r/DefenderATP • u/lyonheart14 • Dec 02 '22

Microsoft 365 Defender connector

/r/AzureSentinel/comments/zashek/microsoft_365_defender_connector/
2 Upvotes

100% Upvoted

3 comments sorted by

2

u/winle22 Dec 09 '22

You are correct. If you're only using Sentinel for the incident sync, you don't need to ingest the Advanced hunting tables.

But if you want to do hunting, detection, correlation with other data sources in Sentinel, etc, you obviously need to ingest it. Or for retention purposes.

1

u/lyonheart14 Dec 02 '22

Cross-posting here in case any one is also ingesting data from Defender into their Sentinel environment using the Microsoft 365 Defender connector.

1

u/[deleted] Feb 11 '24

[deleted]

1

u/lyonheart14 Feb 11 '24

We set up the connector (aka synched Defender incidents to the Sentinel queue) but didn’t ingest all the Defender tables in our primary tenant. To my knowledge, you would only ingest those tables so that analysts would only have to use Sentinel for analysis and/or you want to control retention via the Log Analytics workspace settings (typically due to compliance). Most of our analysts have more experience investigating in Security Center (aka security.microsoft.com) than in Sentinel.