Microsoft Entra ID log source parameters
When you add an Entra ID log source on the QRadar Console by using the Microsoft Azure Event Hubs protocol, there are specific parameters you must use.
The following table describes the parameters that require specific values to retrieve Microsoft
Entra ID events from Microsoft Entra ID:
Parameter | Value |
---|---|
Log Source type | Microsoft Entra ID |
Protocol Configuration | Microsoft Azure Event Hubs |
Log Source Identifier |
The Log Source Identifier can be any valid value, including the same value as the Log Source Name parameter, and doesn't need to reference a specific server. If you configured multiple Microsoft Entra ID log sources, you might want to identify the first log source as EntraID-1, the second log source as EntraID-2, and the third log source as EntraID-3. |
For a complete list of Microsoft Entra ID protocol parameters and their values, see Microsoft Azure Event Hubs protocol configuration options.