XDR Analytics Data source

bridgetlitt — Thu, 15 May 2025 04:37:46 GMT

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-source/BitLocker-key-retrieval https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-source/Exchange-mailbox-audit-bypass In the Analytics Alert reference guide- there is a reference to "AzureAD Audit Log" and "Office 365 Audit". Which Collection Integrations do I have to use to get these logs? Looking to have full coverage over all the identity threat ITDR alerts that mentions Required data as "Office 365 Audit" and "AzureAD Audit Log". I think configuring all the options in both the Collection Integrations "Azure Event Hub" and "Office 365" might cause some duplicates which might affect analytics. Do anyone know what config I can use to only cover the ITDR alerts with required data mentioned as "Office 365 Audit" and "AzureAD Audit Log"?

Re: XDR Analytics Data source

nsinghvirk — Tue, 20 May 2025 17:07:54 GMT

Hello @bridgetlitt

Thanks for reaching out to us. In Office 365 log collection integration there is option to select Azure AD activity logs. Hence to avoid duplication of data Office 365 integration will be better.

topic XDR Analytics Data source in Cortex XDR Discussions

XDR Analytics Data source

Re: XDR Analytics Data source