https://community.splunk.com/t5/Getting-Data-In/Microsoft-365-Defender-add-on-for-splunk/m-p/578564#M102158 <P>Hi,</P><P>This add-on is to ingest MCAS logs into splunk?</P><P>Or do we need to use syslog collectors to ingest the MCAS logs? and this add-on is to only ingest incidents and alserts?</P><P>&nbsp;</P> Thu, 16 Dec 2021 03:19:37 GMT VijaySrrie 2021-12-16T03:19:37Z https://community.splunk.com/t5/Getting-Data-In/Microsoft-365-Defender-add-on-for-splunk/m-p/578564#M102158 <P>Hi,</P><P>This add-on is to ingest MCAS logs into splunk?</P><P>Or do we need to use syslog collectors to ingest the MCAS logs? and this add-on is to only ingest incidents and alserts?</P><P>&nbsp;</P> Thu, 16 Dec 2021 03:19:37 GMT https://community.splunk.com/t5/Getting-Data-In/Microsoft-365-Defender-add-on-for-splunk/m-p/578564#M102158 VijaySrrie 2021-12-16T03:19:37Z https://community.splunk.com/t5/Getting-Data-In/Microsoft-365-Defender-add-on-for-splunk/m-p/578573#M102159 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/164779">@VijaySrrie</a>&nbsp;</P><P>Read this the description talk about MCAS however this doesn't do ingest them just for CIM -&nbsp;<A href="https://splunkbase.splunk.com/app/5278/" target="_blank">https://splunkbase.splunk.com/app/5278/</A></P><P>MCAS logs you would probably need syslog/ Splunk TCP/UDP to ingest.&nbsp;</P><P>Microsoft 365 Defender add-on as per the docs it ingest only Incidents &amp; Alerts.</P><P>---</P><P>An upvote would be appreciated if this reply helps!</P> Thu, 16 Dec 2021 03:53:18 GMT https://community.splunk.com/t5/Getting-Data-In/Microsoft-365-Defender-add-on-for-splunk/m-p/578573#M102159 venkatasri 2021-12-16T03:53:18Z