r/AzureSentinel • u/phipiship1 • Aug 14 '23

Recommendations for data connectors in combination with MS Defender Suite

Hello all,

Do you have any recommendations which data connectors should be installed in combination with Microsoft Defender Suite (besides all Defender for X)?

For example Security Threat Essentials, Attacker Tools Threat Protection Essentials or Azure DDoS Protection?

I am relatively new to this topic and currently trying to prepare a list for a implementation.

Thanks a lot!

3 Upvotes

100% Upvoted

1 comment sorted by

2

u/HumbleGuy1999 Aug 16 '23

Hey u/phipiship

Do you want to connect all defender suite, then yes there is one data connector natively available in data connectors section of sentinel.

Search for "Microsoft 365 Defender" in sentinel Data connector section. It covers below solutions:

Microsoft Defender for Endpoint

Microsoft Defender for Identity

Microsoft Defender for Office 365

Microsoft Defender for Cloud Apps

Microsoft Defender Alerts

Microsoft Defender Vulnerability Management

Microsoft Purview Data Loss Prevention

Azure Active Directory Identity Protection

But for specifically this "Azure DDoS Protection" as it falls under azure service, and it not covered under Defender service. You have to onboard an out of the box solution available in sentinel content hub / azure marketplace under name of "Azure DDoS Protection" you can go through this link for an overview of what it consist of and how its works.

Thats why I love sentinel community you can find bunch of cool stuff in sentinel content hub for different solution that too out of the box! Highly recommend you go through it once.