Skip to content

Latest commit

 

History

History
115 lines (77 loc) · 5.16 KB

raw-data-export-storage.md

File metadata and controls

115 lines (77 loc) · 5.16 KB
Raw
title description ms.service ms.author author ms.localizationpriority manager audience ms.collection ms.topic ms.subservice ms.custom search.appverid ms.date
Stream Microsoft Defender for Endpoint events to your Storage account
Learn how to configure Microsoft Defender for Endpoint to stream Advanced Hunting events to your Storage account.
defender-endpoint
siosulli
siosulli
medium
deniseb
ITPro
m365-security
tier3
must-keep
reference
reference
api
met150
06/28/2024

Configure Microsoft Defender for Endpoint to stream Advanced Hunting events to your Storage account

[!INCLUDE Microsoft Defender XDR rebranding]

Applies to:

Note

For the full data streaming experience available, please visit Stream Microsoft Defender XDR events | Microsoft Learn.

Want to experience Defender for Endpoint? Sign up for a free trial.

Before you begin

  1. Create a Storage account in your tenant.

  2. Sign in to your Azure tenant, go to Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights.

Important

Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.

Enable raw data streaming

  1. Sign in to the Microsoft Defender portal as a Security Administrator.

  2. Go to Data export settings page in Microsoft Defender XDR.

  3. Select on Add data export settings.

  4. Choose a name for your new settings.

  5. Choose Forward events to Azure Storage.

  6. Type your Storage Account Resource ID. In order to get your Storage Account Resource ID, go to your Storage account page on Azure portal > properties tab > copy the text under Storage account resource ID:

    :::image type="content" source="../media/storage-account-resource-id.png" alt-text="The Event Hubs with resource ID1" lightbox="../media/storage-account-resource-id.png":::

  7. Choose the events you want to stream and select Save.

The schema of the events in the Storage account

  • A blob container is created for each event type:

    :::image type="content" source="../media/storage-account-event-schema.png" alt-text="The Event Hubs with resource ID2" lightbox="../media/storage-account-event-schema.png":::

  • The schema of each row in a blob is the following JSON:

    {
  "time": "<The time WDATP received the event>"
  "tenantId": "<Your tenant ID>"
  "category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
  "properties": { <WDATP Advanced Hunting event as Json> }
}

  • Each blob contains multiple rows.

  • Each row contains the event name, the time Defender for Endpoint received the event, the tenant it belongs (you get events only from your tenant), and the event in JSON format in a property called properties.

  • For more information about the schema of Microsoft Defender for Endpoint events, see Advanced Hunting overview.

  • In Advanced Hunting, the DeviceInfo table has a column named MachineGroup which contains the group of the device. Here, every event is decorated with this column as well. For more information, see Device Groups.

    [!NOTE] Device group creation is supported in Defender for Endpoint Plan 1 and Plan 2.

Data types mapping

In order to get the data types for our events properties, take the following steps:

  1. Sign in to the Microsoft Defender portal and go to Advanced Hunting page.

  2. Run the following query to get the data types mapping for each event:

    {EventType}
| getschema
| project ColumnName, ColumnType

    Here's an example for Device Info event:

    :::image type="content" source="../media/data-types-mapping-query.png" alt-text="The Event Hubs with resource ID3" lightbox="../media/data-types-mapping-query.png":::

Related articles

[!INCLUDE Microsoft Defender for Endpoint Tech Community]