Azure Event Hubs is a big data streaming platform and event ingestion service, specifically designed to integrate Azure services with external solutions like third-party SIEMs. Microsoft Entra ID (which includes Microsoft Graph activity logs) has a built-in diagnostic setting to stream logs directly to an Event Hubs namespace. This provides a real-time, scalable, and standardized endpoint for SIEM tools to consume the log data. Most major SIEM vendors have pre-built connectors for Azure Event Hubs, making this the most direct and administratively simple method for the required integration.

B. an Azure Event Grid namespace: Azure Event Grid is a service for routing discrete events for reactive programming models, not for high-throughput, continuous log streaming required by a SIEM.

C. an Azure Storage account: This option is for long-term archival of logs. While a SIEM could ingest from storage, it is not a real-time stream and requires a more complex pull mechanism.

D. a Log Analytics workspace: This is the native data store for Azure Monitor and Microsoft Sentinel. Sending logs here to forward them to a third-party SIEM adds an unnecessary step and complexity.

1. Microsoft Entra documentation

"Stream Microsoft Entra logs to an Azure event hub": "Streaming your Microsoft Entra logs to an event hub allows you to integrate with third-party Security Information and Event Management (SIEM) tools

such as Splunk and QRadar. This integration allows you to combine Microsoft Entra activity log data with other data managed by your SIEM

to provide richer insights into your environment." (See the "Introduction" section).

2. Azure Monitor documentation

"Stream Azure monitoring data to an event hub for consumption by an external tool": "Azure Monitor provides a complete full stack monitoring solution for your applications and services in Azure... At the same time

you may also need to send monitoring data to other monitoring tools in your environment... The most common method to stream monitoring data to an external tool is to use Azure Event Hubs." (See the "Overview" section).

3. Azure Event Hubs documentation

"What is Azure Event Hubs?": "Azure Event Hubs is a big data streaming platform and event ingestion service. It can receive and process millions of events per second. Data sent to an event hub can be transformed and stored by using any real-time analytics provider or batching/storage adapters." (See the "Overview" section).