Pulling activities from Azure ATP


Just wondering if there is a way to pull activities from Azure ATP?  I would like to  export of all activities of a certain type (for example user account changes) on a daily basis.


There doesn't seem to be any way to access the data that AATP collects to use for other purposes.


3 Replies

@Robert Young , You can go to the profile page of the entity and press "download activities".

There is not scheduling option for this though...


best response confirmed by Robert Young (Contributor)

@Robert Young 


If you want to see all activities for a specific user, as Eli mentioned you can do this from the entity profile page.


If you want to search for activities across entities, this is something that you will need to wait for the Unified Secops Portal which was announced at RSA. 

Unified SecOps:

The Unified Secops portal is currently in Limited Public Preview. 



Thanks, I was looking to pull from all entities...will check out the Pub review.