Microsoft Entra ID - Ingest Identity Alerts as Custom Detections
Details
Ingests Microsoft Entra ID Identity Alerts into Cisco XDR as Custom Security Events, normalized as Detections in the XDR Data Warehouse. These detections participate in XDR’s correlation pipeline, enabling native incident creation automatically.
Description
Install the Workflow
-
Click Install
- Important: no manual Workflow configuration is required.
-
After installation, run the Workflow manually once.
-
Workflow transforms Microsoft Entra ID Risk Alerts into Custom Security Events
-
Events are stored as Detections
-
Detections automatically participate in:
- Correlation
- Incident generation
-
-
Verification
- Navigate to Detections Viewer in Cisco XDR
- Confirm that:
- Checks are being ingested as Detections
- Detections may be correlated into Incidents
Notes
- This Workflow demonstrates the art of the possible using XDR Automate
- A native integration between Cisco XDR and Cisco Identity Intelligence is on the roadmap
- All generated configuration can be reviewed and modified after bootstrap if needed
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- Microsoft Entra ID
- Cisco XDR
About
- Author
- Oxana Sannikova
- Version
- v1.0
- Intent
- Custom Security Event
- Integration
- Average rating
- No ratings yet
- Authorship
- Community
Contact and support information
External links
Related workflows
Cisco Managed
This workflow appears in the pivot menu and allows you to disable a user in Microsoft Entra ID using their email or username.
Cisco Managed
This incident response workflow allows you to disable one or more users in Microsoft Entra ID from a playbook.
Cisco Managed
This workflow appears in the pivot menu and allows you to enable a user in Microsoft Entra ID using their email or username.
Cisco Managed
This incident response workflow allows you to enable one or more users in Microsoft Entra ID from a playbook.