📢 Read the latest Release Notes to learn what's new on Hunters! 💡

Microsoft 365 Defender

  • Updated on Aug 31, 2026
  • Published on Jan 2, 2025
Prev Next

image

Self Service Ingestion

Connect this data source on your own, using the Hunters platform.

Overview

Microsoft 365 Defender is an antivirus program and security solution developed by Microsoft Corporation. It is designed to protect computers and networks from various forms of malware, including viruses, spyware, ransomware, and other malicious software. Microsoft Defender is available for both consumer and enterprise users and provides real-time protection against threats.

Licensing Requirements for Microsoft 365 Defender & Defender for Office 365 Integrations

To successfully integrate Microsoft 365 Defender and Microsoft Defender for Office 365 with Hunters, your Microsoft licensing plan must include access to the Advanced Hunting API and the unified security data available within the Microsoft 365 Defender portal.

Hunters relies on this API to ingest alert telemetry, email and collaboration data, threat investigation details, and continuous security event streams.

Microsoft restricts this functionality to specific licensing tiers.


To integrate with Hunters, the organization must have one of the following:

  • Microsoft Defender for Office 365 Plan 2 (P2)

    • Advanced Hunting

    • Threat Explorer

    • Automated Investigation & Response

    • Access to unified security APIs (AlertInfo, AlertEvidence, EmailEvents, etc.)

  • Microsoft 365 E5 / E5 Security

    • Includes all Defender for Office 365 Plan 2 features, plus broader Microsoft 365 Defender capabilities.

    • Other Bundles That Include Defender for Office 365 P2

    • Microsoft 365 A5

    • Microsoft 365 G5

    • Security add-on packs that explicitly include Defender for Office 365 P2 features

Microsoft Defender for Office 365 Plan 1 (P1) does not considered as supported licensing Plan.

Supported data types

MDE - Defender for Endpoint

Table name:
microsoft_365_defender_alert_evidence
microsoft_365_defender_alert_info

Integrating Microsoft Defender for Endpoint events to Hunters will allow exploring the related data, as well as triaging Defender alerts and correlating to other related threats.

🚧 Note

For this data type to work properly, make sure that mdatp-device-info is also connected in addition to the actual event, as the device info table is used for adding essential device information as part of the lead.

Expected format

The file format for all data types should be NDJSON.

📘 Note

Currently, backfilling is not supported for Azure storage account-based data flows. Hence, the "Start date" field could be ignored.

MDI - Defender for Identity

Table name:
microsoft_365_defender_alert_evidence
microsoft_365_defender_alert_info

Microsoft 365 Defender for Identity is Microsoft’s Identity detection engine, which aggregates alerts from Microsoft’s identity services. See more details on the alerts here.

Integrating the alerts to Hunters will allow triaging the alerts and correlating to other related threats.

Expected format

DefaultEndpointsProtocol=https;AccountName=defenderlogs;AccountKey=g6DbhGsQ4u890mngU7szCxq/jUioeWTd/gFHyhgde46gvDs3EuKNfSfVcUPQWazMlopLl6if5e7JKdGYtrvdfj==;EndpointSuffix=core.windows.net

MDO - Defender for Office 365

Table name:
microsoft_365_defender_alert_evidence
microsoft_365_defender_alert_info

Microsoft Defender for Office 365 is Microsoft’s Office 365 detection engine, which aggregates alerts from Microsoft’s Office 365 services. See more details on the alerts here.

Integrating the alerts to Hunters will allow triaging the alerts and correlating to other related threats.

Expected format

DefaultEndpointsProtocol=https;AccountName=defenderlogs;AccountKey=g6DbhGsQ4u890mngU7szCxq/jUioeWTd/gFHyhgde46gvDs3EuKNfSfVcUPQWazMlopLl6if5e7JKdGYtrvdfj==;EndpointSuffix=core.windows.net

MDCA - Defender for Cloud Apps

Table name:
microsoft_365_defender_advanced_hunting

More on that can be found here

Microsoft Defender Machine Software Vulnerability Changes Logs

Microsoft Defender Machine Software Vulnerability Changes is the native continuous exposure tracking and assessment capability inside the Microsoft Defender for Endpoint platform. It consolidates continuous streams of software inventory updates, newly discovered CVEs and patch application events from managed devices into actionable threat and vulnerability management insights. Microsoft Defender Machine Software Vulnerability Changes surface new vulnerability exposures, shifting exploitability metrics and remediation progress across the enterprise endpoint landscape and presents them in a standardized JSON format that enables security and IT operations teams to trace risk posture changes, prioritize patching efforts and ensure infrastructure compliance effectively.

Table name:
ms_sft_vulnerability_changes

Send data to Hunters

Hunters supports the collection of logs from Microsoft using API (and also S3).

To connect Microsoft logs:

  1. Retrieve the following information by following this guide by Microsoft:

    • Tenant ID

    • Client ID

    • Client Secret

  2. Complete the process on the Hunters platform, following this guide.

Expected format

{"id": "00000000000001_vendor_software_name_10.0.0.1_CVE-0000-00001", "deviceId": "00000000000001", "rbacGroupId": 1000, "rbacGroupName": "group_name", "deviceName": "device-0001", "osPlatform": "macOS", "osVersion": "10.0.0.0", "osArchitecture": "x64", "softwareVendor": "vendor", "softwareName": "software_name", "softwareVersion": "1.0.0.0", "cveId": "CVE-0000-00001", "vulnerabilitySeverityLevel": "High", "recommendedSecurityUpdate": "https://example.com/security-update", "recommendedSecurityUpdateId": null, "recommendedSecurityUpdateUrl": null, "diskPaths": ["/Applications/Example.app"], "registryPaths": [], "lastSeenTimestamp": "2020-01-02 00:00:00", "firstSeenTimestamp": "2020-01-01 00:00:00", "endOfSupportStatus": null, "endOfSupportDate": null, "exploitabilityLevel": "NoExploit", "recommendationReference": "va-_-vendor-_-software_name", "cvssScore": 8.3, "securityUpdateAvailable": true, "cveMitigationStatus": null, "status": "Fixed", "eventTimestamp": "2020-01-03T00:00:00.000000Z"}
{"id": "00000000000002_vendor_software_name_10.0.0.1_CVE-0000-00002", "deviceId": "00000000000002", "rbacGroupId": 1000, "rbacGroupName": "group_name", "deviceName": "device-0001", "osPlatform": "macOS", "osVersion": "10.0.0.0", "osArchitecture": "x64", "softwareVendor": "vendor", "softwareName": "software_name", "softwareVersion": "1.0.0.0", "cveId": "CVE-0000-00002", "vulnerabilitySeverityLevel": "High", "recommendedSecurityUpdate": "https://example.com/security-update", "recommendedSecurityUpdateId": null, "recommendedSecurityUpdateUrl": null, "diskPaths": ["/Applications/Example.app"], "registryPaths": [], "lastSeenTimestamp": "2020-01-02 00:00:00", "firstSeenTimestamp": "2020-01-01 00:00:00", "endOfSupportStatus": null, "endOfSupportDate": null, "exploitabilityLevel": "NoExploit", "recommendationReference": "va-_-vendor-_-software_name", "cvssScore": 8.8, "securityUpdateAvailable": true, "cveMitigationStatus": null, "status": "Fixed", "eventTimestamp": "2020-01-03T00:00:00.000000Z"}

Send data to Hunters

Microsoft Defender events are exported by Microsoft to Azure Blob Storage and consumed by Hunters from your storage. Follow the steps below to allow the export of events:

  1. Ship real-time events and alerts directly to Azure storage account by logging in to Microsoft Defender Security Center and adding a data export. For detailed instructions follow the official tutorial from Microsoft explaining how to forward events to Azure storage.

  2. Enable the collection of Alert Evidence and Alert Info to the storage. You should see corresponding container names being created with data - insights-logs-advancedhunting-alertevidence, insights-logs-advancedhunting-alertinfo.

  3. Share your Azure storage Azure connection string with Hunters Support.

📘Learn more

Learn more about the Azure connection string here.