Microsoft Defender XDR
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | MicrosoftThreatProtection |
| Publisher | Microsoft |
| Used in Solutions | Microsoft Defender XDR |
| Collection Method | Native |
| Connector Definition Files | MicrosoftThreatProtection.JSON |
| Microsoft Learn | View on Learn |
Microsoft Defender XDR is a unified, natively integrated, pre- and post-breach enterprise defense suite that protects endpoint, identity, email, and applications and helps you detect, prevent, investigate, and automatically respond to sophisticated threats.
Microsoft Defender XDR suite includes:
Microsoft Defender for Endpoint
Microsoft Defender for Identity
Microsoft Defender for Office 365
Threat & Vulnerability Management
Microsoft Defender for Cloud Apps
For more information, see the Microsoft Sentinel documentation.
Additional Information
📖 Setup Guide: Microsoft Defender XDR connector - Connect Defender XDR data to Microsoft Sentinel
Tables Ingested
This connector ingests data into the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AlertEvidence |
✓ | ✗ | ✓ | |
CloudAppEvents |
✓ | ✗ | ✓ | |
DeviceEvents |
✓ | ✗ | ✓ | |
DeviceFileCertificateInfo |
✓ | ✗ | ? | |
DeviceFileEvents |
✓ | ✗ | ? | |
DeviceImageLoadEvents |
✓ | ✗ | ? | |
DeviceInfo |
✓ | ✗ | ? | |
DeviceLogonEvents |
✓ | ✗ | ? | |
DeviceNetworkEvents |
✓ | ✗ | ? | |
DeviceNetworkInfo |
✓ | ✗ | ? | |
DeviceProcessEvents |
✓ | ✗ | ? | |
DeviceRegistryEvents |
ActionType == "RegistryValueSet" |
✓ | ✗ | ? |
EmailAttachmentInfo |
✓ | ✗ | ? | |
EmailEvents |
✓ | ✗ | ✓ | |
EmailPostDeliveryEvents |
✓ | ✗ | ? | |
EmailUrlInfo |
✓ | ✗ | ? | |
IdentityDirectoryEvents |
✓ | ✗ | ? | |
IdentityLogonEvents |
✓ | ✗ | ✓ | |
IdentityQueryEvents |
✓ | ✗ | ? | |
SecurityAlert |
ProductName in "Azure Advanced Threat Protection,Microsoft 365 Defender,Microsoft Cloud App Security,Microsoft Defender Advanced Threat Protection,Office 365 Advanced Threat Protection"ProviderName == "Microsoft 365 Defender" |
✓ | ✗ | ✓ |
SecurityIncident |
✓ | ✗ | ✓ | |
UrlClickEvents |
✓ | ✗ | ? |
Permissions
Resource Provider Permissions:
- Workspace (Workspace): read and write permissions.
Custom Permissions:
- License: M365 E5, M365 A5 or any other Microsoft Defender XDR eligible license.
Tenant Permissions: Requires GlobalAdmin, SecurityAdmin on the workspace's tenant
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect incidents & alerts
Connect Microsoft Defender XDR incidents to your Microsoft Sentinel. Incidents will appear in the incidents queue.
📋 Additional Configuration Step: This connector includes a configuration step of type
MicrosoftThreatProtection. Please refer to the Microsoft Sentinel portal for detailed configuration options for this step.
2. Connect events
📋 Additional Configuration Step: This connector includes a configuration step of type
MicrosoftDefenderATPEvents. Please refer to the Microsoft Sentinel portal for detailed configuration options for this step.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊