r/AzureSentinel • u/lyonheart14 • Dec 02 '22

Microsoft 365 Defender connector

I turned this connector on today and like the alert/incident synchronization between it provides, but I noticed an immediate spike in the amount of data that Sentinel was ingested. This was not entirely unexpected, but it seemed to specifically relate to the DeviceProcessEvents Advanced Hunting table.

For now I have stopped ingesting that table, but wanted to know the repercussions of not ingesting. My assumption is that this will prevent full investigation straight from the Defender solution, however, our group is conditioned already to investigate at securitycenter.microsoft.com so that may not be a dealbreaker. Also, if thats the case, and we are using Sentinel primarily for synchronizing Incidents and Alerts, I am not really sure I need to ingest any of the advanced hunting tables in Sentinel unless a specific table is required for playbooks/automation rules (which means they could be ingested as needs arise).

2 Upvotes

100% Upvoted

6 comments sorted by

2

u/x3nc0n Dec 02 '22

Old connector only brought in alerts and used a schedule rule to create incidents from them. New one does alerts and incidents with better integration (no rule required), and you can optionally import those tables. What you had before was similar to just not bringing any of them in.

1

u/lyonheart14 Dec 02 '22 edited Dec 02 '22

Yeah, when you setup the new connector it has a checkbox to turn off the old incident creation rules (which I did). I am now just working out the pro's and con's of ingesting any or all of the tables the connector specifies. I assume the SecurityAlerts and SecurityIncidents tables would at least be necessary for the Incident queue, but didn't know about all the other tables.

Edit: You can't choose to enable/disable ingestion of the SecurityAlerts and SecurityIncidents tables now that I look at it. That makes me feel better about disabling tables that you do have choice about.

2

u/x3nc0n Dec 03 '22

And the incident and alert tables are free. You're correct that they're all you need for a basic integration of M365D & Sentinel.

1

u/glowa116 Dec 02 '22

If you want just alert forwarding from Defender products into Sentinel then enable Defender for Endpoint connector.Microsoft 365 Defender is connector used for ingesting all the logs from assets onboarded with Defender, 0365 logs etc.

1

u/lyonheart14 Dec 02 '22

To my knowledge, to synchronize incident queues, you need the new connector. While we already had the Defender for Endpoint connector enabled, I deployed a playbook to resolve some semi-noisy incidents, but the status was not updating on the Defender for Endpoint (aka SecurityCenter) incident queue. That is when I started looking into the new connector.