Customer is a leading Threat Intelligence solution provider.
They provide a platform for companies to aggregate and act upon Threat Intelligence.
Customer requested for the integration of their product with the Azure Active Directory logs
- Azure Monitor collects logs for Azure Active Directory, and streams the data to an Azure Event Hub. The Event Hub streams the logs collected by Azure Monitor to the Connector supported HTTP Source through an Azure function
- The Connector receives the events data and parses response data and writes in the LEEF format
- API Test methods and Selenium automation scripts were used to generate the Azure Active Directory events for testing