Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

MDATP Full Telemetry Ingestion

Brass Contributor

I noticed from a previous post (way back in September) that the MDATP streaming api  was being assessed for possible integration with Sentinel. Is there any update to the possibility of this happening? I know there are ways around getting the data into Log Analytics, but it would be huge if we could get that telemetry in so that advanced hunting with that endpoint telemetry could be conducted within Sentinel.

 

Additionally, is there a recommended venue to get visibility on the Sentinel development roadmap?

3 Replies
Ingesting full data in Sentinel will be really costly.
Can you not create the necessary alerts in MDATP?

@Thijs Lecomte I understand that it would potentially be quite expensive, and it certainly wouldn't be meant for everyone. I have seen the use of the CrowdStrike Data Replicator API with Splunk, and Red Canary has done fantastic work with Carbon Black data on the Splunk platform as well. It would be nice to have the ability to have MTP type cross product investigative/fusion capabilities within Sentinel with MDATP data.

best response confirmed by kylemiller061 (Brass Contributor)
Solution

Hi @kylemiller061

 

I'm Ely from the product group.

Getting MDATP data to Sentinel is indeed part of our roadmap and planned for the next few month

 

Thanks,

1 best response

Accepted Solutions
best response confirmed by kylemiller061 (Brass Contributor)
Solution

Hi @kylemiller061

 

I'm Ely from the product group.

Getting MDATP data to Sentinel is indeed part of our roadmap and planned for the next few month

 

Thanks,

View solution in original post