Connect Defender for Servers to Log Analytics Workspace

Question

We've enabled Defender for Servers and I'd like to confirm how to connect it to our Log Analytics Workspace. The Microsoft Defender XDR connector is already installed, but do we need to install the Microsoft Defender for Cloud connector for this?

The instructions in this article may be old. I don't see my workspace on the page that's referenced: https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-servers-plan#enable-the-plan-at-the-log-analytics-workspace-level

Thanks

Answer 1

Hi @Richard Long

The Microsoft Defender XDR connector and the Microsoft Defender for Cloud connector serve different purposes. The Defender for Cloud connector synchronizes you to the Defender for Cloud service. In contrast, the Microsoft Defender XDR connector connects you to many products in the Defender family (except Defender for Cloud).

To connect Defender for Servers to your Log Analytics Workspace, you need to configure integration with the Log Analytics agent. Here are the steps:

1. From the Defender for Cloud’s menu, open Environment settings.
2. Select the relevant subscription.
3. In the Monitoring Coverage column of the Defender plans, select Settings.
4. From the configuration options pane, define the workspace to use.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/working-with-log-analytics-agent

If you find this response helpful and it resolves your issue, please consider marking it as “Accepted” or giving it an upvote. This will help others in the community find the solution more easily.

Answer 2

@Richard Long

Thanks to the details shared by @Vlad Costa you need to Configure Defender for Servers features to have your data collected in LogAnalytics or Azure Monitor workspace.

Once enabled kindly follow :https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-servers-coverage#configure-log-analytics-agent once defender for server plan 1 or 2 are enabled. Kindly refer to the snip below for reference.

If you don't have any further queries and the suggestion above answers your ask, please "Accept the answer", This will help us and others in the community as well.

Thanks,

Akshay Kaushik