Forum Discussion
Azure Sentinel Alerts forward into Event HUB for 3rd Party SIEM
Hi, We are trying to get azure sentinel logs into our on prem QRadar SIEM. we follow to achieve it through Event Hub. but we have facing issue in how to forward Azure Sentinel Alert into Event Hub....
GaryBushey Yes you right, basically i don't know how to utilize '' deploy to azure" option. that why i go with copy paste option.
daniyal2021 It looks like the content field wants to use the "ExtendedProperties" property that comes from the "When a response to an Azure Sentinel alert is triggered" trigger but it didn't come through correct. Clear that field and then you can select the correct value in the Dynamic content listing.
daniyal2021 Not sure what that error means. I was able to install it on 2 different Azure Sentinel instances yesterday without any problems.
