raw-data-export.md

title	description	ms.service	ms.author	author	ms.localizationpriority	manager	audience	ms.collection	ms.topic	ms.subservice	ms.custom	search.appverid	ms.date
Stream Microsoft Defender for Endpoint event	Learn how to configure Microsoft Defender for Endpoint to stream Advanced Hunting events to Event Hubs or Azure storage account	defender-endpoint	siosulli	siosulli	medium	deniseb	ITPro	m365-security tier3 must-keep	reference	reference	api	met150	12/18/2020

Raw Data Streaming API

[!INCLUDE Microsoft Defender XDR rebranding]

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint
• Microsoft Defender for Business

Tip

For the full data streaming experience available, see Stream Microsoft Defender XDR events. If you're using Microsoft Defender for Business, see Use the streaming API with Microsoft Defender for Business.

Want to experience Defender for Endpoint? Sign up for a free trial.

Stream Advanced Hunting events to Event Hubs and/or Azure storage account

Microsoft Defender for Endpoint supports streaming events available through Advanced Hunting to an Event Hubs and/or Azure storage account.

[!VIDEO https://www.microsoft.com/videoplayer/embed/RE4r4ga]

In this section

Topic	Description
Stream Microsoft Defender for Endpoint events to Azure Event Hubs	Learn about enabling the streaming API in your tenant and configure Defender for Endpoint to stream Advanced Hunting to Event Hubs.
Stream Defender for Endpoint events to your Azure storage account	Learn about enabling the streaming API in your tenant and configure Defender for Endpoint to stream Advanced Hunting to your Azure storage account.

Related topics

• Stream Microsoft Defender XDR events | Microsoft Learn

• Overview of Advanced Hunting

• Azure Event Hubs documentation

• Azure Storage Account documentation [!INCLUDE Microsoft Defender for Endpoint Tech Community]