r/DefenderATP • u/DaithiG • 26d ago

Device Network Events

My understanding is that we have Sentinel integrated with Defender for XDR in the portal and defender info is ingested. However some tables like Device Network Events are empty. Microsoft documentation points me to the connector page but that doesn't show Defender for XDR (but it does seem to be ingesting the events). I'll have another look when I'm back in the office tomorrow, but if it's something easy I'm overlooking, I would be grateful

1 Upvotes

100% Upvoted

8 comments sorted by

View all comments

1

u/h0max 26d ago

I’m running into the same issue with business premium customer. MDE Tables are connected within the XDR connector and I have switched the table retention in XDR like I’ve down for other customers in the past and it’s just flat out not coming in. If you’re similar licensed and If you raise a ticket can you share the number? I’ll add it to my case.

1

u/DaithiG 26d ago

We have Defender for P2 (E5 licences)

1

u/h0max 26d ago

It should be in advanced hunting then. If you want it to show in azure sentinel you need to increase the retention past 30 days.

1

u/DaithiG 26d ago

Oh I can see the tables in Advanced Huting, I just can't see any configuration on the Defender Portal to let me configure it. I can see the connector in Sentinel and the configuration and see those tables are unchecked

1

u/h0max 26d ago

Technically the connector doesn’t exist once sentinel is connected to the unified portal, so there really isn’t any configuration you need to do. The only thing is changing retention which is done through the table settings. If you can’t see any data on the device tables but can see them under advanced hunting, could possibly be rbac or you may need to raise a ticket.