Microsoft Purview Audit Log - Send Microsoft Defender XDR activities to Sentinel

Question

Hello everyone!

I would like to forward the Microsoft Defender XDR activities and Microsoft Defender for Identity activities (https://learn.microsoft.com/en-us/purview/audit-log-activities#microsoft-defender-for-identity-activities)

from the Microsoft Purview Audit Log to Microsoft Sentinel. The activities are present in the Microsoft Purview Audit Log.

What is the best way to do this?

The data connector "Microsoft Purview Information Protection" does not collect these activities. I also can't find these logs in the OfficeActivity data table.

Many thanks in advance! :)

Answer 1

Hi @Tabea Zervos

Thanks for reaching out to Microsoft Q&A.
To integrate Microsoft Purview Audit Log with Azure Sentinel for Microsoft Defender XDR activities, you can follow these steps:

Firstly, please note that the Microsoft Purview Audit Log does not currently support direct integration with Azure Sentinel. However, you can use the Azure Sentinel connector for Microsoft Defender to forward the activities to Azure Sentinel.

This means that you can leverage the Azure Sentinel connector for Microsoft Defender to forward the Microsoft Defender XDR activities and Microsoft Defender for Identity activities from the Microsoft Purview Audit Log to Azure Sentinel.

I hope this helps. Please let me know if you have any questions.