Microsoft 365 Defender add-on for splunk

[VijaySrrie]

Hi,

This add-on is to ingest MCAS logs into splunk?

Or do we need to use syslog collectors to ingest the MCAS logs? and this add-on is to only ingest incidents and alserts?

[venkatasri]

Hi @VijaySrrie 

Read this the description talk about MCAS however this doesn't do ingest them just for CIM - https://splunkbase.splunk.com/app/5278/

MCAS logs you would probably need syslog/ Splunk TCP/UDP to ingest. 

Microsoft 365 Defender add-on as per the docs it ingest only Incidents & Alerts.

---

An upvote would be appreciated if this reply helps!