ingest-azure-defender-for-cloud-ocsf

Thin passthrough ingestion skill: raw Defender for Cloud alert JSON in -> canonical finding projection -> OCSF 1.8 Detection Finding JSONL or native enriched finding JSONL out.

Use when

• You have Defender for Cloud alert payloads from the API or wrappers
• You need OCSF Detection Finding or native enriched finding output
• You want parity with GuardDuty, Security Hub, and SCC passthroughs

Do NOT use

• On Azure Activity Logs
• On NSG Flow Logs
• As a remediation skill

Input