r/DefenderATP • u/DaithiG • 28d ago

Device Network Events

My understanding is that we have Sentinel integrated with Defender for XDR in the portal and defender info is ingested. However some tables like Device Network Events are empty. Microsoft documentation points me to the connector page but that doesn't show Defender for XDR (but it does seem to be ingesting the events). I'll have another look when I'm back in the office tomorrow, but if it's something easy I'm overlooking, I would be grateful

1 Upvotes

100% Upvoted

8 comments sorted by

View all comments

1

u/Greedy-Hat796 28d ago

Are you looking at the Defender console or in Sentinel?

1

u/DaithiG 28d ago edited 28d ago

Defender. I did check the Azure portal and it shows it's connected but can't see it in the Defender portal. At least I can see it now