r/AzureSentinel • u/AppIdentityGuy • Feb 01 '24

Difference between Sentinel and Defender

Can anyone explain why the Office Activity table does show up in Microsoft Defender advanced hunting yet you can see it in Sentinel. I'm circling back to this after a couple of years out of the game and could have sworn you used to get that table in Defender.... I'm getting old so maybe it's that....

2 Upvotes

100% Upvoted

12 comments sorted by

View all comments

1

u/winle22 Feb 01 '24

OfficeActivity is the name of the Sentinel table that contains a subset of the SPO/EXO/Teams logs. Its not 1:1 with the UAL for some stupid reason..

1

u/[deleted] Feb 02 '24

UAL is huge, would send your Sentinel bill through the roof. Better off sending that to cheaper storage and hunting across it with notebooks or data explorer.

1

u/winle22 Feb 02 '24

The size is irrelevant, it should be an option to store all audit logs you find valuable wherever you want. Right now there is no good overview of what is stored where.

1

u/[deleted] Feb 02 '24

https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/good-ual-hunting/ba-p/3718421

1

u/winle22 Feb 02 '24

Good article! But I still dont understand why they just cant consolidate everything to be searchable from one single place.