We are about to upgrade ATA to MDI and add ADFS in the mix. We leverage Big-IP F5 as a Web Authentication Proxy for ADFS.

Can we include the signals from the F5s in MDI? If not, is there a way we can improve detections from Sentinel by combining F5 logs with MDI? Any other options?

We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE