Question
Your company has a third-party security information and event management (SIEM) solution that uses Splunk and Microsoft Sentinel.
You plan to integrate Microsoft Sentinel with Splunk.
You need to recommend a solution to send security events from Microsoft Sentinel to Splunk.
What should you include in the recommendation?
- A. a Microsoft Sentinel data connector
- B. Azure Event Hubs Correct
- C. a Microsoft Sentinel workbook
- D. Azure Data Factory
Explanation
Use Azure Event Hubs. A Log Analytics data export rule on the Microsoft Sentinel workspace streams new data from selected tables (for example SecurityIncident, SecurityAlert or SecurityEvent) to an event hub as it arrives, and Splunk reads the event hub by using the Splunk Add-on for Microsoft Cloud Services.
Microsoft Sentinel data connectors bring data into Sentinel; they do not send data out. Workbooks only visualize data, and Azure Data Factory is a batch data integration service, not a way to stream security events to a SIEM.
