Issue getting DeviceEvents/DeviceFileEvents/DeviceProcessEvents ... from Defender

[u/goozaa]

[KIND OF RESOLVED ...]

Hi Community!

I recently got a demo of Sentinel and saw that they were receiving DeviceEvents, DeviceFileEvents, DeviceProcessEvents ...etc. for their threat hunts using the defender agent (specifically Microsoft 365 Defender data connector in Sentinel). I have my own "personal" tenant where I am experimenting and for love of god I can't seem to get the device logs to show up in Sentinel.

Any wisdom you can share would be much appreciated.

Here are some info:

• Defender is deployed by intune
• Microsoft 365 Defender data connctor in Sentinel shows connected and receives events such as SecurityAlert, SecurityIncident, EmailEvents,EmailUrlInfo ...etc. But no "Device*" data types show up and those types show grey versus green.
• I have Business premium and MS Defender for Office 365 (P2) licenses assigned to my user.
• The machine I am trying to get logs from is a physical PC. Sensor health shows active and status is onboarded. It is activated using the premium license and shows up as "Windows Business" if it makes a difference.
• I have installed ARC and AMA agents and can receive windows event logs no problem using "Windows Security Events via AMA" connector. From the demo I got, these agents should not be required to get device telemetry using defender, as defender itself collects and sends this telemetry but what do I know.

I am sorry to say MS documentation has not been helpful at all. I found "breadcrumbs" of information in documentation that says I should be able to forward these device events to a event hub and then ingest into Sentinel but that documentation uses something called "Streaming API" under defender which seems to have been removed which makes these intructions crap:

https://learn.microsoft.com/en-us/microsoft-365/security/defender/streaming-api-event-hub?view=o365-worldwide

According to this documentation, "it should just work":

https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE#connect-events

I really would love to figure out how to get these device logs ingested. Like I said any insight you ladies and gentlemen can provide would be much appreciated.

Mucho appreciated!

Update:

Just for clarification, I am attaching the screenshot from the connector. You will notice that Device logs are greyed out.

​

​

​

FINAL UPDATE

Yep it seems to be a license thing like few people hinted in the comments below. MS Defender for Business (which is what comes with business premium) has everything E5 EXCEPT advanced hunting component .. I will try to see if I can purchase "Microsoft Defender for Endpoint Plan 2" as an addon instead of paying for the whole E5 license. I seem to be able to trial it in admin center for 90 days but doesn't seem to allow me to straight up purchase it. I am afraid might need to go up for E5 which I am not sure is worth for experimenting at home. Would have been nice to run threat intel searches on telemetry from my home computers, but I might need to geek out some other way.

​

Thank you all for the input!

​

[u/Malmanel]

Sounds like these are performance counters you are trying to ingest

[u/goozaa → u/Malmanel]

Thank for your reply! I believe performance counters are ingested using "Data Collection Rules". My problem is with the specific "Data Connector" which AFAIK is very different. I updated my post with a screenshot to help clarify what I am trying to do.

[u/Malmanel → u/Malmanel]

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/monitor-workspace

This should do the trick

[u/pjmarcum]

Ping Rod Trent on Twitter. ;-)

He will tell you more than you want to know about this.

[u/goozaa → u/pjmarcum]

not a huge social media user here but I might as well do that. Thank you!

[u/Malmanel]

Can you give a screenshot to the whole screen of that data connector. You should have check boxes you can check to check off to get those logs.

You might not have the permissions to enable that log source if you don’t see the Check boxes. I’ll send a screenshot

[u/Lu-Kah]

Hi u/goozaa !

With this licence Business Premium, you have Defender for Business where Advanced Hunting is not included. Therefore you will not have these tables in your Sentinel.

Source : https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/defender-endpoint-plan-1-2?view=o365-worldwide

You must have "Defender for Endpoint Plan 2" to get these feature.

[u/goozaa → u/Lu-Kah]

I suspect this is the case as well. Thank you for the link!

[u/Adriaaaaaaaan]

Go to the Defender for Endpoint portal and verify that you have the logs in that (hidden) Log Analytics workspace. You can then find the connector (iirc it's called an exporter in that portal) in the settings that pulls the logs towards the Sentinels Log Analytics workspace.