Prerequisite: This guide only covers how to add data sources after the Azure Event Hub integration is created. To set up the integration, see this guide: API – Azure Event Hub.
Once the integration is created, return to this Adding Sources guide to start sending data into your Event Hub for Huntress to collect.
After creating the integration between Huntress and Azure Event Hub, you can start sending Azure data to the Event Hub for Huntress to collect. To do this, for each application you wish to send telemetry from, follow these steps:
- Navigate to the Azure App you're seeking data from.
-
In the left hand navigation bar, expand the "Monitoring" section, and select "Diagnostic settings".
-
Select "Add diagnostic setting".
-
From the left side, select any logs or metrics that you wish to include in Huntress.
-
From the right side, enable the checkbox for "Stream to an event hub". Make sure you select the "Event hub name" as logs-hub.
- Select the appropriate Subscription, Event hub namespace, and Event hub name from the drop-downs.
-
Set a "Diagnostic setting name" then select Save in the top left.
- Repeat these steps for each app you wish to send to Huntress. Please give each newly configured app up to 30 minutes to begin sending logs, depending on how much activity the application is generating.
Frequently Asked Questions
Why do I see multiple Azure Resource IDs in my logs, but not a separate Huntress data source for each resource?
This is the expected behavior when multiple Azure resources are configured to send their telemetry through a shared Azure Monitor source.
While Huntress can see and process logs from distinct Azure Resource IDs, these individual resources will not automatically appear as separate, standalone data sources in the Huntress platform. Instead, Huntress mirrors exactly how Azure Monitor groups and delivers your telemetry.
Why does this happen?
This setup is highly common when Azure Diagnostic Settings are deployed at scale using Azure Policy or other centralized configuration methods.
The Flow: The Huntress integration uses Azure Diagnostic Settings to route your data to an Event Hub, where Huntress then collects it.
The Consolidation: If multiple resources are configured to stream to the same Event Hub/Azure Monitor source, they are consolidated into a single data stream. Huntress reflects this grouped structure rather than creating a 1:1 mapping for every single Azure resource.
How can I separate them?
If your organization requires each Azure resource to appear as a distinct data source in the Huntress platform, you will need to adjust your Azure logging configuration.
To achieve a 1:1 mapping, Azure logging must be configured to preserve resource-level separation (e.g., routing resources to dedicated endpoints) before the data is handed off to Huntress.
--