I was wondering if anyone had any experience in implementing Azure ATP as a log source for McAfee SIEM. Can anyone provide any work instructions on how to retrieve logs, and if Azure ATP supports forwarding syslog to the event receiver. if so what needs to be done?
I believe the Office 365 log collector can get this data.
These are recorded in the Graph/Management API as ThreatIntelligence* log types.
At a technical level, the event receiver connects to the Azure APIs at a regular interval to collect this data, so no 'forwarding' is needed. You will just need to configure a new SIEM application inside your Azure tenant.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.