Share via

Troubleshoot SIEM tool integration issues

12980401 0 Reputation points
2023-05-02T21:05:42.3033333+00:00

we have followed the docs to collect data from Microsoft Azure Event Hub, for Microsoft Defender integration on elastic stack. for some reason we're not receiving the data?

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,238 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
169 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
117 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. David Broggy 5,701 Reputation points MVP
    2023-05-03T03:27:32.36+00:00

    Hi 12980401,

    I appreciate the challenge in getting Azure Event Hub working with 3rd party collection tools like Elastic Stack.

    A common thing to forget is to point your data at the event hub.

    The documentation often explains how to configure the event hub but it may forget to mention that you need to point one or more data sources at the event hub.

    Here's a link that shows how to validate you have data in your event hub.

    If this is working then your issue is more likely with the event hub connector so please reply back with more details if that is the case.

    https://learn.microsoft.com/en-us/azure/event-hubs/process-data-azure-stream-analytics

  2. JamesTran-MSFT 36,501 Reputation points Microsoft Employee
    2023-05-15T19:25:57+00:00

    @12980401

    Thank you for your post and I apologize for the delayed response!

    When looking more into your issue, I understand that you're having troubles collecting data from Microsoft Azure Event Hub after integrating it with Microsoft Defender. Please keep in mind that after integration, the data collection could take some time (~1hr) and if you're still having issues after waiting, you should be able to verify that the events are being exported to the Event Hubs by running the Advanced Hunting query below.

    Select Hunting > Advanced Hunting > Query and enter the following query:

    //This query will show you how many emails were received in the last hour joined across all the other tables.
EmailEvents
|join kind=fullouter EmailAttachmentInfo on NetworkMessageId
|join kind=fullouter EmailUrlInfo on NetworkMessageId
|join kind=fullouter EmailPostDeliveryEvents on NetworkMessageId
|where Timestamp > ago(1h)
|count

    For more info: Verify that the events are being exported to the Event HubsUser's image

    Additional Links:

    I hope this helps!

    If you're still having issues and would like to work closely with our support team, please let me know.

    Thank you for your time and patience throughout this issue.

    If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.