Third-party SIEM export paths.

Decision model

Sentinel is one possible consumer, not the definition of the telemetry source. Start with the Microsoft product or Azure resource, identify its native export mechanism, then decide whether the SIEM consumes Event Hubs, Storage, or an API collector.

flowchart LR
  SRC[Microsoft telemetry source]
  SRC --> SENT[Microsoft Sentinel optional]
  SRC --> NATIVE[Native export mechanism]
  NATIVE --> EH[Azure Event Hubs]
  NATIVE --> SA[Azure Storage]
  NATIVE --> API[API or collector]
  EH --> SIEM[Third-party SIEM]
  SA --> SIEM
  API --> SIEM

Global export matrix

Defender XDR streaming

Defender XDR streaming sends supported Advanced Hunting event types to Azure Event Hubs or Azure Storage. Microsoft publishes a separate support matrix, and that matrix is not the same thing as the full Advanced Hunting schema. Streaming AlertInfo and AlertEvidence gives alert/evidence telemetry, not complete Defender XDR incident management.

Defender product notes

Microsoft Entra ID

Microsoft Entra diagnostic settings can route supported activity logs to Log Analytics, Event Hubs, Storage, and supported partner destinations. Sentinel is not required. Configuration is under Entra ID, Monitoring and health, Diagnostic settings. General diagnostic settings require Security Administrator; custom security attribute logs require Attribute Log Administrator.

Licensing is per telemetry source, not just per export destination. For example, Microsoft Graph activity logs require Entra ID P1 or P2 and must be integrated with storage or analytics tools for retention. Risk-related logs depend on Microsoft Entra ID Protection capabilities.

Microsoft 365 and Purview audit

Microsoft 365 audit export for third-party SIEMs normally uses the Office 365 Management Activity API. The API exposes tenant-specific content blobs and uses Microsoft Entra app registration plus OAuth. A collector starts subscriptions, polls available content or receives webhook notifications, downloads the content blobs, and forwards records to the SIEM.

Unified audit logging must be enabled before data is available through the API. Audit Standard and Audit Premium licensing affects audit capabilities and retention; this is separate from Event Hubs, Storage, or SIEM collector infrastructure.

Azure Activity Log and resource logs

Azure Activity Log records subscription control-plane operations. Azure resource logs record data-plane or resource-internal operations and are not collected by default. Both commonly use Azure Monitor diagnostic settings for Event Hub, Storage, Log Analytics, or partner destinations, but each resource has its own log categories.

Implementation checklist

1. Pick the source product or Azure resource before picking a Sentinel table.
2. Confirm the export mechanism in Microsoft Learn: Defender streaming, Entra diagnostic settings, Microsoft 365 Management Activity API, or Azure Monitor diagnostic settings.
3. Confirm whether Event Hubs, Storage, or an API collector is the supported destination path.
4. Validate the required role and destination permissions before configuring export.
5. Map each selected event type to the SIEM parser and document unsupported tables explicitly.
6. Keep Sentinel optional unless the architecture intentionally uses Sentinel as an intermediate destination.

Google SecOps translation

Google SecOps parser names do not always line up with Microsoft product or table boundaries. The clearest example is MICROSOFT_DEFENDER_ENDPOINT, which also covers Microsoft Defender for Office 365, Defender for Cloud Apps, TVM, alert/evidence, and identity advanced hunting tables when those payloads use the documented AdvancedHunting category pattern.