Azure Sentinel Side by Side with QRadar

[Jesto001]

Hi,

quick question:

in the "Event Filter" on Qradar we add:

vendorInformation/provider eq 'Azure Sentinel'

to get Sentinel events but is it possible to include another azure instances such as Cloud App, Identity, etc?

I mean, like:

provider eq 'Azure Sentinel, MCAS, IPS'

thank you

[#2]

@Jesto001 A couple ways.

As a query example...

SecurityAlert
| where ProductName == "Microsoft Cloud App Security"

Using a filter in the UI (example in Incidents)...

[#3]

also

SecurityAlert
| where ProductName in ("Microsoft Cloud App Security","product A","product B")