Need ATP integration with Phantom documentation

Question

Hi Team,

Can someone share some document for integrating ATP with phantom automation platform?

Thanks
Mridula

Answer 1

@Mridula Mishra
Microsoft ATP currently supports IBM QRadar and Micro Focus ArcSight through a dedicated SIEM integration model.

If you are talking about Splunk's Phantom, that is supported by a different integration model based on the new Alert API.

1) For the integration you will have to login to : https://df.securitycenter.microsoft.com/interoperability/partners and look for splunk :

2) Once selected you would need to download the ATP Add-on for Splunk :

Once done, you would need to import that data from splunk to Phantom.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.