Skip to content

Forward security events to your SIEM

Add a destination that forwards your tenant's signed audit events to your own SIEM or XDR, in CEF or OCSF, over Syslog, Splunk HEC, Microsoft Sentinel or an HMAC-signed webhook.

Who can do it

A tenant administrator, or a platform super administrator working inside your tenant. The console enables Add destination and the row controls only for a person who holds the permission to manage the tenant's forwarding destinations; a person who can only read sees them disabled.

Before you start

  • Your tenant's edition includes SIEM/XDR forwarding. On a customer-operated deployment the platform operator must also have delegated it to your tenant.
  • Have the collector's details ready: host and port for Syslog, the HTTPS endpoint for the other sinks, and the sink's credential (a HEC token, an Azure AD client secret, or a webhook signing key of at least 32 characters). Syslog uses no credential.
  • Destinations you add are forwarded to in addition to the deployment's own destinations, never in their place.

Steps

  1. Open Settings and select the Integrations tab.
  2. On the SIEM/XDR forwarding row, select Manage. The panel lists the deployment destinations that always receive your events and your tenant's own destinations.
  3. Select Add destination, then pick the sink type under Choose a sink type.
  4. Fill in the form:
    1. Name: unique among your tenant's destinations.
    2. Wire format: CEF or OCSF.
    3. The transport: Host, Port and Syslog transport (UDP, TCP or TLS over TCP) for Syslog; the HTTPS endpoint and credential for the other sinks.
    4. Optionally, TLS trust anchors (PEM, optional) for a collector behind your own certificate authority, and the filters to narrow what is forwarded.
  5. Select Save.
  6. For a webhook, copy the receiver secret the dialog now shows with Copy receiver secret, then select Done. It is shown once.

To change or stop a destination later, use Edit, Disable or Delete on its row.

What you see when it worked

The console confirms that the destination was created and lists it among your tenant's destinations as enabled. It also appears under Effective destinations for this tenant, beside the deployment destinations. The credential is sealed and shown only as configured, never as a value.

If it fails

What you see Cause What to do
The name is refused as already in use Your tenant already has a destination with that name Choose another name
The webhook secret is refused: "At least 32 characters." The signing key is too short Enter a key of at least 32 characters
A trust anchor is refused It is not a certificate authority, it has expired, or it is not a PEM certificate Paste the CA certificates, not the collector's own certificate
A change of host, port or trust anchors is refused Moving a destination requires its credential again Enter the credential in the same edit
The row reads that your access does not include managing forwarding You hold only the read permission Ask a tenant administrator
The row says the operator has not delegated SIEM/XDR forwarding Customer-operated deployment without delegation Ask your platform operator to delegate it

A person working inside your tenant through support access cannot add, change or delete a destination.

Without the console

Surface How
API POST /api/v3/admin/tenants/{tenantId}/event-forwarding/destinations (operation createDestination)
API PUT /api/v3/admin/tenants/{tenantId}/event-forwarding/destinations/{id} (operation replaceDestination), which also enables or disables it
API DELETE /api/v3/admin/tenants/{tenantId}/event-forwarding/destinations/{id} (operation deleteDestination)
  • Tenant Settings: what the screen shows and every decision you make on it.