Forum Discussion

KashifKloudy's avatar
KashifKloudy
Copper Contributor
Jan 25, 2024

Ingesting Purview compliance DLP logs to Splunk

We are in the process of enabling Microsoft purview MIP DLP for a large-scale enterprise, and there is a requirement to push MIP DLP related alerts, incidents and data to Splunk SIEM. Could not find any specific documentation for the same. researched on this and found below solutions however not sure which could work to fit in our requirement:

Above mentioned steps do not explain much about Ingestion of MIP DLP raw data or incidents. If anyone has done it in the past I will appreciate any input.

 

Resources