Microsoft Sentinel - Export XDR Detection Findings
Details
This workflows exports XDR detection findings to Microsoft Sentinel every 5 minutes using a schedule automation rule.
Description
This workflows exports XDR detection findings to Microsoft Sentinel every 5 minutes using a schedule automation rule. More information about the XDR Query API and its schemas can be found here: https://developer.cisco.com/docs/cisco-xdr/exporting-xdr-detection-findings-exporting-xdr-detection-findings/
Targets: Query APIs, Microsoft Sentinel Ingestion
Steps:
- Calculate and format the necessary timestamps
- For each page of findings:
- Fetch this page of findings
- For each finding returned, fetch its events and export them to Sentinel
- Check if there's a next page
- If there isn't, end the loop
- If there is, update the paging variables
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- Microsoft Sentinel
- Cisco XDR
About
- Author
- Cisco
- Version
- v1.4
- Integration
- Average rating
- No ratings yet
- Authorship
- Cisco Managed
Contact and support information
External links
Related workflows
Cisco Managed
This incident response workflow allows you to export summary of an XDR incident to a Microsoft Sentinel custom table from a playbook or using an automation rule.