How best to ingest Microsoft Defender ATP events?

[jwalzerpitt]

Microsoft Defender ATP (MDATP) events can be sent to a blob storage account or an Event Hub. I was wondering if anyone is collecting MDATP events either way and how the setup was to parse the events?

Thx

[jwalzerpitt · Accepted solution]

I ended up using the Microsoft Azure Add on for Splunk (https://splunkbase.splunk.com/app/3757/), which was straight forward and easy to configure.

[iamkilarunaresh]

Please take a look at this app : https://splunkbase.splunk.com/app/5038/ you can onboard the data using the Modular inputs. 

[jwalzerpitt]

Thx for the link, but this add-on is only collecting MDATP alerts and not the actual events