How to forward the Event Timeline entries from Defender for IoT ?

Question

Dear team ,

I have configured a forwarding rule on Defender for IoT and set the Minimum Alert Level to Warning. It's not forwarding the event timeline data to the Syslog server.

Answer 1

Hello Rushikesh Kulkarni,

Thanks for reaching out, understand the scenario you’re trying to achieve here.

It sounds like you’re expecting Event Timeline entries (investigation-level events) to be forwarded via Syslog, but in Microsoft Defender for IoT this is not how forwarding is designed to work.

Why Event Timeline data is not forwarded

Syslog forwarding rules (even with Minimum Alert Level = Warning) only apply to:

• Security alerts
• Operational alerts

Event Timeline entries:

• Are part of the investigation view
• Represent raw / contextual activity data
• Are not classified as alerts

Because of this, timeline entries are not picked up by Syslog forwarding rules, regardless of severity settings.

Current behavior

Syslog forwarding in Defender for IoT is alert-driven, not event-stream driven That’s why timeline data is not being sent to your Syslog server.

Options for accessing Event Timeline data

If you need deeper visibility beyond alerts, here are the recommended approaches:

1. Export Event Timeline to CSV

Use the Export option from the Event Timeline page in the sensor console

You can export filtered or full datasets for analysis

Please refer this https://learn.microsoft.com/azure/defender-for-iot/organizations/how-to-track-sensor-activity#export-the-event-timeline-to-csv

2. Use Defender for IoT APIs

You can programmatically retrieve event timeline data

Useful for Custom reporting

Building your own forwarding logic

Integrating with external systems

3. Integrate with SIEM

Forward alerts and related data into a SIEM like Microsoft Sentinel

Build Analytics rules, Workbooks, Playbooks

While timeline data itself isn’t directly forwarded, you can correlate alerts with additional context

Please refer this

• https://learn.microsoft.com/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners
• https://learn.microsoft.com/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners

Your configuration is correct this behavior is by design. However, for use cases like real-time monitoring or deeper investigation pipelines, this does highlight a gap in native forwarding capabilities.

I Hope this helps. Do let me know if you have any further queries.

---

If this answers your query, please do click Accept Answer and Yes for was this answer helpful.

Thank you!

Answer 2

Event Timeline entries are not forwarded by Defender for IoT forwarding rules. Forwarding rules on OT sensors send alert information only, based on the minimum alert severity and other conditions configured in the rule.

The documented forwarding behavior is:

• Forwarding rules run only on alerts triggered after the rule is created.
• The payload sent to SIEM/Syslog targets (ArcSight, NetWitness, LogRhythm, FortiSIEM, ServiceNow, generic Syslog) consists of alert fields such as alert title, severity, type, protocol, timestamps, source/destination IPs, and category.
• There is no option in the forwarding rule configuration to include Event Timeline data; only alerts and (optionally, in some integrations) system/alert notifications are supported.

To get Event Timeline–like visibility in downstream systems, configure forwarding rules to send alerts (and system notifications where available) and then use those alert records in the SIEM to approximate the timeline. Direct forwarding of Event Timeline entries themselves is not supported by the forwarding rules described in the available documentation.

---

References:

• Integrate ArcSight with Microsoft Defender for IoT
• Forward on-premises OT alert information
• Integrate RSA NetWitness with Microsoft Defender for IoT
• Integrate LogRhythm with Microsoft Defender for IoT
• Integrate Fortinet with Microsoft Defender for IoT
• Integrate ServiceNow with Microsoft Defender for IoT (legacy)