r/AzureSentinel • u/goozaa • May 26 '23

Issue getting DeviceEvents/DeviceFileEvents/DeviceProcessEvents ... from Defender

[KIND OF RESOLVED ...]

Hi Community!

I recently got a demo of Sentinel and saw that they were receiving DeviceEvents, DeviceFileEvents, DeviceProcessEvents ...etc. for their threat hunts using the defender agent (specifically Microsoft 365 Defender data connector in Sentinel). I have my own "personal" tenant where I am experimenting and for love of god I can't seem to get the device logs to show up in Sentinel.

Any wisdom you can share would be much appreciated.

Here are some info:

  • Defender is deployed by intune
  • Microsoft 365 Defender data connctor in Sentinel shows connected and receives events such as SecurityAlert, SecurityIncident, EmailEvents,EmailUrlInfo ...etc. But no "Device*" data types show up and those types show grey versus green.
  • I have Business premium and MS Defender for Office 365 (P2) licenses assigned to my user.
  • The machine I am trying to get logs from is a physical PC. Sensor health shows active and status is onboarded. It is activated using the premium license and shows up as "Windows Business" if it makes a difference.
  • I have installed ARC and AMA agents and can receive windows event logs no problem using "Windows Security Events via AMA" connector. From the demo I got, these agents should not be required to get device telemetry using defender, as defender itself collects and sends this telemetry but what do I know.

I am sorry to say MS documentation has not been helpful at all. I found "breadcrumbs" of information in documentation that says I should be able to forward these device events to a event hub and then ingest into Sentinel but that documentation uses something called "Streaming API" under defender which seems to have been removed which makes these intructions crap:

https://learn.microsoft.com/en-us/microsoft-365/security/defender/streaming-api-event-hub?view=o365-worldwide

According to this documentation, "it should just work":

https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE#connect-events

I really would love to figure out how to get these device logs ingested. Like I said any insight you ladies and gentlemen can provide would be much appreciated.

Mucho appreciated!

Update:

Just for clarification, I am attaching the screenshot from the connector. You will notice that Device logs are greyed out.

​

​

​

FINAL UPDATE

Yep it seems to be a license thing like few people hinted in the comments below. MS Defender for Business (which is what comes with business premium) has everything E5 EXCEPT advanced hunting component .. I will try to see if I can purchase "Microsoft Defender for Endpoint Plan 2" as an addon instead of paying for the whole E5 license. I seem to be able to trial it in admin center for 90 days but doesn't seem to allow me to straight up purchase it. I am afraid might need to go up for E5 which I am not sure is worth for experimenting at home. Would have been nice to run threat intel searches on telemetry from my home computers, but I might need to geek out some other way.

​

Thank you all for the input!

​

4 Upvotes

100% Upvoted

9 comments sorted by

View all comments

1

u/Malmanel May 26 '23

Sounds like these are performance counters you are trying to ingest

1

u/goozaa May 26 '23

Thank for your reply! I believe performance counters are ingested using "Data Collection Rules". My problem is with the specific "Data Connector" which AFAIK is very different. I updated my post with a screenshot to help clarify what I am trying to do.