Consume Azure ATP alerts via Microsoft Graph API

%3CLINGO-SUB%20id%3D%22lingo-sub-1221996%22%20slang%3D%22en-US%22%3EConsume%20Azure%20ATP%20alerts%20via%20Microsoft%20Graph%20API%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1221996%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20style%3D%22font-size%3A%2011.0pt%3B%20font-family%3A%20'Segoe%20UI'%2Csans-serif%3B%22%3EWondering%20how%20to%20consume%20your%20Azure%20ATP%20alerts%3F%20Check%20out%20our%26nbsp%3B%3CU%3E%3CA%20title%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fresources%2Fsecurity-api-overview%3Fview%3Dgraph-rest-1.0%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fresources%2Fsecurity-api-overview%3Fview%3Dgraph-rest-1.0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%20style%3D%22color%3A%20%236888c9%3B%22%3EMicrosoft%20Graph%20API%3C%2FSPAN%3E%3C%2FA%3E%26nbsp%3B%3C%2FU%3Eintegration.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-size%3A%2011.0pt%3B%20font-family%3A%20'Segoe%20UI'%2Csans-serif%3B%22%3EOnce%20you%20enable%20%3CU%3E%3CA%20title%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Faatp-integration%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Faatp-integration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%20style%3D%22color%3A%20%236888c9%3B%22%3Eour%20integration%20with%20Cloud%20App%20Security%3C%2FSPAN%3E%3C%2FA%3E%3C%2FU%3E%2C%20all%20Azure%20ATP%20alerts%20can%20be%20consumed%20through%20the%20API.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-size%3A%2011.0pt%3B%20font-family%3A%20'Segoe%20UI'%2Csans-serif%3B%22%3EFor%20each%20alert%20you%20get%20its%20title%2C%20description%2C%20and%20entities.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-size%3A%2011.0pt%3B%20font-family%3A%20'Segoe%20UI'%2Csans-serif%3B%22%3EPlease%20share%20your%20feedback%26nbsp%3Bwith%20us!%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2115981%22%20slang%3D%22en-US%22%3ERe%3A%20Consume%20Azure%20ATP%20alerts%20via%20Microsoft%20Graph%20API%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2115981%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F104809%22%20target%3D%22_blank%22%3E%40Tali%20Ash%3C%2FA%3E%2C%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Faatp-integration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Faatp-integration%3C%2FA%3E%20link%20is%20a%20404.%20Is%20there%20updated%20documentation%20for%20integration%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2116418%22%20slang%3D%22en-US%22%3ERe%3A%20Consume%20Azure%20ATP%20alerts%20via%20Microsoft%20Graph%20API%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2116418%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F423024%22%20target%3D%22_blank%22%3E%40mstair%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20need%20to%20share%20telemetry%20between%20Defender%20for%20Identity%20and%20MCAS%20-%26gt%3B%20see%20integration%20here%3C%2FP%3E%3CP%3E1)%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fcloud-app-security%2Fmdi-integration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fcloud-app-security%2Fmdi-integration%3C%2FA%3E%3C%2FP%3E%3CP%3Eand%3C%2FP%3E%3CP%3E2)%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fdefender-for-identity%2Fmcas-integration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fdefender-for-identity%2Fmcas-integration%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethen%20you%20can%20consume%20those%2040~%20alerts%20using%20MS-Graph%20API.%20All%2040~%20Defender%20for%20Identity%20%2F%20Azure%20ATP%20alerts%20--%26gt%3B%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fdefender-for-identity%2Fsuspicious-activity-guide%3Ftabs%3Dexternal%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fdefender-for-identity%2Fsuspicious-activity-guide%3Ftabs%3Dexternal%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThen%20use%20the%20MS-Graph%20API%20to%20receive%20those%20events%20in%20a%20nice%20format%20--%26gt%3B%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fgraph%2Fapi%2Fresources%2Fsecurity-api-overview%3Fview%3Dgraph-rest-1.0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fgraph%2Fapi%2Fresources%2Fsecurity-api-overview%3Fview%3Dgraph-rest-1.0%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20is%20the%20info-note%3A%3C%2FP%3E%3CP%3E***%20Microsoft%20Defender%20for%20Identity%20alerts%20are%20available%20via%20the%20Microsoft%20Cloud%20App%20Security%20integration.%20This%20means%20you%20will%20get%20Microsoft%20Defender%20for%20Identity%20alerts%20only%20if%20you%20have%20joined%26nbsp%3BUnified%20SecOps%20and%20connected%20Microsoft%20Defender%20for%20Identity%20into%20Microsoft%20Cloud%20App%20Security.%20Learn%20more%20about%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdefender-for-identity%2Fmcas-integration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehow%20to%20integrate%20Microsoft%20Defender%20for%20Identity%20and%20Microsoft%20Cloud%20App%20Security%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Wondering how to consume your Azure ATP alerts? Check out our Microsoft Graph API integration.

 

Once you enable our integration with Cloud App Security, all Azure ATP alerts can be consumed through the API.

 

For each alert you get its title, description, and entities.

 

Please share your feedback with us!

2 Replies

Hi @Tali Ash, the https://docs.microsoft.com/en-us/cloud-app-security/aatp-integration link is a 404. Is there updated documentation for integration?

@mstair 

 

You need to share telemetry between Defender for Identity and MCAS -> see integration here

1) https://docs.microsoft.com/en-US/cloud-app-security/mdi-integration

and

2) https://docs.microsoft.com/en-US/defender-for-identity/mcas-integration

 

then you can consume those 40~ alerts using MS-Graph API. All 40~ Defender for Identity / Azure ATP alerts --> https://docs.microsoft.com/en-US/defender-for-identity/suspicious-activity-guide?tabs=external

 

Then use the MS-Graph API to receive those events in a nice format --> https://docs.microsoft.com/en-US/graph/api/resources/security-api-overview?view=graph-rest-1.0

 

Here is the info-note:

*** Microsoft Defender for Identity alerts are available via the Microsoft Cloud App Security integration. This means you will get Microsoft Defender for Identity alerts only if you have joined Unified SecOps and connected Microsoft Defender for Identity into Microsoft Cloud App Security. Learn more about how to integrate Microsoft Defender for Identity and Microsoft Cloud App Security.