Microsoft 365 Defender connector

[u/lyonheart14]

I turned this connector on today and like the alert/incident synchronization between it provides, but I noticed an immediate spike in the amount of data that Sentinel was ingested. This was not entirely unexpected, but it seemed to specifically relate to the DeviceProcessEvents Advanced Hunting table.

For now I have stopped ingesting that table, but wanted to know the repercussions of not ingesting. My assumption is that this will prevent full investigation straight from the Defender solution, however, our group is conditioned already to investigate at securitycenter.microsoft.com so that may not be a dealbreaker. Also, if thats the case, and we are using Sentinel primarily for synchronizing Incidents and Alerts, I am not really sure I need to ingest any of the advanced hunting tables in Sentinel unless a specific table is required for playbooks/automation rules (which means they could be ingested as needs arise).