Apr 15 2020
- last edited on
Nov 02 2021
I noticed from a previous post (way back in September) that the MDATP streaming api was being assessed for possible integration with Sentinel. Is there any update to the possibility of this happening? I know there are ways around getting the data into Log Analytics, but it would be huge if we could get that telemetry in so that advanced hunting with that endpoint telemetry could be conducted within Sentinel.
Additionally, is there a recommended venue to get visibility on the Sentinel development roadmap?
Apr 15 2020 11:59 AM
Apr 15 2020 01:11 PM
@Thijs Lecomte I understand that it would potentially be quite expensive, and it certainly wouldn't be meant for everyone. I have seen the use of the CrowdStrike Data Replicator API with Splunk, and Red Canary has done fantastic work with Carbon Black data on the Splunk platform as well. It would be nice to have the ability to have MTP type cross product investigative/fusion capabilities within Sentinel with MDATP data.