Forum Discussion

Manuel_DEste's avatar
Manuel_DEste
Copper Contributor
Apr 05, 2019

Integration of Sentinel with other 3rd party on-prem SIEM solutions (stream alerts to eventhub)

Dear Sentinel community,   I'm wondering if anyone already explored the possibilities of integrating sentinel Alerts with other SIEM solutions.    An Example could be for customers which want to ...
  • Ofer_Shezaf's avatar
    Ofer_Shezaf
    Apr 07, 2019

    Hi Manuel_DEste, great meeting you again!

     

    Yes and no.

     

    Forwarding alerts to an event hub is supported. You can use one of several ways:

    • Run a Logic App scheduled playbook to read alerts using the Log Analytics connector and then write them to an event hub using the Event Hub connector.
    • Soon you will be able to do it by running a playbook automatically when an alert triggers.
    • Lastly, you can Use the Security Graph API. Note that this will send all Azure alerts to your SIEM, not just Sentinel's.

    Why no? because what you really want to send are cases and not alerts, which are automatically aggregated and reduced alerts. We are working to make sure those can be sent to a SIEM as well. 

Resources