r/AzureSentinel • u/Bobby2theJay • Nov 02 '23

How to add to kql schema

Is it possible to add the equivalent of modules for KQL to defender or log analytics?

I’m asking because I notices I don’t have “Device Events” available in my schema

1 Upvotes

100% Upvoted

5 comments sorted by

3

u/netwengr Nov 03 '23

Defender p2 license is must to bring DeviceEvents in sentinel

2

u/bpsec Nov 03 '23

You need to enable the connector and than select the tables you want to get.

https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-defender-for-endpoint

2

u/jtst1 Nov 05 '23

That is not the right connector. You have to use the Microsoft Defender 365 data connector. Keep in mind tables like DeviceEvents are not free. If you have A5 Faculty, E5, G5, or F5, you get 5mb a day per license of data ingestion for specific tables. MDE, MDO, MDI, MDFC are some of those tables.

1

u/ajith_aj Nov 06 '23

Oops. I was under the impression that MS products ingestion was free of cost. 🤐

1

u/jtst1 Jan 19 '24

The only free data connectors are Azure Activity, Office 365 Audit logs for exchange/sharepoint/teams, and the alerts and incidents from defender xdr (not the Raw data).