Ingest Azure Activity Logs

[Mireia]

Good afternoon!

I want to ingest Azure Activity Logs into our Chronicle instance. For that, I have found the following guide: Ingest Azure Activity Logs  |  Chronicle  |  Google Cloud

This guide explains how to obtain those logs but using 'shared key'. It worked fine for me too...but instead of doing it this way, I would like to do it using 'SAS token'.

I do not know the correct way to fill in the feed fields.

I have tried many ways (with simple URI, SAS URL...) but I have not been able to connect it correctly.

Has anyone been able to do this using 'SAS token'? If so, how have you filled in the feed fields?

Thanks!