Consume Azure ATP alerts via Microsoft Graph API

mstair 

You need to share telemetry between Defender for Identity and MCAS -> see integration here

1) https://docs.microsoft.com/en-US/cloud-app-security/mdi-integration

and

2) https://docs.microsoft.com/en-US/defender-for-identity/mcas-integration

then you can consume those 40~ alerts using MS-Graph API. All 40~ Defender for Identity / Azure ATP alerts --> https://docs.microsoft.com/en-US/defender-for-identity/suspicious-activity-guide?tabs=external

Then use the MS-Graph API to receive those events in a nice format --> https://docs.microsoft.com/en-US/graph/api/resources/security-api-overview?view=graph-rest-1.0

Here is the info-note:

*** Microsoft Defender for Identity alerts are available via the Microsoft Cloud App Security integration. This means you will get Microsoft Defender for Identity alerts only if you have joined Unified SecOps and connected Microsoft Defender for Identity into Microsoft Cloud App Security. Learn more about https://docs.microsoft.com/en-us/defender-for-identity/mcas-integration.