How to retrieve Incident Audit Logs from the Unified Defender Portal?

Question

Hi everyone,

We are currently transitioning our SOC operations from the standalone Microsoft Sentinel (Azure portal) to the unified Microsoft Defender portal. In Sentinel, we relied on the AzureActivity and SentinelAudit tables to track incident changes—specifically identifying WHO performed an action, WHAT was changed (status, owner, etc.), WHEN it happened, and HOW (API vs. Portal).

Now that Sentinel is integrated into Defender, I have the following questions:

1. Which Advanced Hunting tables should we query to see audit logs for incident modifications (e.g., status changes, assignments, or comments) that occur within the Defender portal?
2. Which API Endpoint is recommended for programmatically retrieving these audit trails (the "Audit History") for a specific incident?

Configuration: Are there specific "Diagnostic settings" or "Advanced features" that must be toggled in the Defender settings to ensures these logs are captured in the CloudAppEvents or SentinelAudit tables?

Any guidance on KQL samples or API documentation for audit data in the unified portal would be greatly appreciated.

[Moved from Microsoft 365 and Office | Microsoft 365 Defender | Other | Other}

Answer 1

Hi Jeet Patel,

In the unified Microsoft Defender portal, incident modifications (status changes, assignments, comments, etc.) are no longer written to AzureActivity or SentinelAudit as they were in the standalone Sentinel (Azure portal) experience.

Instead, Defender incident and portal actions are audited via Microsoft 365 Unified Audit Log (UAL) and surfaced through Advanced Hunting primarily in the following table:

1. CloudAppEvents: - This is the primary table to track who did what, when, and how for Defender portal actions. Microsoft documentation confirms that:
   • Defender XDR activities flow into the Unified Audit Log
   • These activities are then exposed in CloudAppEvents when the Microsoft 365 connector is enabled.
   Note: CloudAppEvents is populated only when Defender activities are written to the Microsoft 365 Unified Audit Log (UAL) and then ingested via Defender for Cloud Apps. Items to check : -
   1. Enable Microsoft 365 connector
   2. Enable Microsoft 365 connector
   3. Insufficient permissions
2. For programmatic approach I recommend Microsoft Purview Unified Audit Log for Audit Trail (who/what/when/how)

Reference:

https://learn.microsoft.com/en-us/defender-office-365/audit-log-search-defender-portal

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.