category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Defender for Cloud Apps Event Collector
  version: -1
configuration:
- additionalinfo: |-
    More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-defender-for-cloud-apps-event-collector
  display: Endpoint Type
  name: endpoint_type
  required: false
  type: 15
  section: Connect
  defaultvalue: Worldwide
  options:
  - Worldwide
  - US GCC
  - US GCC-High
- display: Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com)
  additionalinfo: In the Security Center, go to Settings > Clod Apps > About tab, where the API URL is displayed.
  name: url
  required: true
  type: 0
  section: Connect
- name: client_id
  required: true
  type: 0
  section: Connect
  additionalinfo: The Client (Application) ID to use to connect.
  display: Client (Application) ID
- name: credentials
  required: true
  type: 9
  section: Connect
  displaypassword: Client Secret
  hiddenusername: true
- display: Tenant ID
  name: tenant_id
  required: true
  type: 0
  section: Connect
- defaultvalue: '05a65629-4c1b-48c1-a78b-804c4abdd4af/.default'
  display: Scope
  name: scope
  type: 0
  section: Connect
  required: true
  additionalinfo: The scope of the application (only if self-deployed).
- defaultvalue: '3 days'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: after
  type: 0
  section: Collect
  required: false
- display: Number of alerts for each fetch.
  name: limit
  type: 0
  section: Collect
  required: false
  defaultvalue: '1000'
  additionalinfo: The number of events to retrieve. Events are retrieved in pages of up to 100 (the API page-size limit) until this number is reached.
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Verify SSL Certificate
  name: verify
  type: 8
  section: Connect
  advanced: true
  required: false
  defaultvalue: 'true'
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Event types to fetch
  name: event_types_to_fetch
  section: Collect
  type: 16
  defaultvalue: Alerts,Admin activities,Login activities
  options:
  - Alerts
  - Admin activities
  - Login activities
description: Collects the events log for alerts and activities provided Microsoft Defender for Cloud Apps API.
display: Microsoft Defender for Cloud Apps Event Collector
name: Microsoft Defender for Cloud Apps Event Collector
script:
  commands:
  - description: Returns a list of alerts. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    name: microsoft-defender-cloud-apps-get-events
    arguments:
    - description: The maximum number of events to return per event type. Events are retrieved in pages of up to 100 (the API page-size limit).
      defaultValue: '1000'
      name: limit
    - description: The first fetch time (<number> <time unit>, for example 12 hours, 1 day, 3 months).
      defaultValue: 3 days
      isArray: true
      name: after
    - auto: PREDEFINED
      default: true
      defaultValue: 'false'
      description: Whether to push the fetched event to XSIAM or not.
      name: should_push_events
      predefined:
      - 'false'
      - 'true'
    - name: event_types_to_fetch
      auto: PREDEFINED
      description: A comma-separated list of event types to scope this run to. If not provided, all configured event types are fetched.
      isArray: true
      predefined:
      - Alerts
      - Admin activities
      - Login activities
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: microsoft-defender-cloud-apps-auth-reset
    arguments: []
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/auth-utils:1.0.0.11671917
fromversion: 6.8.0
marketplaces:
- marketplacev2
- platform
tests:
- No Tests
supportedModules:
- xsiam