How to connect the Microsoft Defender XDR event logs using the API?

Robbe Willeme 0 Reputation points
2024-08-12T14:42:15.0433333+00:00

I'm currently working on automating the deployment of a Microsoft Sentinel workspace using PowerShell scripts. So far, I have successfully used the Microsoft.SecurityInsights API to install solutions and enable analytic rules. Now, I am looking to connect various data connectors, particularly for Microsoft Defender XDR, using ARM templates.

I've been able to connect incidents and alerts, but I'm having difficulty automating the connection of specific event log tables (e.g., DeviceInfo, DeviceEvents, EmailEvents, etc.). I discovered that Azure uses a different API endpoint to connect these event logs when I manually configure it. But when trying to automate this process via the same API call that azures uses, I received an error indicating that an application context cannot access the API and that a user context is required.

Is there a recommended approach to fully automate the process of connecting these event logs, or is user interaction necessary at some stage?

Azure API Management
Azure API Management
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
2,105 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,130 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.