Hello,
we are struggling to integrate Azure Sentinel to QRoC over MS Sentinel Universal Cloud REST API connector workflow described here Universal Cloud REST API connector workflow for Microsoft Sentinel. Integration works properly (on network level). However we are facing problems once incidents are pulled from MS Sentinel API to QRoC. Incidents are pulled randomly and not always all of them.
I did quick test with Postman utility where I query MS Sentinel API and all incidents are fetched properly. The same with QRoC feature for connection testing. In both cases incidents are fetched. We asked MS for support but no luck. Our observation is that there is a problem with query in the workflow...
Did somebody else had this issue? Please, do you have somebody workflow which is working properly?
Thank you for hints/tips/tricks...
| Ibm |
remove preview |
|
| Universal Cloud REST API connector workflow for Microsoft Sentinel |
| You can customize your workflow and workflow parameters based on the default workflow. |
| View this on Ibm > |
|
|
.
------------------------------
Lubos Chupac
------------------------------