB for 3rd Party SIEM

Hi, We are trying to get azure sentinel logs into our on prem QRadar SIEM. we follow to achieve it through Event Hub. but we have facing issue in how to forward Azure Sentinel Alert into Event Hub....
GaryBushey's avatar
GaryBushey
Bronze Contributor
Jan 27, 2021

daniyal2021 If I understand what is happening correctly, you either deployed the code to your environment using the "Deploy to Azure" button (which I just tested and worked fine)  or you copied and pasted the code into a new playbook (in which case there are probably changes that need to be made in the code).  Is that correct?

daniyal2021's avatar
daniyal2021
Copper Contributor
Jan 27, 2021

GaryBushey Yes you right, basically i don't know how to utilize '' deploy to azure" option. that why i go with copy paste option.  

  • daniyal2021's avatar
    daniyal2021
    Copper Contributor
    Jan 27, 2021

    daniyal2021 Now stack in this can you please suggest something.

     

    • GaryBushey's avatar
      GaryBushey
      Bronze Contributor
      Jan 27, 2021

      daniyal2021 It looks like the content field wants to use the "ExtendedProperties" property that comes from the "When a response to an Azure Sentinel alert is triggered" trigger but it didn't come through correct.    Clear that field and then you can select the correct value in the Dynamic content listing.

       

      • daniyal2021's avatar
        daniyal2021
        Copper Contributor
        Jan 28, 2021

        GaryBushey now they showing error on repo permissions revoke

         

  • Rod_Trent's avatar
    Rod_Trent
    Icon for Microsoft rankMicrosoft
    Jan 27, 2021

    daniyal2021 Clicking the "Deploy to Azure" button takes you to the Azure console deployment screen. It's a better method to ensure there's no missing characters or formatting errors in the code (which sounds like might be your issue).