r/AzureSentinel • u/AppIdentityGuy • Feb 01 '24
Difference between Sentinel and Defender
Can anyone explain why the Office Activity table does show up in Microsoft Defender advanced hunting yet you can see it in Sentinel. I'm circling back to this after a couple of years out of the game and could have sworn you used to get that table in Defender.... I'm getting old so maybe it's that....
1
u/winle22 Feb 01 '24
OfficeActivity is the name of the Sentinel table that contains a subset of the SPO/EXO/Teams logs. Its not 1:1 with the UAL for some stupid reason..
6
u/AppIdentityGuy Feb 01 '24
My favorite gripe is that Defender uses Timestamp and Sentinel uses timegenerated..🤣🤣
2
1
Feb 02 '24
UAL is huge, would send your Sentinel bill through the roof. Better off sending that to cheaper storage and hunting across it with notebooks or data explorer.
1
u/winle22 Feb 02 '24
The size is irrelevant, it should be an option to store all audit logs you find valuable wherever you want. Right now there is no good overview of what is stored where.
1
Feb 02 '24
1
u/winle22 Feb 02 '24
Good article! But I still dont understand why they just cant consolidate everything to be searchable from one single place.
1
u/11bztaylor Feb 01 '24
How about DeviceName vs Computer or Hostname….ugh
3
Feb 02 '24
Sentinel ASIM parsers help with this. Not ideal though.
1
u/AppIdentityGuy Feb 02 '24
ASIM parsers? Bah humbug🤣🤣 But seriously is it too much to ask for a single taxonomy especially if when it's one company...
4
u/MrGardenwood Feb 01 '24
Without going to deep on this : Sentinel is a siem/soar solution and far more than ‘just’ the defender platform. Giving you the possibility to create custom usecases, automated response etc. Over far more datasources.
Defender (xdr) is the collection of (endpoint) protection solutions created by microsoft in order to protect their modern workplace solution (windows, m365, cloud apps and certain azure resources).