Azure Event Hub
Configure Azure Event Hub log collection for Cortex XDR.
You can configure collecting Azure Event Hub logs using a standard data source or content pack (onboarded prior to July 26, 2026):
Standard data source overview
Forward different types of logs to Cortex XDR from Azure Event Hub using the Microsoft Azure Event Hub data source.
Link to standard data source instructions
The following types of logs can be ingested from Azure Event Hub:
Activity logs
Microsoft Entra ID Activity logs and Microsoft Entra ID Sign-in logs
Resource logs, including AKS audit logs
For more information, see Ingest logs from Microsoft Azure Event Hub.
Link to content pack details (onboarded prior to July 26, 2026)
Azure Logs: Use this content pack to ingest and normalize various Azure logs to the Cortex Data Model (XDM) schema, including Azure Entra ID events ingested via the Office 365 data source, and Azure Logs ingested via the Microsoft Azure Event Hub data source. It includes modeling and parsing rules for log normalization.
Last updated
Was this helpful?