Event details
IRM is great in correlation of the signals in M365 and showing the relations of the event rising alerts.... what is your suggestion how to include the SOC team, which is not natively working with the Purview portal but out of Sentinel... For bigger organizations the UI in purview portal is not very efficient. Are they plans to include the same correlation details and views in Sentinel?
- Heather_Poulsen
Community Manager
Thanks for participating in the Tech Accelerator! For reference, the panel covered this topic at around 15:30. - Patrick_David
Microsoft
Insider Risk Management can send signals to Sentinel today when they opt into sending these to the O365 Management APIs which can help SOC teams. https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-settings?view=o365-worldwide#export-alerts. We would love to hear more about the use case. - IRM integration is actually in Preview inside the Sentinel so that you can utilize that data. But you need to remember about the privacy and anonymity of the potential IRM users (from the top of the org as C-level, across admins, privileged users, and departing users). There are regulations in several countries where, when you investigate IRM you cannot have knowledge of who is the user.
