Security Onion & Azure AD Logs

Hi All,

Some context, our company decided a commercial SIEM (Splunk) was no longer affordable and switched us to Security Onion. I am looking at how to integrate the Azure AD logs into SO but the documentation is not much out there.

Anyone have any links or suggestions on how to easily do this?

azure azure ad commercial context cybersecurity documentation integrate links logs onion security siem splunk