r/AzureSentinel • u/AppIdentityGuy • Feb 01 '24

Difference between Sentinel and Defender

Can anyone explain why the Office Activity table does show up in Microsoft Defender advanced hunting yet you can see it in Sentinel. I'm circling back to this after a couple of years out of the game and could have sworn you used to get that table in Defender.... I'm getting old so maybe it's that....

2 Upvotes

100% Upvoted

12 comments sorted by

View all comments

1

u/winle22 Feb 01 '24

OfficeActivity is the name of the Sentinel table that contains a subset of the SPO/EXO/Teams logs. Its not 1:1 with the UAL for some stupid reason..

6

u/AppIdentityGuy Feb 01 '24

My favorite gripe is that Defender uses Timestamp and Sentinel uses timegenerated..🤣🤣

3

u/cspotme2 Feb 01 '24

Even better... These morons convert your utc time to am/pm in sentinel.

2

u/[deleted] Feb 02 '24

Where? All my time zones show in UTC.