This commit is contained in:
dicolanl 2021-06-16 00:57:53 +00:00
Родитель 525d001024
Коммит 62407ea70c
2 изменённых файлов: 4 добавлений и 4 удалений

Просмотреть файл

@ -8,11 +8,11 @@ Also it automatically add this information to the incident as comments and chang
Prerequisite:
This logic app use Oauth2 to authenticate against MDATP API:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/apis-intro
https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro
Please follow this documentation to create AAD app and give the Permissions based on this article:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities#permissions
https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities#permissions
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FEnrich-SentinelIncident-MDATPTVM%2Fazuredeploy.json)
[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FEnrich-SentinelIncident-MDATPTVM%2Fazuredeploy.json)

Просмотреть файл

@ -1,12 +1,12 @@
# Ingest Office 365 Management Activity API Data
Author: Pete Bryan
This playbook ingests Audit.General events from the Office 365 Management Activity API (https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference) and writes them to a custom log table called O365API_CL.
This playbook ingests Audit.General events from the Office 365 Management Activity API (https://docs.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference) and writes them to a custom log table called O365API_CL.
There are a number of pre-configuration steps required before deploying the Logic App.
## Enable Office 365 Audit Logging
In order to collected Audit events from an Office 365 subscription you first need to enable audit logging. There are several ways to do this: https://docs.microsoft.com/en-us/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide
In order to collected Audit events from an Office 365 subscription you first need to enable audit logging. There are several ways to do this: https://docs.microsoft.com/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide
## Register an Azure AD App
1. Go to Azure Active Directory / App Registrations