topic Re: How best to ingest Microsoft Defender ATP events? in Getting Data In

How best to ingest Microsoft Defender ATP events?

jwalzerpitt — Wed, 02 Sep 2020 15:34:32 GMT

Microsoft Defender ATP (MDATP) events can be sent to a blob storage account or an Event Hub. I was wondering if anyone is collecting MDATP events either way and how the setup was to parse the events?

Thx

Re: How best to ingest Microsoft Defender ATP events?

iamkilarunaresh — Wed, 02 Sep 2020 15:49:40 GMT

Please take a look at this app : https://splunkbase.splunk.com/app/5038/ you can onboard the data using the Modular inputs.

Re: How best to ingest Microsoft Defender ATP events?

jwalzerpitt — Wed, 02 Sep 2020 15:57:52 GMT

Thx for the link, but this add-on is only collecting MDATP alerts and not the actual events

Re: How best to ingest Microsoft Defender ATP events?

jwalzerpitt — Thu, 10 Sep 2020 14:25:02 GMT

I ended up using the Microsoft Azure Add on for Splunk (https://splunkbase.splunk.com/app/3757/), which was straight forward and easy to configure.