---
url: https://docs.realmsec.info/integration/azure_eventhub.md
---

# Azure Event Hub

Realm Security integrates seamlessly with Azure Event Hub, enabling intelligent routing and analysis of security event logs.

When streaming logs from multiple log sources to Azure Event Hubs, your architecture should prioritize logical segregation, regional alignment, and independent scaling.

## Topology

Two common options are:

* One Event Hub per log type
* One shared Event Hub for all log types

![Overview](../images/azure_event_hub.png)

### One Event Hub Per Log Type

Create a single Event Hubs Namespace, but create individual Event Hub instances inside it for each unique log source or category (e.g., insights-logs-signinlogs, insights-logs-activity). This is recommended as it keeps logs for each log type separate, easier to track through the fabric, provides better visibility and forward to separate tables/index in the downstream systems.

### One Shared Event Hub

Same Event Hub can be used to send multiple different log types as long as they conform to similar log format (ie: JSON). This is typically used for low volume sources to simplify setup and management of Azure Event Hub. In this setup, splitting each log type into a separate table/index in downstream systems does require additional effort.

## Scaling with Event Hubs

There are two factors that influence scaling with Event Hubs.

* Throughput units (standard tier) or processing units (premium tier): Throughput units control the throughput capacity of event hubs. A single throughput unit provides the following capabilities:

  * Ingress: Up to 1 MB per second or 1,000 events per second (whichever comes first).
  * Egress: Up to 2 MB per second or 4,096 events per second.

The Auto-inflate feature of Event Hubs automatically scales up by increasing the number of throughput units to meet usage needs.

* Partitions: Event Hubs organizes sequences of events sent to an event hub into one or more partitions. As newer events arrive, they're added to the end of this sequence.

For further details see [Microsoft: Scaling with Azure Event Hub](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-scalability).

Follow these steps to configure sending logs from Azure to Realm Security Data Fabric.

## Prerequisites

* Ensure you have administrative access to your Azure console.

## Overview

1. Azure Console: Create Microsoft Entra app registration
2. Azure Console: Create Event Hub
3. Azure Console: Send Events to Event Hub
4. Realm Console: Configure Azure Event Hub Input Feed

## 1. Azure: Create Microsoft Entra App Registration

1. Log in to the Azure console.
2. Navigate to **App Registrations > New registration**.
3. Give the app a name and click **Register**.

![Register](../images/azure_register_an_application.png)

4. Navigate to the newly created App Registration.
5. Store the **Client ID** and **Tenant ID**. These will be used later when configuring the Azure Event Hub input feed in the Realm console.
6. Navigate to **Manage > Certificate and secrets**. Select the **Client secrets** tab and click **New client secret**.

![Client Secret](../images/azure_app_registration.png)

7. Give the secret an optional description and select an expiration.
8. Store the **client secret value** — it will be used later when configuring the Azure Event Hub input feed in the Realm console.

## 2. Azure: Create Event Hub

1. Navigate to the **Event Hubs** page in the Azure portal.
2. Select **+ Create** and fill out the **Basics** tab:

   > **Subscription/Resource Group:** Select your existing group
   > **Namespace name:** Give the namespace a globally unique name
   > **Region:** Select the same region as your logs
   > **Pricing tier:** Select any tier except Basic (Basic does not support Event Grid notifications)

   Store the fully qualified namespace name (e.g., `your-namespace-name.servicebus.windows.net`) and the Event Hub name — these will be used when configuring the input feed in the Realm console.

![Create Namespace](../images/azure-event-hub-create-namespace.png)

3. Select **Review + create**, then select **Create**.
4. Once deployment is complete, select **Go to resource**.
5. On the Namespace page, select **+ Event Hub** from the top menu.

![Create Event Hub](../images/azure-create-event-hub.png)

> **Name:** Give your Event Hub instance a name
> **Partition Count:** 2 partitions is typically sufficient. Refer to [Azure Event Hub partitions documentation](https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-features#number-of-partitions) if you need more.
> **Retention:** We recommend at least 8 hours, in case a downstream service has an outage.

> **Note:** If you configure the Event Hub to use a custom consumer group (not `$Default`), save that value — it will be used when configuring the input feed in the Realm console.

![Create Event Hub Form](../images/azure-create-event-hub-form.png)

6. Select **Review + create**, then select **Create**.
7. Select **Access Control (IAM)** from the left-hand sidebar.
8. Click **+ Add** and select **Add role assignment**.

![Add role assignment](../images/azure-event-hub-add-role-assignment.png)

9. On the **Role** tab, search for and select **Azure Event Hubs Data Receiver**.

   > **Note:** This role allows the application to read events from the hub and is required for the Realm ingestion process.

10. On the **Members** tab:
    * Set **Assign access to** to `User, group, or service principal`.
    * Click **+ Select members**.
    * In the search box, enter the Name or Client ID of the App Registration you created in Step 1.
    * Select your application from the list and click **Select**.

11. Click **Review + assign**, then click it again to confirm the assignment.

## 3. Azure: Sending Events to Event Hub

### A. Configure Azure Activity Logs

1. In the Azure portal, search for and select **Monitor**.
2. From the left-hand menu, select **Activity log**, then select **Export Activity Logs**.
3. Select **+ Add diagnostic setting**.
   > **Setting name:** Provide a name
   > **Categories:** Select the log categories you wish to monitor
4. Under **Destination details**:
   * Check the **Stream to an event hub** box.
   > **Subscription:** Select your subscription
   > **Event hub namespace:** Select the namespace created in Step 2
   > **Event hub name:** Select your specific Event Hub instance
   > **Event hub policy name:** `RootManageSharedAccessKey` (or a custom policy with Send permissions)
5. Select **Save**.

### B. Configure Microsoft Entra ID Logs (Azure AD)

1. Navigate to **Microsoft Entra ID** (formerly Azure Active Directory).
2. In the left-hand sidebar, scroll down to the **Monitoring** section and select **Diagnostic settings**.
3. Select **+ Add diagnostic setting**.
   > **Setting name:** Provide a name (e.g., `realm-entra-logs-to-eventhub`)
   > **Logs:** Select the specific logs you want to capture
4. Under **Destination details**:
   * Check the **Stream to an event hub** box.
   * Select your **Subscription**, **Event hub namespace**, and **Event hub name** as in the previous section.
5. Select **Save**.

#### Support Log Types

Realm supports the follow log types being sent through Azure Event Hub:\
**Audit Logs**\
**SignInlogs**\
**NonInteractiveUserSignInLogs**\
**ServicePrincipalRiskEvents**\
**ManagedIdentitySignInLogs**\
**ProvisioningLogs**\
**ADFSSignInLogs**\
**RiskyUsers**\
**UserRiskEvents**\
**NetworkAccessTrafficLogs**\
**RiskyServicePrincipals**\
**ServicePrincialRiskEvents**\
**EnrichedOffice365AuditLogs**\
**MicrosoftGraphActivityLogs**\
**RemoteNetworkHealthLogs**\
**NetworkAccessAlerts**\
**NetworkAccessConnectionEvents**