Skip to main content

CollectorsCloud Collectors Administration Guide

Migrate the Microsoft Security Alerts Cloud Collector

The Microsoft Security Alerts Cloud Collector enables you to ingest security alert logs into the Exabeam Security Operations Platform and use the Search service to find specific events in those logs.

If you previously used the Azure Cloud Connector that was part of the SaaS Cloud Connectors, migration to the Cloud Collectors service is recommended. Before you migrate, consider the following:

  • License Requirements: No additional license is required. The Cloud Collectors app is included with your existing license.

  • SaaS Cloud Connectors Support: Both the SaaS Cloud Connectors and the new Cloud Collectors environments can run in parallel.

The following table displays the endpoints from the Azure SaaS Cloud Connector that are mapped to the new Microsoft Security Alert Cloud Collector.

Legacy Endpoint

New Service Sources

Graph Security Alerts

  • Azure Active Directory Identity Protection

  • Microsoft 365 Defender

  • Microsoft App Governance

  • Microsoft Defender for Cloud

  • Microsoft Defender for Cloud Apps

  • Microsoft Defender for Endpoint

  • Microsoft Defender for Identity

  • Microsoft Defender for Office 365

  • Microsoft Purview Data Loss Prevention

When you are ready to migrate:

  1. Onboard the new cloud collector as follows:

  2. Stop the endpoint in the Azure Cloud Connector.

Note

Note that duplicate events may occur during the transition period when both collectors are active.