How to ingest Advanced Hunting events into Azure Event Hub and recreate incidents

Question

We want to use REST API to list incidents through Azure Event Hub where we could streamline advanced hunting events into it (if its possible).

What we now need to know is whether this API supports incidents (for MDI/MDO) or raw data. And if it’s the latter and the raw data is of an alert, can we then recreate an incident using only that data?

Any help would be highly appreciated.

Thanks

Answer 1

Hello @Patrik Jakus ,

Thanks for the question and using MS Q&A platfrom.

You may checkout the Raw Data Streaming API which helps ingest Advanced Hunting events into Azure Event Hub.

Hope this helps.