We are very excited to share that ‘ASC continuous export’ is now generally available for all ASC customers!
‘ASC continuous export’ allows for ASC alerts and recommendations to be consumed by a large variety of products, in addition to Azure portal and API. This new capability enables customers to leverage ASC for enterprise level scenarios.
Any customer can now stream alerts \ recommendations to multiple export targets such as Azure Event Hubs or Azure Log Analytics workspaces, which in turn enable integrations with 3rd party SIEMs, 3rd party solutions in real-time, Azure Data Explorer, custom Power BI dashboards and Azure Monitor alerts.
How is it configured?
In the Azure portal, under “Security Center -> Pricing and settings” customers are offered to configure continuous export for their subscription. They can choose the target of the export, as well as filter exported data by severity. More advanced filtering capabilities are available via REST API or ARM Deployment.
We are continuously monitoring feedback to improve the experience. We would love to hear your feedback!
Official documentation and examples can be found here.