Raw Data Streaming API

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2

Note

For the full data streaming experience available, please visit Stream Microsoft Defender XDR events | Microsoft Learn. If you're using Microsoft Defender for Business, see Use the streaming API (preview) with Microsoft Defender for Business.

Want to experience Defender for Endpoint? Sign up for a free trial.

Stream Advanced Hunting events to Event Hubs and/or Azure storage account

Microsoft Defender for Endpoint supports streaming events available through Advanced Hunting to an Event Hubs and/or Azure storage account.

In this section

Topic	Description
Stream Microsoft Defender for Endpoint events to Azure Event Hubs	Learn about enabling the streaming API in your tenant and configure Defender for Endpoint to stream Advanced Hunting to Event Hubs.
Stream Defender for Endpoint events to your Azure storage account	Learn about enabling the streaming API in your tenant and configure Defender for Endpoint to stream Advanced Hunting to your Azure storage account.

Related topics

• Stream Microsoft Defender XDR events | Microsoft Learn

• Overview of Advanced Hunting

• Azure Event Hubs documentation

• Azure Storage Account documentation

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.