Overview

Many Azure services (Activity Log, Diagnostic settings, NSG flow logs, Front Door, App Service, etc.) can stream events to Azure Event Hubs. The Azure Event Hub integration consumes from a hub and forwards everything written to it into Cloud SIEM.

Prerequisites

• An Azure Event Hub namespace and event hub.
• A Shared Access Policy with Listen permission on the hub.
• The Azure services you want to monitor configured to publish to that hub via Diagnostic settings.

Step 1: Create or identify an Event Hub

1. Open the Azure portal and navigate to Event Hubs.
2. Select an existing namespace or click Create.
3. Inside the namespace, open Event Hubs and create a hub (for example, insights-logs-auditlogs) with a partition count and retention that suit your volume.

Step 2: Create a Listen-only Shared Access Policy

1. Open the event hub (not the namespace).
2. Go to Settings → Shared access policies → Add.
3. Name it atatus-siem and grant only the Listen claim.
4. Click Create, then open the policy and copy the Connection string – primary key.

Step 3: Configure source services to send to the Event Hub

For each Azure service you want to monitor:

1. Open the resource → Diagnostic settings → Add diagnostic setting.
2. Select the log categories of interest.
3. Choose Stream to an event hub, pick the namespace, hub, and the policy from Step 2.
4. Save.

Step 4: Connect Azure Event Hub in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Azure Event Hub card and click Connect.
3. Fill in the form:

1. Click Connect.

Tip: Create a dedicated consumer group (for example, atatus) so other consumers reading the same hub do not interfere with offset tracking.

Verification

• The Azure Event Hub card shows Configured.
• Events appear in Security → Cloud SIEM → Audit Logs → Events with source azure_eventhub.