Microsoft Intune (v1.0.12)
Microsoft Intune is a family of endpoint management solutions that enable you to protect and administer all your endpoints from a single place.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- IT Services
Modeling rules (1)
- Microsoft Intune
Parsing rules (1)
- MicrosoftIntune Parsing Rule
README
Microsoft Intune
This pack includes Cortex XSIAM content.
Note: The logs will be stored in the dataset named msft_intune_raw.
To filter a query to focus only on Microsoft Intune logs, use the following filters:
-
In XQL queries, use: * filter _collector_name=* -
In Datamodel queries, use: * xdm.observer.name=*
Collect Events from Vendor
In order to use the collector, you need to use the following option:
To collect logs from Microsoft Intune, use the information described here to configure log streaming from Microsoft Intune to Azure Event Hub.
- Pay attention: Timestamp parsing is available for the default UTC (+0000) format for Microsoft Intune.
Azure Event Hub Integration
To create or configure the Azure Event Hub collector (to collect the logs you sent to Azure Event Hub), use the information described here.