Behind the scenes: Building Azure integrations for ASC alerts

Expel outlines their process and lessons learned building an Azure Security Center integration: they evaluated Microsoft Graph Security API, Azure Log Analytics, and Azure Management API, ultimately choosing Management API for data parity; added context and automated decision support to improve SOC triage; deduplicated and tuned noisy/preview alerts; implemented visibility and onboarding workflows; and developed a log aggregation approach that reduced Azure Storage log volume (and costs) significantly while preserving detection context. The post is an engineering and operational guide, not an incident report.