> For the complete documentation index, see [llms.txt](https://msdocs.aohwv.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://msdocs.aohwv.com/quick-start/getting-started.md).

# Overview

## Quick Start

Connect your Microsoft cloud environment to your SIEM so your RedLegg SOC can see potential threats. Plan for about **2–3 hours** in total.

### Log Volume

More logs mean more cost. Ideally we want the **BEST** logs not just more logs.  Most SIEMs charge by **events or messages per second (EPS / MPS)** or by **data per day (GB/day)**, and the Azure Event Hub adds a small cost as volume grows. Turning everything on without a plan can raise your bill quickly.

**The highest-volume sources:**

| Source                                    | Volume         | Step   |
| ----------------------------------------- | -------------- | ------ |
| Defender XDR **Devices** events           | Very high      | Step 3 |
| Entra ID **NonInteractiveUserSignInLogs** | High           | Step 2 |
| Entra ID **MicrosoftGraphActivityLogs**   | High           | Step 2 |
| Microsoft 365 audit logs                  | Medium to high | Step 4 |
| Everything else                           | Low to medium  | —      |

**How to keep costs under control:**

* **Start with the high-value, lower-volume sources:** Entra ID sign-ins and audit logs, Defender alerts, and the Azure Activity Log.
* **Estimate before you add high-volume sources.** Step 3 includes a query that shows how many events each Defender table produces per day.
* **Filter at the SIEM**, for example dropping everyday Copilot use (Step 5).
* **Avoid duplicates.** Don't collect the same alerts from two places (see the Defender for Cloud note in Step 7).
* **Skip what doesn't help security.** This guide already leaves out raw Azure resource logs and Intune inventory for this reason.
* **Review volume monthly** with your SIEM provider and adjust.

{% hint style="info" %}
**Not sure what your volume will be?** RedLegg can help estimate your EPS/MPS and recommend which sources give you the most security value for the cost. See **Get Expert Help**.
{% endhint %}

### Steps

{% stepper %}
{% step %}

#### [Prerequisites](#prerequisites)

Confirm you have the admin roles, licenses and SIEM details you'll need.
{% endstep %}

{% step %}

#### [Step 1 — Event Hub Setup](#step-1-event-hub-setup)

Create the Event Hub your SIEM reads Microsoft logs from. *(15 min)*
{% endstep %}

{% step %}

#### [Step 2 — Entra ID](#step-2-entra-id)

Send sign-ins, directory changes and risky user data. *(10 min)*
{% endstep %}

{% step %}

#### [Step 3 — Defender XDR](#step-3-defender-xdr)

Stream alerts plus endpoint, email, identity and cloud app events. *(15 min)*
{% endstep %}

{% step %}

#### [Step 4 — Microsoft 365](#step-4-microsoft-365)

Collect inbox rules, mailbox access, file sharing and Teams activity. *(20 min)*
{% endstep %}

{% step %}

#### [Step 5 — Copilot](#step-5-copilot)

Keep Copilot admin changes and filter out everyday use. *(5 min)*
{% endstep %}

{% step %}

#### [Step 6 — Purview](#step-6-purview)

Add data loss prevention events and label changes. *(10 min)*
{% endstep %}

{% step %}

#### [Step 7 — Azure](#step-7-azure)

Connect Defender for Cloud and the Azure Activity Log. *(20 min)*
{% endstep %}

{% step %}

#### [Step 8 — Intune (optional)](#step-8-intune-optional)

Collect Intune admin actions like remote wipes and pushed scripts. *(5 min)*
{% endstep %}
{% endstepper %}

### When you're done

RedLegg willl show from every source above. If anything is missing, check the **Verify** section at the end of that step.

## Related

* [Why This Matters](/readme/why-cloud-logs-matter.md) — Why your SOC needs these logs
* [Top 10 Hardening Steps](/secure-and-measure/top-10-hardening-steps.md) — Secure your tenant while you're in there
* [Get Expert Help](/get-expert-help/overview.md) — RedLegg and AOHWV services


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://msdocs.aohwv.com/quick-start/getting-started.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.