Microsoft Defender for Cloud Event Collector

XSIAM collector for Microsoft Defender for Cloud alerts.

Analytics & SIEM · Microsoft Defender for Cloud

Configuration parameters

  • server_url — Microsoft Azure Management URL
  • client_id — (required)
  • tenant_id — (required)
  • enc_key — (required)
  • certificate_thumbprint —
  • private_key — Private Key
  • sub_id — (required)
  • first_fetch — First fetch time interval
  • unsecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (2)

  • ms-defender-for-cloud-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • ms-defender-for-cloud-get-events

    Lists alerts for the subscription according to the specified filters.