Import Azure log data

Step 1: Create a resource group

1. Log on to the Azure portal.

2. In the left navigation pane, select Resource groups, and then click Create.

   

3. On the Create a resource group page, set the following parameters, and then click Review + create.

   Parameter	Description
   Subscription	The Azure subscription for the resource group
   Resource group	A unique name for the resource group
   Region	The region for the resource group

4. After confirming the information, click Create.

Step 2: Create an Event Hubs namespace

1. In the left navigation pane, click All services. In the Analytics area, click Event Hubs.

   

2. On the Event Hubs page, click Create and configure the following parameters.

   For differences between pricing tiers, see Quotas and limits, Event Hubs Premium, and Event Hubs Dedicated. For throughput and processing units, see Scalability of Event Hubs.

   Parameter	Description
   Subscription	The subscription from Step 1
   Resource group	The resource group from Step 1
   Namespace name	A name for the namespace. The corresponding Kafka broker endpoint appears below the field.
   Region	The same region as the resource group in Step 1
   Pricing tier	Select Basic (default) for general use. To restrict access to Agentic SOC only, select Standard, Premium, or Dedicated — these tiers support network whitelisting.
   Throughput units / Processing units	Keep the defaults.
   Auto-inflate	Enable as needed.

   

3. On the Networking tab, set Network connectivity to Public access, and then click Review + create at the bottom of the page.

   Important

   To restrict access so that only Agentic SOC can reach this namespace, configure a network whitelist in Azure. For details, see Configure an Event Hubs whitelist (optional).

4. After confirming the configuration, click Create and wait for the deployment to complete.

5. On the Your deployment is complete page, click Go to resource to open the namespace details page.

   Alternatively, on the Event Hubs home page, click the namespace name in the list to open its details page.

Step 3: Create an event hub

1. On the namespace details page, click + Event Hub.

2. Enter the required information and click Review + create.

   Important

   The event hub name maps directly to the Kafka topic. Record this name — you'll enter it as the Topics value when configuring the data import task in Security Center.

   Parameter	Description
   Name	A name for the event hub. This name becomes the Kafka topic name — use a descriptive, recognizable name.
   Other configurations	Keep the defaults.

3. On the confirmation page, click Create and wait for the task to complete.

4. Return to the namespace homepage to see the new event hub listed in the Event Center section.

Step 4: Get the primary connection string

1. On the namespace page, in the left navigation pane under Settings, click Shared access policies.

2. Click the default policy RootManageSharedAccessKey. In the policy details pane, copy the Primary connection string.

   Important

   The primary connection string is the Kafka password used when authorizing Security Center. Copy the entire string — you'll paste it into the Password field in Security Center.

   

Step 5: Write data to the event hub

Follow the instructions in the official Azure documentation to write the data that you want to analyze to the event hub that you created in Step 3. For more information, see the following documents:

• Export Defender for Cloud alerts to an event hub

• Collect IIS logs from a virtual machine with Azure Monitor, Send data from Azure Monitor to an event hub

• Send data to an event hub using .NET

• Send data to an event hub using Java

• Send events to an event hub using Python

• Send events to an event hub using JavaScript

• Send events to an event hub using Go

• Send events to an Azure event hub using C

• Stream data with Azure Event Hubs and Apache Kafka

Step 1: Authorize Security Center to access the event hub

1. Go to Security Center console > System Settings > Feature Settings. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

2. On the Multi-cloud Configuration Management tab, click Multi-cloud Assets, then click Grant Permission and select IDC from the drop-down list.

3. In the panel that appears, set the following parameters.

   Parameter	Value
   Service Provider	Apache
   Connection Type	Kafka
   Endpoint	<YOUR-NAMESPACE>.servicebus.windows.net:9093 — replace <YOUR-NAMESPACE> with your Event Hubs namespace name
   Username	$ConnectionString (fixed, cannot be changed)
   Password	The primary connection string from Step 4
   Communication Protocol	sasl_ssl
   SASL Authentication Mechanism	plain

4. For AK Service Status Check, this parameter is not applicable — skip it.

Step 2: Create a data import task

2a. Create a data source

If you've already created a data source, skip to step 2b.

1. Go to Security Center console > Agentic SOC > Integration Center. In the upper-left corner, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

2. On the Data Source tab, create a data source to receive logs. For details, see Create a data source for Simple Log Service (SLS).

   Parameter	Value
   Source Data Source Type	Agentic SOC Dedicated Collection Channel (recommended) or User Log Service
   Add Instances	Create a new Logstore to keep Azure logs isolated from other data

2b. Add a data import task

1. On the Data Import tab, click Add Data.

2. In the panel that appears, configure the following parameters.

   Parameter	Value
   Data Source Type	Kafka
   Endpoint	<YOUR-NAMESPACE>.servicebus.windows.net:9093
   Topics	The event hub name from Step 3
   Value Type	json
   Data Source Name	The data source created in step 2a
   Destination Logstore	The Logstore selected in step 2a

3. Click OK. Security Center starts retrieving logs from the Azure event hub automatically.