Microsoft Defender for Cloud Apps Event Collector

Collects the events log for alerts and activities provided Microsoft Defender for Cloud Apps API.

Analytics & SIEM · Microsoft Defender for Cloud Apps

Configuration parameters

  • endpoint_type — Endpoint Type
  • url — Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com) (required)
  • client_id — Client (Application) ID (required)
  • credentials — (required)
  • tenant_id — Tenant ID (required)
  • scope — Scope (required)
  • after — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • limit — Number of alerts for each fetch.
  • isFetchEvents — Fetch events
  • verify — Verify SSL Certificate
  • proxy — Use system proxy settings
  • event_types_to_fetch — Event types to fetch

Commands (2)

  • microsoft-defender-cloud-apps-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • microsoft-defender-cloud-apps-get-events

    Returns a list of alerts.