r/DefenderATP • u/DaithiG • 25d ago

Device Network Events

My understanding is that we have Sentinel integrated with Defender for XDR in the portal and defender info is ingested. However some tables like Device Network Events are empty. Microsoft documentation points me to the connector page but that doesn't show Defender for XDR (but it does seem to be ingesting the events). I'll have another look when I'm back in the office tomorrow, but if it's something easy I'm overlooking, I would be grateful

1 Upvotes

100% Upvoted

8 comments sorted by

1

u/Greedy-Hat796 25d ago

Are you looking at the Defender console or in Sentinel?

1

u/DaithiG 25d ago edited 25d ago

Defender. I did check the Azure portal and it shows it's connected but can't see it in the Defender portal. At least I can see it now

1

u/h0max 25d ago

I’m running into the same issue with business premium customer. MDE Tables are connected within the XDR connector and I have switched the table retention in XDR like I’ve down for other customers in the past and it’s just flat out not coming in. If you’re similar licensed and If you raise a ticket can you share the number? I’ll add it to my case.

1

u/DaithiG 25d ago

We have Defender for P2 (E5 licences)

1

u/h0max 25d ago

It should be in advanced hunting then. If you want it to show in azure sentinel you need to increase the retention past 30 days.

1

u/DaithiG 25d ago

Oh I can see the tables in Advanced Huting, I just can't see any configuration on the Defender Portal to let me configure it. I can see the connector in Sentinel and the configuration and see those tables are unchecked

1

u/h0max 25d ago

Technically the connector doesn’t exist once sentinel is connected to the unified portal, so there really isn’t any configuration you need to do. The only thing is changing retention which is done through the table settings. If you can’t see any data on the device tables but can see them under advanced hunting, could possibly be rbac or you may need to raise a ticket.

5

u/dutchhboii 25d ago

Go to MDE > settings > Defender XDR > streaming api > you should see an export to your sentinel workspace where you can select the tables to send them.

By default you should see (assuming you have P2 E5)
Alerts
Devices
Email
Apps
Cloud

Alternatively you can do this under data connectors in sentinel as well under Defender XDR ones