To send audit events to log forwarding endpoints

1. On the left, select Security > Security events.
2. On the top right, select Security events settings.
3. Enable the Send the audit events to log forwarding endpoints option.

   After you enable the option, the Select endpoints and categories option displays.

4. Select the Select endpoints and categories option to see the log forwarding endpoints that are configured in your environment and the available audit categories.

   Example of an endpoint: Azure Sentinel.

5. Select the appropriate log forwarding endpoints.
6. Select the Select audit event categories option.
7. Select the categories of the audit events that you want to forward to the selected endpoints. For example, Alert, Anomaly, etc.
8. After you select your log forwarding endpoint, the options to specify the associated credentials display. You can either add new credentials for the endpoint or select the existing credentials.