As recently announced by MTP, we are happy to share that Azure ATP and Cloud App Security data is now available in MTP’s advanced hunting feature through 3 new tables - IdentityQueryEvents ; IdentityLogonEvents and AppFileEvents.
Hunting over identity and application activities augments our existing investments in improving MTP capabilities such as incident correlation and automatic incident response with Azure ATP and Cloud App Security capabilities
But this is just the beginning -- we are working hard on add more activities to Advanced hunting as well as exposing additional user information to enable even more powerful queries, stay tuned!
You can read the announcement here.
