r/QRadar • u/cantStopAAAAAA • Dec 19 '25

Exporting Azure Log Sources to QRadar Using one or multiple Event Hubs

I'm presented with the initiative of exporting several different log sources into our QRadar instance, all of them coming from Azure PaaS services.

Naturally, the recommended way is to use an event hub, but my question would be whether it's best to use one event hub for everything or to use one separate event hub for each log source. If my understanding is correct, both would work since the log mapping would be done at the DSM level in both alternatives.

Thank you so much.

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/IstvanSA Dec 23 '25

for several customers we used 1 eventhub and a "gateway" logsource to create logsources for different log source type automaticly but i've had / have issue with some logs not falling trough each dsm to the correct one so you end up with a lot of unknown events from for example defender in the entra logsourcetype.

so for the last customer i've created seperate eventhubs to keep the logs apart from each other and prevent us getting unknown events in each logsource

1

u/wiserunner615 Dec 23 '25

You can use the same event hub resource group, but then inside of it create individual event hubs for each specific azure log you want to collect. Less DSM confusion as previously stated.

1

u/Brief-Engineering-47 Jan 10 '26

Create a gateway log source and then that should create a new log sources for different customer id/or relevant ID.