Blog Post

Microsoft Sentinel Blog
3 MIN READ

Analyzing Endpoints Forensics - Azure Sentinel Connector

Hesham_Saad's avatar
Hesham_Saad
Icon for Microsoft rankMicrosoft
Oct 10, 2021
Overview & Use Case   Thanks to WarrenZA , Jason_Baxter & paulrob for the brainstorming, technical contributing, and proof reading!   The field of Endpoint forensics seeks to help investigato...
Updated Oct 09, 2021
Version 1.0
Jason Baxter's avatar
Jason Baxter
Copper Contributor
Jan 21, 2022

EhrenSchmidt , Thanks for reaching out.  The general concept is to Authenticate via an App Registration & Client App ID & secret. You can then decide to store this in Azure Keyvault and adjust the Logic App Accordingly. You set this in the HTTP Connector under the Authentication via Oauth. And then you get the Auth token.
The playbook  has the necessary code & queries for  MDE as in the screenshots above.
@Warrenza might be able to help further in this regard.