Connect your Microsoft 365 Defender data to Microsoft Sentinel (2023)

microsoft guardianMicrosoft 365 AdvocateConnectors with event integration capabilities allow you to stream all events and alerts from Microsoft 365 Defender to Microsoft Sentinel and synchronize events between the two portals. Microsoft 365 Defender events include all alerts, entities, and other related information grouped together and enriched with alerts from Microsoft 365 Defender component services.Microsoft Defender Endpoint,Microsoft Defender Identity,Microsoft Defender para Office 365, IMicrosoft Defender for cloud applications, as well as alerts from other services such asMicrosoft Rights Data Loss Prevention (DLP)IAzure Active Directory Identity Protection (AADIP)。

The connector also allows streamingadvanced huntingevent ofAllCopying older Defender components to Microsoft Sentinel allows you to copy advanced indexing queries for these Defender components to Microsoft Sentinel, enrich Sentinel alerts with raw event data from Defender components to provide more information, and store logs in Log Analytics and improve retention rates.

For more information about event integration and advanced hunting event collection, seeMicrosoft 365 Defender integrates with Microsoft Sentinel。

The Microsoft 365 Defender Connector is now generally available.

preconditions

• You must have a valid Microsoft 365 Defender license as described inMicrosoft 365 Defender prerequisites。

• Your user must be assignedglobal adminlubricantsecurity administratorThe tenant role from which you want to transmit logs.

• The user must have read and write permissions to the Microsoft Sentinel workspace.

• To make changes to connector settings, users must be in the same Azure Active Directory tenant that the Microsoft Sentinel workspace is associated with.

• Installation solutionMicrosoft 365 Advocatezcontent centerIn Microsoft Sentinel. For more information, seeDiscover and manage Microsoft Sentinel content out of the box。

Prerequisites for Active Directory Synchronization via MDI

• Your tenant must join Microsoft Defender for Identity.

• An MDI sensor must be installed.

Connect to Microsoft 365 Defender

In Microsoft Sentinel, selectdata connector, chooseMicrosoft 365 AdvocateSelect from galleryOpen connector page。

DiezSettingThe section is divided into three parts:

1. Connect events and alertsSupports basic integration between Microsoft 365 Defender and Microsoft Sentinel to synchronize events and alerts between both platforms.

2. Connect entitiesEnables the integration of local Active Directory user identities with Microsoft Sentinel through Microsoft Defender for Identity.

3. connection eventsAllows you to collect raw, advanced hunting events from Defender components.

These are explained in more detail below. LookMicrosoft 365 Defender integrates with Microsoft Sentinelfor more information.

Connect events and alerts

To ingest and sync Microsoft 365 Defender events and all your alerts to the Microsoft Sentinel event queue:

1. Check the box markedDisable all Microsoft event creation rules for these products. respectableto avoid repeated incidents.
   (When you connect the Microsoft 365 Defender connector, this check box will not appear.)

2. chooseConnect events and alertsbutton.

To query event data from Microsoft 365 Defender, use the following statement in the query window:

Security incident | Where Provider Name == "Microsoft 365 Defender"

Connect entities

Use Microsoft Defender for Identity to synchronize user entities from on-premises Active Directory with Microsoft Sentinel.

Confirm that you are satisfiedpreconditionsUsed to synchronize local Active Directory users with Microsoft Defender for Identity (MDI).

1. chooseGo to the UEBA configuration pageassociation.

2. insideConfiguration of the individual's behavior.page, if you have not already enabled UEBA, at the top of the page, slide the toggle button toexist。

3. classificationActive Directory (preview)check box and selectTo use。

   

connection events

If you want to collect advanced search events from Microsoft Defender for Endpoint or Microsoft Defender for Office 365, you can collect the following types of events from their corresponding advanced search tables.

1. In the table, select the check boxes next to the types of events you want to collect:

   • defender of the final point
   • Office 365 defender
   • identity defender
   • Cloud Application Guardian
   • defender alert

   Table name	type of activity
   Device Information	Information about your computer, including information about your operating system
   Device network information	The device's network properties, including physical cards, IP and MAC addresses, and connected networks and domains.
   device process events	Create processes and events related to them.
   Device Network Events	Network connections and related events.
   device file events	Creation, modification and other events related to the file system.
   Device Registration Event	Create and modify registry keys
   Device login event	Sign-ins and other authentication events on the device
   Device image load event	DLL load event
   device events	Multiple event types, including those triggered by security mechanisms such as Windows Defender Antivirus and Vulnerability Protection
   Device file certificate information	Certificate information for the signed file obtained from the certificate verification event on the endpoint

2. ClickMake changes。

3. To query an advanced lookup table in Log Analytics, enter the table name from the list above in the query window.

Check your data acquisition

The data graph on the connector page shows that it is downloading data. You will notice that it displays a row for events, alerts, and events, and that the events row is an aggregation of the event volume from all enabled tables. Once you enable the connector, you can use the KQL query below to generate more detailed charts.

Use the following KQL query to get a graph of incoming Microsoft 365 Defender events:

let's go now = now(); (time range from (14d) ago to Now-1d, step 1d | expand count = 0 | union isfuzzy=true ( SecurityIncident | where ProviderName == "Microsoft 365 Defender" | summarize Count = count() by bin_at(TimeGenerated, 1d , Now) ) | Sum by bin_at(TimeGenerated, 1d, Now) Count=max(Count) | Sort by TimeGenerate | Item value = iff(isnull(Count), 0, Count), Time = TimeGenerate, Legend = " Events" ) |Render Scheduling

Use the following KQL query to generate an event volume graph for a single table (changedevice eventstable for the table of your choice):

let Now = now();(TimeGenerate range from Aug(14d) to Now-1d Step 1d | Expand count = 0 | union isfuzzy=true (DeviceEvents | summarize Count = count() by bin_at(TimeGenerate, 1d, Now)) | Sum Count=max(Count) by bin_at(TimeGenerate, 1d, Now) | Sort by TimeGenerate | Item value = iff(isnull(Count), 0, Count), Time = TimeGenerate, Legend = "Events") | Surface render time

insidenext stepYou'll find useful workbooks, sample queries, and analysis rule templates included. You can run them in place or modify and save them.

next step

In this document, you learn how to use the Microsoft 365 Defender connector to integrate Microsoft 365 Defender events and advanced search event data from Microsoft Defender Component Services with Microsoft Sentinel. For more information about Microsoft Sentinel, see the following articles:

• Learn howKnow your data and potential threats。
• Start usingDetect threats with Microsoft Sentinel。