MDATP Full Telemetry Ingestion

[kylemiller061]

I noticed from a previous post (way back in September) that the MDATP streaming api  was being assessed for possible integration with Sentinel. Is there any update to the possibility of this happening? I know there are ways around getting the data into Log Analytics, but it would be huge if we could get that telemetry in so that advanced hunting with that endpoint telemetry could be conducted within Sentinel.

Additionally, is there a recommended venue to get visibility on the Sentinel development roadmap?

[#2]

Ingesting full data in Sentinel will be really costly.
Can you not create the necessary alerts in MDATP?

[#3]

@Thijs Lecomte I understand that it would potentially be quite expensive, and it certainly wouldn't be meant for everyone. I have seen the use of the CrowdStrike Data Replicator API with Splunk, and Red Canary has done fantastic work with Carbon Black data on the Splunk platform as well. It would be nice to have the ability to have MTP type cross product investigative/fusion capabilities within Sentinel with MDATP data.

[#4 · Accepted solution]

Hi @kylemiller061

I'm Ely from the product group.

Getting MDATP data to Sentinel is indeed part of our roadmap and planned for the next few month

Thanks,