I have a couple of session policies (block downloads/block malware uploads) and one access policy (blocking access from unmanaged devices) set up in MCAS (or now Microsoft Defender for Cloud Apps).
An issue I have is that the policies ONLY forward alerts to Microsoft Sentinel, when they are closed in MCAS. They are not 'raising' alerts for any other possible trigger.
The alerts syncing is switched on in MCAS (or Microsoft Defender for Cloud Apps) AND SecurityAlert logs appear in Sentinel.
Has anyone come across this where NOT all Alerts in MCAS are sent on to a SIEM such as Sentinel?
WHAT is the best practice to ensure alerts are triggered in an MCAS policy? Is this primarily defined from rule definitions, alert thresholds, filter and governance actions, policy severity settings?
Thanks in advance
