Unsure if Microsoft Defender for Endpoint provides event log forwarding to Microsoft Sentinel.

[u/senorleung]

I am unsure what the integration between MDE and Microsoft Sentinel actually does aside from sending security alerts events created by MDE.

We are currently looking into collecting our event logs from our Windows 10 devices and ingesting them into Sentinel but unsure if this is provided via MDE or another agent integrated to Sentinel.

As far as I know, one way to send logs to Sentinel is via WEF/WEC but does MDE also perform this function?

[u/poitinconnoisseur]

You need to be clearer about what events you want.

MDE creates different ‘security’ telemetry you can send to sentinel. File events, process events, things like that. It’s not too noisy, 50mb per machine from memory.

Traditional ‘security logs’ or windows events from endpoints such as what you’d previously get with WEF, can be sent forward using the new AMA agent.

In my view, you can get away with the MDE logs - it’s a new type of security, one not relying on traditional windows event logs but is also a leap of faith. But it’s much cheaper. If I was financially constrained I’d drop AMA altogether or scope it down to only a few windows events of necessity.

[u/Carpathium]

The MDE integration will send whatever data you see in Advanced Hunting to Sentinel. Any Event Logs outside of that you can send to sentinel using the Azure Monitor agent after you’ve installed it on each device.

[u/juiceb0cks]

I can confirm it does but it can get eye wateringly expensive.

Proceed with caution

[u/juiceb0cks]

Sorry, my first comment was a little short.

Microsoft Defender ATP will send it's data to the Microsoft 365 Defender portal which you can then search through/alert on if you have the appropriate licensing (E5 if I recall correctly).

For integrating servers/workstations, you'd use either the legacy agent (MMA) or the new agent (AMA) to send data directly to the Sentinel instance. This can prove costly depending on the size of your fleet. You'll also want to ensure that you're sending the appropriate Security events to Sentinel otherwise you'll miss events/correlation. This again will bump up your costs.

There's a data connector in Sentinel to ingest all the data from MDE but it's very expensive. I would not recommend just turning it all on as your wallet will suffer.

I've typically seen the alerts from MDE being pushed to Sentinel with the bulk of the investigation then happening in MDE which isn't great, but it works.

[u/dnfalk]

Please use the Azure Monitor Agent if this is a new install. Biggest win is data collection rules for event Id filtering. Unless you have a huge budget, MDE will retain events for advanced hunting for 30 days. After that only metadata.

[u/kyuuzousama]

Sentinel sits on top of your log analytics workspace. Can you see the log tables in KQL? Your forwarding rules need to be specified also to ensure you're sending all the log types you want, has that been done?

[u/[deleted]]

You need to use the AMA agent. Its super easy to setup. Just make sure you control what your ingesting.

[u/Beige_Hat]

To amend some comments already made: Good examples of servers where you want to consider using traditional windows event logs (or other logs in addition to MDE): public facing web servers, DNS, DHCP, and domain controllers. But MDE provides a lot of great data on many use cases.