I got the liberty to test the F5 XC GLR logs to Microsoft Sentinel for SIEM Integration. This use case is planned to give demo during App World by our Architects. F5 XC sends logs to the Microsoft tools such as Azure Event Hub, Blob Storage and we need to take help of another tools such as Log Analytic workspace, Azure SQL DB, Azure Functions or Logic apps are tedious process to integrate logs to Sentinel. This also involves more manual work and requires customers to have good expertise over these apps/services.

By direct Integration of F5 XC access, security events from GLR to Microsoft Sentinel results in better visualization of incidents and attacks. This helps customer to take faster decisions based on incidents. This gives customer to less worry about integration of tools mentioned above with the Sentinel. Also helps in leveraging our XC customers with Microsoft services.

Thanks,

Chaithanya