For private and public cloud environments a lightweight “log collector” VM is installed in your datacenter environment; the log collector receives logs from any source (virtual or physical) with an IP Address.  Examples:  network devices, virtual and/or physical servers, cloud VM’s, etc.  Normally, your VMs and devices send the logs directly to our Managed SIEM via HTTPS encrypted outbound connections.
For SaaS environments (Example: Microsoft Office 365) we configure logs to be sent directly from the SaaS application to the Managed SIEM via encrypted connections (varies per SaaS application).