Tagged Event Hubs

2026

  1. Project2 min readEntra ID audit logs to CrowdStrike SIEM, one stream per countryEntra ID → Event Hubs → Stream Analytics → CrowdStrike NG-SIEM, with Azure Automation keeping the user-to-country lookup fresh. Beyond filtering: each country becomes a measurable unit, with its own events, volumes and security metrics.