How to forward the Event Timeline entries from Defender for IoT ?

Rushikesh Kulkarni 0 Reputation points
2026-03-25T12:38:48.1233333+00:00

Dear team ,

I have configured a forwarding rule on Defender for IoT and set the Minimum Alert Level to Warning. It's not forwarding the event timeline data to the Syslog server.

Azure Internet of Things

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-03-25T12:39:07.1566667+00:00

    Event Timeline entries are not forwarded by Defender for IoT forwarding rules. Forwarding rules on OT sensors send alert information only, based on the minimum alert severity and other conditions configured in the rule.

    The documented forwarding behavior is:

    • Forwarding rules run only on alerts triggered after the rule is created.
    • The payload sent to SIEM/Syslog targets (ArcSight, NetWitness, LogRhythm, FortiSIEM, ServiceNow, generic Syslog) consists of alert fields such as alert title, severity, type, protocol, timestamps, source/destination IPs, and category.
    • There is no option in the forwarding rule configuration to include Event Timeline data; only alerts and (optionally, in some integrations) system/alert notifications are supported.

    To get Event Timeline–like visibility in downstream systems, configure forwarding rules to send alerts (and system notifications where available) and then use those alert records in the SIEM to approximate the timeline. Direct forwarding of Event Timeline entries themselves is not supported by the forwarding rules described in the available documentation.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. SRILAKSHMI C 19,735 Reputation points Microsoft External Staff Moderator
    2026-04-08T14:31:10.1+00:00

    Hello Rushikesh Kulkarni,

    Thanks for reaching out, understand the scenario you’re trying to achieve here.

    It sounds like you’re expecting Event Timeline entries (investigation-level events) to be forwarded via Syslog, but in Microsoft Defender for IoT this is not how forwarding is designed to work.

    Why Event Timeline data is not forwarded

    Syslog forwarding rules (even with Minimum Alert Level = Warning) only apply to:

    • Security alerts
    • Operational alerts

    Event Timeline entries:

    • Are part of the investigation view
    • Represent raw / contextual activity data
    • Are not classified as alerts

    Because of this, timeline entries are not picked up by Syslog forwarding rules, regardless of severity settings.

    Current behavior

    Syslog forwarding in Defender for IoT is alert-driven, not event-stream driven That’s why timeline data is not being sent to your Syslog server.

    Options for accessing Event Timeline data

    If you need deeper visibility beyond alerts, here are the recommended approaches:

    1. Export Event Timeline to CSV

    Use the Export option from the Event Timeline page in the sensor console

    You can export filtered or full datasets for analysis

    Please refer this https://learn.microsoft.com/azure/defender-for-iot/organizations/how-to-track-sensor-activity#export-the-event-timeline-to-csv

    2. Use Defender for IoT APIs

    You can programmatically retrieve event timeline data

    Useful for Custom reporting

    Building your own forwarding logic

    Integrating with external systems

    3. Integrate with SIEM

    Forward alerts and related data into a SIEM like Microsoft Sentinel

    Build Analytics rules, Workbooks, Playbooks

    While timeline data itself isn’t directly forwarded, you can correlate alerts with additional context

    Please refer this

    Your configuration is correct this behavior is by design. However, for use cases like real-time monitoring or deeper investigation pipelines, this does highlight a gap in native forwarding capabilities.

    I Hope this helps. Do let me know if you have any further queries.

    If this answers your query, please do click Accept Answer and Yes for was this answer helpful.

    Thank you!

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.