MDE_365 _Integration with SIEM(ArcSight)

Question

Hi All,

In my environment ,we have integrated Microsoft 365 defender (mde) -EDR with ArcSight ,in our case we receive only Alerts and Incidents events only in our ArcSight logs .which is creating more noise and we are not able to create any rule in ArcSight .So wanted to know if we can receive only incidents events from MDE console to ArcSight ?like only incidents events can be integrated with SIEM.

Thanks in Advance

Answer 1

I would think that incidents only would be an option. Can you recount how the ArcSight integration was setup initially? You can stream these alerts and incidents to Sentinel at no additional cost. Once option would be to link M365D to a Sentinel instance (just for this purpose). This could reveal additional options for ArcSight integration with more filtering options. For example, use the workspace data export to send the incidents table to an event hub.