This commit is contained in:
Joey Caparas 2017-01-13 15:46:29 -08:00
parent 24d3dfd298
commit 3290200b90
3 changed files with 10 additions and 18 deletions

View File

@ -48,26 +48,18 @@ You need to add an application in your Azure Active Directory (AAD) tenant then
12. Type the following URLs in the **Reply URL** field: 12. Type the following URLs in the **Reply URL** field:
- Depending on the location of your datacenter, select either the EU or the US URL: - `https://DataAccess-PRD.trafficmanager.net:444/api/FetchAccessTokenFromAuthCode`
- For EU: `https://wdatp-alertexporter-eu.securitycenter.windows.com/api/FetchAccessTokenFromAuthCode`
- For US: `https://wdatp-alertexporter-us.securitycenter.windows.com/api/FetchAccessTokenFromAuthCode`
- `https://localhost:44300/WDATPconnector` - `https://localhost:44300/WDATPconnector`
13. Click **Save** and copy the key in a safe place. You'll need this key to authenticate the client application on Azure Active Directory. 13. Click **Save** and copy the key in a safe place. You'll need this key to authenticate the client application on Azure Active Directory.
14. Open a web browser and connect to the following URL: <br> 14. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=<clientID>&tenantId=<tenant ID>&clientSecret=1234`<br>
- For EU:
```text
https://wdatp-alertexporter-eu.securitycenter.windows.com/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234
```
- For US:
```text
https://wdatp-alertexporter-us.securitycenter.windows.com/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234
```
An Azure login page appears. An Azure login page appears.
> [!NOTE] > [!NOTE]
> - Replace *clientID* with your client ID.
> - Replace *tenant ID* with your actual tenant ID. > - Replace *tenant ID* with your actual tenant ID.
> - Keep the client secret as is. This is a dummy value, but the parameter must appear. > - Keep the *clientSecret* as is. This is a dummy value, but the parameter must appear.
15. Sign in with the credentials of a user from your tenant. 15. Sign in with the credentials of a user from your tenant.

View File

@ -69,7 +69,7 @@ The following steps assume that you have completed all the required steps in [Be
<td>Type in the name of the client property file. It must match the client property file.</td> <td>Type in the name of the client property file. It must match the client property file.</td>
</tr> </tr>
<td>Events URL</td> <td>Events URL</td>
<td>For EU: https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts </br></br> For US: https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts</td> <td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**: https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts </br>**For US:** https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts</td>
<tr> <tr>
<td>Authentication Type</td> <td>Authentication Type</td>
<td>OAuth 2</td> <td>OAuth 2</td>

View File

@ -56,7 +56,7 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
</tr> </tr>
<tr> <tr>
<td>Endpoint URL</td> <td>Endpoint URL</td>
<td>For EU: https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts </br></br> For US: https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts</td> <td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**: https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts </br>**For US:** https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts
</tr> </tr>
<tr> <tr>