Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Set up the required Azure resources to export security alerts to IBM QRadar and Splunk

4 September 2026Doc update+36 / −13 lines

In brief

The documentation now covers Event Hubs prerequisites, consumer groups, tenant-level policy behavior, QRadar storage configuration, and Splunk Microsoft Entra authentication, including use of the client-secret value and the Data Receiver role.

What Defender admins need to know

Administrators configuring Splunk or QRadar exports should follow these added setup steps and note that tenant-level policies include alerts from new subscriptions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Prepare Azure resources for exporting to Splunk and QRadar

Step 1: Create an Event Hubs namespace and event hub with send permissions

Create an Event Hubs namespace, an event hub, and a shared access policy with send permissions.

  1. In the Event Hubs service, create an Event Hubs namespace:
    1. Select Create.
    2. Enter the details of the namespace, select Review + create, and select Create.

Step 2: For streaming to QRadar SIEM - Create a Listen policy

If you're streaming to QRadar, create a Listen policy on the same event hub.

  1. Select Add, enter a unique policy name, and select Listen.
  2. Select Create to create the policy.
  3. After the listen policy is created, copy the Connection string primary key and save it to use later.

Step 3: Create a consumer group, then copy and save the name to use in the SIEM platform

Create a consumer group for your event hub and save its name for later use when you configure your SIEM platform.

  1. In the Entities section of the Event Hubs event hub menu, select Event Hubs and select the event hub you created.

    :::image type="content" source="media/export-to-siem/open-event-hub.png" alt-text="Screenshot of opening the event hub Microsoft Event Hubs." lightbox="media/export-to-siem/open-event-hub.png":::

Step 4: Enable continuous export for the scope of the alerts

  1. In theUse Azure search box, search for "policy" and goPolicy to the Policy.

  2. In the Policy menu, select Definitions.

  3. Search for "deploy export" and select the Deploy export to Event Hub for Microsoft Defender for Cloud data built-in policy.

  4. Select Assign.

  5. Define the basic policy options:

    1. In Scope, select the ... to select the scope to apply the policy to.
    2. Find the root management group (for tenant scope), management group, subscription, or resource group in the scope and select Select.
      • To select a tenant root management group level, you need to have permissions on tenant level.
    3. (Optional) In Exclusions you can define specific subscriptions to exclude from the export.
    4. Enter an assignment name.
    5. Make sure policy enforcement is enabled.

  6. In the policy parameters:

    1. Enter the resource group where the automation resource is saved.
    2. Select resource group location.
    3. Select the ... next to the Event Hub details and enter the details for the event hub, including:
      • Subscription.
      • The Event Hubs namespace you created.
      • The event hub you created.
      • In authorizationrules, select the shared access policy that you created to send alerts.

    :::image type="content" source="media/export-to-siem/create-export-policy-parameters.png" alt-text="Screenshot of parameters for the export policy." lightbox="media/export-to-siem/create-export-policy-parameters.png":::

  7. Select Review and Create and Create to finish the process of defining theenable continuous export to Event Hubs.

    • Notice that when you activate continuous export policy on the tenant (root management group level), it automatically streams your alerts on any new subscription that will be created under this tenant.

Step 5: For streamingof security alerts to QRadar SIEM - Create a storage account

  1. Go to the Azure portal, select Create a resource, and select Storage account. If that option isn't shown, search for "storage account".
  2. Select Create.
  3. Enter the details for the storage account, select Review and Create, and then Create.

Step 6: For streaming alerts to Splunk SIEM - Create a Microsoft Entra application

  1. In the menu search box, search for "Microsoft Entra ID" and go to Microsoft Entra ID.your event hub.

  2. Go to the Azure portal, select Create a resource, and select Microsoft Entra ID. If that option isn't shown, search for "active directory".

  3. In the menu, select App registrations.

    :::image type="content" source="media/export-to-siem/create-client-secret.png" alt-text="Screenshot of creating client secret." lightbox="media/export-to-siem/create-client-secret.png":::

  4. After the secret is created, copy the Secret ID and save it for later use together with the Application ID and Directory (tenant) ID.

  1. In the Azure search box, search for "policy" and go to the Policy.

  2. In the Policy menu, select Definitions.

  3. Search for "deploy export" and select the Deploy export to Event Hub for Microsoft Defender for Cloud data built-in policy.

  4. Select Assign.

  5. Define the basic policy options:

    1. In Scope, select ... to choose where the policy applies.
    2. Find the root management group (for tenant scope), management group, subscription, or resource group. Then select Select.
      • You need tenant-level permissions to select the root management group.
    3. (Optional) In Exclusions, select subscriptions to exclude from the export.
    4. Enter an assignment name.
    5. Make sure policy enforcement is enabled.

  6. In the policy parameters:

    1. Enter the resource group where the automation resource is saved.
    2. Select the resource group location.
    3. Select ... next to Event Hub details and enter these details:
      • Subscription.
      • The Event Hubs namespace you created.
      • The event hub you created.
      • In authorizationrules, select the shared access policy you created for sending alerts.

    :::image type="content" source="media/export-to-siem/create-export-policy-parameters.png" alt-text="Screenshot of parameters for the export policy." lightbox="media/export-to-siem/create-export-policy-parameters.png":::

  7. Select Review and Create, then select Create to finish defining continuous export to Event Hubs.

    • When you activate this policy at the tenant (root management group) level, it streams alerts from any new subscription created under that tenant.

Step 5: For streaming alerts to QRadar SIEM - Create a storage account

If you're streaming alerts to QRadar, create a storage account that QRadar uses to consume events.

  1. Go to the Azure portal, select Create a resource, and select Storage account. If that option isn't shown, search for "storage account".
  2. Select Create.
  3. Enter the details for the storage account, select Review and Create, and then Create.

Step 6: For streaming alerts to Splunk SIEM - Create a Microsoft Entra application

If you're streaming alerts to Splunk, register a Microsoft Entra application that Splunk uses to authenticate with the event hub.

  1. In the menu search box, search for "Microsoft Entra ID" and go to Microsoft Entra ID.

  2. Go to the Azure portal, select Create a resource, and select Microsoft Entra ID. If that option isn't shown, search for "active directory".

  3. In the menu, select App registrations.

    :::image type="content" source="media/export-to-siem/create-client-secret.png" alt-text="Screenshot of creating client secret." lightbox="media/export-to-siem/create-client-secret.png":::

  4. After the client secret is created, copy the secret Value and save it for later use together with the Application (client) ID and Directory (tenant) ID.

Step 7: For streaming alerts to Splunk SIEM - Allow Microsoft Entra ID to read from the event hub

Grant your Microsoft Entra application the Data Receiver role on the Event Hubs namespace so Splunk can read events.

  1. Go to the Event Hubs namespace you created.
  2. In the menu, go to Access control.
  3. Select Add and select Add role assignment.
  4. In the Roles tab, search for Azure Event Hubs Data Receiver.
  5. Select Next.
  6. Select Select Members.
  7. Search for the Microsoft Entra application you created before and selectregistered in Step 6. Select it.
  8. Select Close.

To continue setting up export of alerts,Your Azure resources are now configured to stream security alerts to your SIEM platform.

Next step

[!div class="nextstepaction"] Install the built-in connectors for the SIEM you're using.your SIEM.