Microsoft Defender for Cloud Apps Event Collector
Collects the events log for alerts and activities provided Microsoft Defender for Cloud Apps API.
- Category
- Analytics & SIEM
- Pack
- MicrosoftCloudAppSecurity
Configuration parameters
- endpoint_type — Endpoint Type
- url — Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com) (required)
- client_id — Client (Application) ID (required)
- credentials — (required)
- tenant_id — Tenant ID (required)
- scope — Scope (required)
- after — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
- limit — Number of alerts for each fetch.
- isFetchEvents — Fetch events
- eventFetchInterval — Events Fetch Interval
- verify — Verify SSL Certificate
- proxy — Use system proxy settings
- event_types_to_fetch — Event types to fetch
Commands (2)
- microsoft-defender-cloud-apps-auth-reset — Run this command if for some reason you need to rerun the authentication process.
- microsoft-defender-cloud-apps-get-events — Returns a list of alerts. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.