The Managed Hunting service leverages Azure Lighthouse to ingest data from the customer-owned event hub. The following button deploys the Azure Resource Management template azuredeploy.json. The intent of the ARM template is to delegate the contributor role for the subscription containing the event hub to a Mandiant Managed Defense user group. Mandiant administrators from the user group will then configure the Managed Hunting service to ingest data from the customer-owned event hub.
Subcription Owner role is required to complete the process triggered by the button.