Import Azure logs into Security Center

Step 1: Create a resource group

1. Log on to the Azure portal. Open the Azure portal.

2. In the left navigation pane, choose Resource groups, then click Create.

3. On the Create a resource group page, configure the following settings, then click Review + create.

   • Subscription: Select the Azure subscription in which to create the resource group.

   • Resource group name: Enter a unique name for the resource group.

   • Region: Select the Region for the resource group.

4. Confirm the settings, then click Create.

Step 2: Create an Event Hubs namespace

1. In the left navigation pane, choose All services. Under Analytics, click Event Hubs.

   

2. On the Event Hubs page, click Create and configure the following settings.

   • Subscription: Select the subscription from Step 1.

   • Resource group: Select the resource group created in Step 1.

   • Namespace name: Enter a name for the namespace. The service address of the Kafka endpoint appears at the lower-right of the input box. For example, if you enter test01namespace, the address suffix is .servicebus.windows.net.

   • Region: Select the Region of the resource group created in Step 1.

   • Pricing tier: Select a tier based on your requirements. The default is Basic. To restrict access to the namespace so that only Agentic SOC can reach it, Standard configuration or above is recommended. For instructions, see Configure an event hub allowlist (optional).

     Note

     For the differences between tiers, see the Azure documentation on quotas and limits, Event Hubs Premium, and Event Hubs Dedicated. Quotas and limits、Event Hubs PremiumandEvent Hubs Dedicated。

   • Throughput Units / Processing Units (Premium): Keep the default value.

     Note

     For details about throughput units and processing units, see the Azure documentation on scaling. Scaling with Event Hubs.

   • Auto-inflate: Turn this feature on or off based on your requirements.

3. On the Networking tab, set Public access as the connectivity method, then click Review + create at the bottom of the page.

   Important

   To grant Agentic SOC exclusive access to the Event Hubs namespace, configure an IP allowlist in Azure. For instructions, see Configure an event hub allowlist (optional).

4. Verify the settings, then click Create and wait for the deployment to finish.

5. On the Deployment complete page, click Go to resource to open the namespace details page.

   Note

   You can also open the namespace details page by clicking the namespace name in the list on the Event Hubs home page.

Step 3: Create an event hub

1. On the namespace details page created in Step 2, click + Event Hub.

2. On the creation page, configure the following settings, then click Review + create.

   • Name: Enter a name for the event hub.

     Important

     The event hub name is the Kafka topic that you configure later. Use a representative name that is easy to find and understand.

   • Other settings: Keep the defaults.

3. On the confirmation page, click Create and wait for the task to finish.

4. Return to the namespace home page. The new event hub appears in the Event Hubs section.

Step 4: Record key information

Record the following information. You need it when you configure Azure diagnostic settings and when you import the Event Hubs logs into Agentic SOC.

Microsoft Entra ID

1. On the Azure portal home page, search for Microsoft Entra ID and open the service page.

2. In the left navigation pane, choose Monitoring > Diagnostic settings.

   

3. Click Add diagnostic setting, or select an existing setting to edit.

4. Select the log categories to collect, such as sign-in logs and audit logs.

5. Under the destination, select Stream to an event hub, then select the namespace and event hub instance created in Step 3.

   

6. Click Save.

Azure Key Vault

The steps are similar to those for Microsoft Entra ID.

1. Open the Azure Key Vault resource page.

2. In the left navigation pane, choose Monitoring > Diagnostic settings.

3. Click Add diagnostic setting, or select an existing setting to edit.

4. Select the log categories to collect. Under the destination, select Stream to an event hub, then select the namespace and event hub instance created in Step 3.

5. Click Save.

Azure Firewall

The steps are similar to those for Microsoft Entra ID.

1. Open the Azure Firewall resource page.

2. In the left navigation pane, choose Monitoring > Diagnostic settings.

3. Click Add diagnostic setting, or select an existing setting to edit.

4. Select the log categories to collect. Under the destination, select Stream to an event hub, then select the namespace and event hub instance created in Step 3.

5. Click Save.

Azure Activity Log

The entry point for Activity Log differs from resource-level diagnostic settings.

1. On the Azure portal home page, search for and open the Azure Monitor service.

2. In the left navigation pane, choose Activity log.

   

3. At the top of the page, click Diagnostic settings.

4. Click Add diagnostic setting, or select an existing setting to edit.

5. Select the activity log categories to collect. Under the destination, select Stream to an event hub, then select the event hub created in Step 3.

   

6. Click Save.

Step 1: Authorize Security Center to access the event hub

1. On the Multi-cloud Configuration Management tab, select the multi-cloud asset, then click Add Authorization and select IDC from the drop-down list.

2. In the panel that appears, configure the following settings:

   • Vendor: Select Apache.

   • Product: Select Kafka.

   • Endpoint: Enter <YOUR-NAMESPACE>.servicebus.windows.net:9093. Replace <YOUR-NAMESPACE> with the Event Hubs namespace name.

   • Username:$ConnectionString. This value is fixed and cannot be changed.

   • Password: The primary connection string of the event hub.

   • Protocol:sasl_ssl.

   • SASL mechanism:plain.

3. For Configure Sync Policy and AK Service Status Check: Not applicable. Skip this step.

Step 2: Create a data import task

1. Create a data source for the Azure log data. If you have already created one, skip this step.

2. On the Data Import tab, click Add Data Import.

3. In the panel that appears, configure the following settings:

   • Data source type:Kafka.

   • Endpoint:<YOUR-NAMESPACE>.servicebus.windows.net:9093, where <YOUR-NAMESPACE> is the Event Hubs namespace name.

   • Topics: The event hub name that you set when you created the event hub.

   • Value type:json.

4. Configure the target data source:

   • Data source name: Select the data source created in this step.

   • Target Logstore: Select the Logstore configured for the data source.

5. Click OK to save the configuration.

After the import is configured, Security Center automatically pulls logs from the Azure event hub.