Support for Microsoft Defender XDR connector data types in different clouds

The type of cloud your environment uses affects Microsoft Sentinel's ability to ingest and display data from these connectors, like logs, alerts, device events, and more. This article describes support for different Microsoft Defender XDR connector data types in Microsoft Sentinel across different clouds, including Commercial, GCC, GCC-High, and DoD.

Read more about data type support for different clouds in Microsoft Sentinel.

Connector data

Incidents

Data type	Commercial / GCC (Azure Commercial)	GCC-High / DoD (Azure Government)
Incidents	Generally available	Generally available

Alerts

From Microsoft Defender XDR

Data type	Commercial / GCC (Azure Commercial)	GCC-High / DoD (Azure Government)
Microsoft Defender XDR alerts: SecurityAlert	Generally available	Public preview

From standalone component connectors

Data type	Commercial	GCC	GCC-High / DoD
Microsoft Defender for Endpoint: SecurityAlert (MDATP)	Generally available	Generally available	Generally available
Microsoft Defender for Office 365: SecurityAlert (OATP)	Public preview	Public preview	Public preview
Microsoft Defender for Identity: SecurityAlert (AATP)	Generally available	Unsupported	Unsupported
Microsoft Defender for Cloud Apps: SecurityAlert (MCAS)	Generally available	Generally available	Unsupported
Microsoft Defender for Cloud Apps: McasShadowItReporting	Generally available	Generally available	Unsupported

Raw event data

Microsoft Defender for Endpoint

Data type	Commercial / GCC (Azure Commercial)	GCC-High / DoD (Azure Government)
DeviceInfo	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceNetworkInfo	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceProcessEvents	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceNetworkEvents	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceFileEvents	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceRegistryEvents	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceLogonEvents	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceImageLoadEvents	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceEvents	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview
DeviceFileCertificateInfo	Generally available	Microsoft Defender XDR: Generally available Microsoft Sentinel: Public preview

Microsoft Defender for Identity

Data type	Commercial / GCC (Azure Commercial)	GCC-High / DoD (Azure Government)
IdentityDirectoryEvents	Generally available	Unsupported
IdentityLogonEvents	Generally available	Unsupported
IdentityQueryEvents	Generally available	Unsupported

Microsoft Defender for Cloud Apps

Data type	Commercial / GCC (Azure Commercial)	GCC-High / DoD (Azure Government)
CloudAppEvents	Generally available	Unsupported

Microsoft Defender for Office 365

Data type	Commercial / GCC (Azure Commercial)	GCC-High / DoD (Azure Government)
EmailEvents	Generally available	Public preview
EmailAttachmentInfo	Generally available	Public preview
EmailUrlInfo	Generally available	Public preview
EmailPostDeliveryEvents	Generally available	Public preview
UrlClickEvents	Generally available	Public preview

Alerts

Data type	Commercial / GCC (Azure Commercial)	GCC-High / DoD (Azure Government)
AlertInfo	Generally available	Public preview
AlertEvidence	Generally available	Public preview

Next steps

In this article, you learned which Microsoft Defender XDR connector data types are supported in Microsoft Sentinel for different cloud environments.

• Read more about GCC environments in Microsoft Sentinel.
• Learn about Microsoft Defender XDR integration with Microsoft Sentinel.
• Learn how to get visibility into your data and potential threats.
• Get started detecting threats with Microsoft Sentinel.
• Use workbooks to monitor your data.