Sending Azure Active Directory Logs to Security Onion (Distributed Setup)

[SankaGamage]

Hello everyone,

I use Security Onion in a distributed deployment, with the manager node installed on a server. I access it through a VPN connection.

I want to send Azure Active Directory logs to Security Onion. I’ve already gone through various discussions and documentation, but I couldn’t find a clear or simple explanation of how to achieve this.

Could someone please provide guidance on the steps or point me to any documentation that explains this process clearly? I would greatly appreciate any straightforward methods or recommendations.

Thank you for your help!

[dougburks]

Here is the relevant documentation:
https://docs.securityonion.net/en/2.4/third-party-integrations.html
https://www.elastic.co/guide/en/integrations/current/azure.html