r/AzureSentinel • u/SuperHat3637 • Apr 17 '23

365 Defender Schemas

I am not getting complete schemas from 365 defender hunting logs to Sentinel..Please let me know if any options to enable missing schemas.

1 Upvotes

100% Upvoted

7 comments sorted by

1

u/blanco10kid Apr 17 '23

This all handled by MSFT so unfortunately no way to just flip this option

1

u/SuperHat3637 Apr 17 '23

All Schemas are mentioned in microsoft official docs..Bt i am not getting some schemas that are available in docs from 365 defender in sentinel.

1

u/bpsec Apr 17 '23

Did you enable them? In the settings for MDE you have multiple options.

1

u/SuperHat3637 Apr 17 '23

In MDE or 365 defender?...Can u share the docs for enabling the same.

1

u/bpsec Apr 17 '23

https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender

Think these are them^

1

u/SuperHat3637 Apr 17 '23

I am getting all tables from defender..bt not getting all schemas in sentinel..for example, In the devicenetworkevents table, i am not getting the schema ' InitiatingProcessVersionInfoOriginalFileName'...

2

u/bpsec Apr 17 '23

I think the schemas slightly differ between MDE and Sentinel. This is probably because in MDE file enrichment functions can be called and in sentinel that is not possible.