This commit is contained in:
Joey Caparas 2017-03-22 16:00:52 -07:00
parent fd2fc7a44f
commit 45cbd98322

View File

@ -29,17 +29,18 @@ Enable security information and event management (SIEM) integration so you can p
2. Select **Enable SIEM integration**. This activates the **SIEM connector access details** section with pre-populated values and an application is created under you Azure Active Directory (AAD) tenant.
> [!WARNING]
> The client secret is only displayed once. Make sure you keep a copy of it in a safe place.
> For more information about getting a new secret see, [Learn how to get a new secret](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md#learn-how-to-get-a-new-client-secret).
WARNING:<br>
The client secret is only displayed once. Make sure you keep a copy of it in a safe place.<br>
For more information about getting a new secret see, [Learn how to get a new secret](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md#learn-how-to-get-a-new-client-secret).
3. Choose the SIEM type you use in your organization.
> [!NOTE]
> If you select HP ArcSight, you'll need to save these two configuration files:
> - WDATP-connector.jsonparser.properties
> - WDATP-connector.properties
> If you want to connect directly to the alerts REST API through programmatic access, choose **Generic API**.
NOTE:<br>
If you select HP ArcSight, you'll need to save these two configuration files:<br>
- WDATP-connector.jsonparser.properties
- WDATP-connector.properties <br>
If you want to connect directly to the alerts REST API through programmatic access, choose **Generic API**.
4. Copy the individual values or select **Save details to file** to download a file that contains all the values.