Azure Sentinel Side by Side with QRadar

Occasional Visitor

Hi,

quick question:

 

in the "Event Filter" on Qradar we add:

vendorInformation/provider eq 'Azure Sentinel'

to get Sentinel events but is it possible to include another azure instances such as Cloud App, Identity, etc?

I mean, like:

provider eq 'Azure Sentinel, MCAS, IPS'

 

thank you

2 Replies

@Jesto001 A couple ways.

 

As a query example...

 

SecurityAlert
| where ProductName == "Microsoft Cloud App Security"

 

Using a filter in the UI (example in Incidents)...

 

prodname.png

also

SecurityAlert
| where ProductName in ("Microsoft Cloud App Security","product A","product B")