Forum Discussion

Hamid285's avatar
Hamid285
Copper Contributor
Nov 16, 2020

cloud app security and SIEM agent

Hello, We need to send our cloud app security alerts to our onpremise SIEM, we know that we can install a java program to setup cloud app security agent, by the way we ever used event HUB for AD azu...
Cloud App Security
SurVir's avatar
SurVir
Icon for Microsoft rankMicrosoft

BillTheKid, what are high availability options for setting up SIEM Agent Server? How do we make sure it is not single point of failure and can scale?

BillTheKid's avatar
BillTheKid
Brass Contributor
Jun 30, 2022

SurVir, you don't use it anymore more today (2 years later). You would integrate MDCA (previously known as MCAS) within MDE and use the Streaming API to get all raw-data via CloudAppEvents table (for MDCA raw data). Alerts are merged into AlertInfo table (for MDCA alerts) (for alerts you alternatively may use Graph-API) and Incidents would require Incidents API (for MDCA merged incidents). This gets you safe all the information and is scalable and has no point of failures when implementing correctly - forget the MCAS SIEM AGENT , this was before they went "XDR".

Resources