We are about to upgrade ATA to MDI and add ADFS in the mix. We leverage Big-IP F5 as a Web Authentication Proxy for ADFS.
Can we include the signals from the F5s in MDI? If not, is there a way we can improve detections from Sentinel by combining F5 logs with MDI? Any other options?
