Question

A company runs a business-critical Azure SQL Database. The security team needs SQLSecurityAuditEvents retained for 7 years in a tamper-resistant, low-cost store for regulatory audits. The operations team needs the same audit and performance logs available for interactive KQL queries and correlation with other resources over a 90-day window. The finance team wants the raw log stream forwarded to an existing third-party SIEM hosted outside Azure in near real time. Which logging solution should you recommend to satisfy all three requirements with the least custom development?

Accepted Answer

Configure one diagnostic setting with three destinations: an immutable Azure Storage account for 7-year archival, a Log Analytics workspace for 90-day interactive analysis, and an Event Hub for streaming to the third-party SIEM.

Answer

Configure a single diagnostic setting that sends all logs to a Log Analytics workspace, then build scheduled export scripts to copy data to storage and the SIEM.

Answer

Enable only Log Analytics with 7-year data retention and use continuous export to feed the SIEM, satisfying all teams from a single workspace.

Answer

Send all logs to an Event Hub and let each team build a consumer application to route data to storage, analytics, and the SIEM as needed.