deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-15 10:23:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

update table to fix numbering

Browse Source
This commit is contained in:
Joey Caparas
2016-07-27 19:34:12 +10:00
parent 96b2f8f213
commit 5a92db6171
2 changed files with 76 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md
View File

@ -47,13 +47,30 @@ The following steps assume that you have completed all the required steps in [Be
5. In the form fill in the following required fields with these values:
Field | Value
:---|:---
Configuration File | Type in the name of the client property file. It must match the client property file.
Events URL | `https://DataAccess-PRD.trafficmanager.net:444/api/alerts`
Authentication Type | OAuth 2
OAuth 2 Client Properties File | Select *wdatp-connector.properties*.
Refresh Token | Paste the refresh token that your Windows Defender ATP contact provided, or you the one you get after running the `restutil` tool.
<table>
<tbody style="vertical-align:top;">
<tr>
<th>Field</th>
<th>Value</th>
</tr>
<tr>
<td>Configuration File</td>
<td>Type in the name of the client property file. It must match the client property file.</td>
</tr>
<td>Events URL</td>
<td>`https://DataAccess-PRD.trafficmanager.net:444/api/alerts`</td>
<tr>
<td>Authentication Type</td>
<td>OAuth 2</td>
</tr>
<td>OAuth 2 Client Properties file</td>
<td>Select *wdatp-connector.properties*.</td>
<tr>
<td>Refresh Token</td>
<td>Paste the refresh token that your Windows Defender ATP contact provided, or you the one you get after running the `restutil` tool.</td>
</tr>
</tr>
</table>
All other values in the form are optional and can be left blank.
6. Select **Next**, then **Save**.

66
windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md
View File

@ -44,20 +44,58 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
> [!NOTE]
>All other values in the form are optional and can be left blank.
Field | Value
:---|:---
Endpoint URL | `https://DataAccess-PRD.trafficmanager.net:444/api/alerts`
HTTP Method | GET
Authentication Type | oauth2
OAuth 2 Token Refresh URL | Value taken from AAD application
OAuth 2 Client ID | Value taken from AAD application
OAuth 2 Client Secret | Value taken from AAD application
Response type | json
Response Handler | JSONArrayHandler
Polling Interval | Number of seconds that Splunk will ping the Windows Defender ATP endpoint. Accepted values are in seconds.
Set sourcetype | From list
Source type | \_json
<table>
<tbody style="vertical-align:top;">
<tr>
<th>Field</th>
<th>Value</th>
</tr>
<tr>
<td>Endpoint URL</td>
<td>https://DataAccess-PRD.trafficmanager.net:444/api/alerts</td>
</tr>
<td>Events URL</td>
<td>`https://DataAccess-PRD.trafficmanager.net:444/api/alerts`</td>
<tr>
<td>HTTP Method</td>
<td>GET</td>
</tr>
<td>Authentication Type</td>
<td>oauth2</td>
<tr>
<td>OAuth 2 Token Refresh URL</td>
<td> Value taken from AAD application</td>
</tr>
<tr>
<td>OAuth 2 Client ID</td>
<td>Value taken from AAD application</td>
</tr>
<tr>
<td>OAuth 2 Client Secret</td>
<td>Value taken from AAD application</td>
</tr>
<tr>
<td>Response type</td>
<td>json</td>
</tr>
<tr>
<td>Response Handler</td>
<td>JSONArrayHandler</td>
</tr>
<tr>
<td>Polling Interval</td>
<td>Number of seconds that Splunk will ping the Windows Defender ATP endpoint. Accepted values are in seconds.</td>
</tr>
<tr>
<td>Set sourcetype</td>
<td>From list</td>
</tr>
<tr>
<td>Source type</td>
<td>\_json</td>
</tr>
</tr>
</table>
After completing these configuration steps, you can go to the Splunk dashboard and run queries.