Microsoft Defender for Endpoint Alerts in Microsoft Sentinel

Question

Microsoft Defender for Endpoint Alerts in Microsoft Sentinel

Anand R Menon 301

Hi,

Currently I have enabled Microsoft Defender for Endpoint Alerts to flow to Sentinel by enabling it in the corresponding Sentinel Connector. Is it possible to configure such that Defender incidents appear in Sentinel with all the correlated alerts in the same way as it appear in Defender instead of generating a Sentinel incident for each Defender alert flown into Sentinel. Also want to know enabling this alert/incident flow through Connector or Microsoft Incident Creation Rule is the best option or whether both needs to be enabled? Thank you.

Regards,
Anand

Accepted answer

0 additional answers

Your answer

Answer 1

Andrew Blumhardt 10,051 Microsoft Employee

I believe you will see better aggregation when switching over to the Microsoft 365 Defender (Preview) connector. This connects to M365D rather than the individual services. When you activate this connector it will ask to turn off the other alert forwarding rules that it replaces. You will also have the option to stream the raw logs from the M365D advanced hunting tables. I think you need the SecurityIncidents and SecurityAlerts tables at a minimum. This also provides 2-way alerts integration. These raw tables are not free unfortunately. They will incur ingestion changes. Most of the tables are fairly small but you might find that some tables are more expensive than expected. Definitely monitor ingestion volume/price for a few weeks after activation. Also, there are about a dozen alert rule templates in Sentinel that add additional checks on MDE device tables. Mostly static threat intel checks.

Anand R Menon 301 Reputation points

2022-02-05T05:37:05.543+00:00

@Andrew Blumhardt Thanks for the reply. I tried disabling M365 Defender connector, then disabling M365 Defender for Endpoint, O365, Identity etc connectors(Because directly disabling these connectors won't work when M365 Defender connector is enabled), then enabling back M365 Defender connector. But noticed that, on enabling M365 Defender connector, the Endpoint, O365 etc. connectors are again back to 'enabled' state. This may be expected outcome although I'm not sure. Also disabled the "Microsoft Incident Creation rules" for these solutions to avoid conflicts. Will wait and see if Defender alerts are collated into single incidents as expected.

Also, when tried to enable "Advanced Hunting raw logs" from M365 Defender connector, getting the following error:
"Server error
Categories AdvancedHunting-EmailAttachmentInfo, AdvancedHunting-EmailEvents, AdvancedHunting-EmailUrlInfo, AdvancedHunting-EmailPostDeliveryEvents are not supported."

Seems this issue is only for "Defender for Office 365" tables. "Defender for Endpoint" tables are connected successfully now.
Anand R Menon 301 Reputation points

2022-03-05T05:41:51.667+00:00

@Andrew Blumhardt Thanks for the prompt suggestion. Enabling the Microsoft 365 Defender connector solved the issue. Now, the MDE alerts are rightly collated into incidents in Sentinel, also there is bi-directional sync for incident status between both solutions.

Share via

Microsoft Defender for Endpoint Alerts in Microsoft Sentinel

0 additional answers

Your answer