# Defender for Endpoint to Azure Event Hub to Elasticsearch?

**URL:** <https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578>\
**Category:** Elasticsearch\
**Created:** [November 22, 2022, 5:53pm UTC](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578 "2022-11-22T17:53:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [November 22, 2022, 5:53pm UTC](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578/1 "2022-11-22T17:53:31Z")

</div>

Our Defender for Endpoint Device tables are around 1TB a day, I'll never get the money to use Sentinel so I'm looking for an alternative.

Is there no way to use Azure Event Hubs with Elasticsearch? Stream the events from the Defender for Endpoint api to Azure Event Hub and then into an Elasticsearch cluster?

Is this even possible?  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2022, 5:54pm UTC](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578/2 "2022-12-20T17:54:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.