collecting activity logs via API for security

Hello Everyone!

We are planning to collect MCAS activity event logs for security monitoring via API  for applications we connected (O365, Azure, Workday, Salesforce, Service Now, Docusign). Can you please sare information about best practises, playbooks or guides regarding this scenario? Or if you have experience in similiar cases, I'll be thankful for information 🙂