A financial services company runs several Azure SQL databases and virtual machines. The security operations team uses a third-party SIEM product hosted outside Azure that ingests events in near real time through a streaming endpoint. The architect must recommend how to route Azure resource logs (diagnostic logs) to this external SIEM with the lowest latency while avoiding custom polling agents. Which destination should be configured in the diagnostic settings?