https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/fetching-microsoft-defender-for-office-365-alerts/m-p/581253#M3168 <P>Greetings!</P> <P>&nbsp;</P> <P>Has anyone had any success ingesting Microsoft Defender for Office 365 alerts into XSOAR?</P> <P>&nbsp;</P> <P>We're currently fetching MDE alerts using the Microsoft Defender for Endpoint integration. I'd think that, because they share a portal, MDO alerts would also be fetchable using this integration, but I haven't had any success.</P> <P>&nbsp;</P> <P>Microsoft's documentation makes it sound like MDO alerts are reachable via Microsoft XDR and Graph Security APIs.</P> <P>&nbsp;</P> <P><A href="https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide" target="_blank" rel="noopener">Security Operations Guide for Defender for Office 365 | Microsoft Learn</A></P> <P>&nbsp;</P> <P>As far as I know, there's no integration for XDR endpoints, but there is for Graph Security. I don't want to spend a ton of time spinning those up if it's not going to work though. Any insight is appreciated!</P> Thu, 21 Mar 2024 20:21:58 GMT BowenAguero 2024-03-21T20:21:58Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/fetching-microsoft-defender-for-office-365-alerts/m-p/581253#M3168 <P>Greetings!</P> <P>&nbsp;</P> <P>Has anyone had any success ingesting Microsoft Defender for Office 365 alerts into XSOAR?</P> <P>&nbsp;</P> <P>We're currently fetching MDE alerts using the Microsoft Defender for Endpoint integration. I'd think that, because they share a portal, MDO alerts would also be fetchable using this integration, but I haven't had any success.</P> <P>&nbsp;</P> <P>Microsoft's documentation makes it sound like MDO alerts are reachable via Microsoft XDR and Graph Security APIs.</P> <P>&nbsp;</P> <P><A href="https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide" target="_blank" rel="noopener">Security Operations Guide for Defender for Office 365 | Microsoft Learn</A></P> <P>&nbsp;</P> <P>As far as I know, there's no integration for XDR endpoints, but there is for Graph Security. I don't want to spend a ton of time spinning those up if it's not going to work though. Any insight is appreciated!</P> Thu, 21 Mar 2024 20:21:58 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/fetching-microsoft-defender-for-office-365-alerts/m-p/581253#M3168 BowenAguero 2024-03-21T20:21:58Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/fetching-microsoft-defender-for-office-365-alerts/m-p/582671#M3206 <P>Hey there! Have you tried using this integration?&nbsp;<A href="https://cortex.marketplace.pan.dev/marketplace/details/Microsoft365Defender/" target="_blank">https://cortex.marketplace.pan.dev/marketplace/details/Microsoft365Defender/</A></P> <P>&nbsp;</P> <P>This looks like it can pull what you wanted.&nbsp;</P> Thu, 04 Apr 2024 16:37:32 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/fetching-microsoft-defender-for-office-365-alerts/m-p/582671#M3206 BharathwajTiruputkuzhi 2024-04-04T16:37:32Z