Forum Discussion

Copper Contributor

Sep 26, 2019

Azure ATP alerts from MCAS and Graph

Hi, for my current customer we are trying to integrate O365 ATP and Azure ATP alerts into their current SIEM. we have enabled the MCAS integration for Azure ATP. this enables us to get the security ...

Astrid McClean

Microsoft

Sep 27, 2019

FrankM670

Hi Frank,

While the ExternalID is not available in the MCAS version of the syslog alert, today the unique alert id is available. For example:

Note that in the MCAS version of the alerts, the external ID field is the alert id, not the alert type id (which is what Azure ATP used).

Regards,

Astrid

FrankM670
Copper Contributor
Sep 30, 2019
Astrid McClean ,

Thanks for that! is there a list of those ID's that we van map back to an Alert? like there is for the externalID in the syslog messages? as i assume it is still not advised to filter on descriptions as these might be updated.
thanks.
- Segun160
  Copper Contributor
  Feb 17, 2020
  FrankM670 Did you manage to solve this ? can you please help with how you did ?
  - Astrid McClean
    Microsoft
    Feb 18, 2020
    Segun160
    
    All the unique ids have now been documented here: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/suspicious-activity-guide?tabs=external#security-alert-name-mapping-and-unique-external-ids
    
    See the Cloud App Security IDs tab for the names you see via MCAS and the Graph API.
Segun160
Copper Contributor
Feb 17, 2020
Astrid McClean I am having the same issues working with Log integration to an external SIEM, can you please help with how to get a list of available unique alert id

Forum Discussion

Azure ATP alerts from MCAS and Graph

Share

Resources