---
title: "Microsoft 365 Defender"
slug: "microsoft-365-defender"
tags: ["Self Service Ingestion"]
updated: 2026-08-31T07:06:26Z
published: 2026-08-31T07:06:26Z
canonical: "docs.hunters.ai/microsoft-365-defender"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365 Defender

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/f654d4a-mic.png?sv=2026-02-06&spr=https&st=2026-10-17T14%3A49%3A55Z&se=2026-10-17T15%3A49%3A55Z&sr=c&sp=r&sig=2KHNd7K0Q9L3Syas5TN54GIufgXZhxt28h43f7zdJgM%3D)

          Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

## Overview

Microsoft 365 Defender is an antivirus program and security solution developed by Microsoft Corporation. It is designed to protect computers and networks from various forms of malware, including viruses, spyware, ransomware, and other malicious software. Microsoft Defender is available for both consumer and enterprise users and provides real-time protection against threats.

> [!CAUTION]
> Licensing Requirements for Microsoft 365 Defender & Defender for Office 365 Integrations
> 
> To successfully integrate Microsoft 365 Defender and Microsoft Defender for Office 365 with Hunters, your Microsoft licensing plan must include access to the Advanced Hunting API and the unified security data available within the Microsoft 365 Defender portal.
> 
> Hunters relies on this API to ingest alert telemetry, email and collaboration data, threat investigation details, and continuous security event streams.
> 
> Microsoft restricts this functionality to specific licensing tiers.
> 
> To integrate with Hunters, the organization must have one of the following:
> 
> - Microsoft Defender for Office 365 Plan 2 (P2)
>   - Advanced Hunting
>   - Threat Explorer
>   - Automated Investigation & Response
>   - Access to unified security APIs (AlertInfo, AlertEvidence, EmailEvents, etc.)
> - Microsoft 365 E5 / E5 Security
>   - Includes all Defender for Office 365 Plan 2 features, plus broader Microsoft 365 Defender capabilities.
>   - Other Bundles That Include Defender for Office 365 P2
>   - Microsoft 365 A5
>   - Microsoft 365 G5
>   - Security add-on packs that explicitly include Defender for Office 365 P2 features
> 
> 
> 
> **Microsoft Defender for Office 365 Plan 1 (P1) does not considered as supported licensing Plan.**

## Supported data types

### MDE - Defender for Endpoint

**Table name:** `microsoft_365_defender_alert_evidence` `microsoft_365_defender_alert_info`

Integrating Microsoft Defender for Endpoint events to Hunters will allow exploring the related data, as well as triaging Defender alerts and correlating to other related threats.

> [!WARNING]
> 🚧 **Note**
> 
> For this data type to work properly, make sure that `mdatp-device-info` is also connected in addition to the actual event, as the device info table is used for adding essential device information as part of the lead.

### Expected format

The file format for all data types should be NDJSON.

📘 **Note**

Currently, backfilling is not supported for Azure storage account-based data flows. Hence, the "Start date" field could be ignored.

### MDI - Defender for Identity

**Table name:** `microsoft_365_defender_alert_evidence` `microsoft_365_defender_alert_info`

Microsoft 365 Defender for Identity is Microsoft’s Identity detection engine, which aggregates alerts from Microsoft’s identity services. See more details on the alerts here.

Integrating the alerts to Hunters will allow triaging the alerts and correlating to other related threats.

### Expected format

```plaintext
DefaultEndpointsProtocol=https;AccountName=defenderlogs;AccountKey=g6DbhGsQ4u890mngU7szCxq/jUioeWTd/gFHyhgde46gvDs3EuKNfSfVcUPQWazMlopLl6if5e7JKdGYtrvdfj==;EndpointSuffix=core.windows.net
```

### MDO - Defender for Office 365

**Table name:** `microsoft_365_defender_alert_evidence` `microsoft_365_defender_alert_info`

Microsoft Defender for Office 365 is Microsoft’s Office 365 detection engine, which aggregates alerts from Microsoft’s Office 365 services. See more details on the alerts here.

Integrating the alerts to Hunters will allow triaging the alerts and correlating to other related threats.

### Expected format

```plaintext
DefaultEndpointsProtocol=https;AccountName=defenderlogs;AccountKey=g6DbhGsQ4u890mngU7szCxq/jUioeWTd/gFHyhgde46gvDs3EuKNfSfVcUPQWazMlopLl6if5e7JKdGYtrvdfj==;EndpointSuffix=core.windows.net
```

### MDCA - Defender for Cloud Apps

**Table name:** `microsoft_365_defender_advanced_hunting`

More on that can be found [here](/v1/docs/microsoft-defender#overview)

### Microsoft Defender Machine Software Vulnerability Changes Logs

Microsoft Defender Machine Software Vulnerability Changes is the native continuous exposure tracking and assessment capability **inside** the **Microsoft Defender for Endpoint** platform. It consolidates continuous streams of software inventory updates, newly discovered CVEs and patch application events from managed devices into actionable threat and vulnerability management insights. Microsoft Defender Machine Software Vulnerability Changes surface new vulnerability exposures, shifting exploitability metrics and remediation progress across the enterprise endpoint landscape and presents them in a standardized JSON format that enables security and IT operations teams to trace risk posture changes, prioritize patching efforts and ensure infrastructure compliance effectively.

**Table name:** `ms_sft_vulnerability_changes`

## Send data to Hunters

Hunters supports the collection of logs from Microsoft using API (and also S3).

**To connect Microsoft logs:**

1. Retrieve the following information by following [this guide](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp?tabs=PowerShell) by Microsoft:
  - Tenant ID
  - Client ID
  - Client Secret
2. Complete the process on the Hunters platform, following [this guide](https://hunters.document360.io/docs/connect-a-data-source).

### Expected format

```json
{"id": "00000000000001_vendor_software_name_10.0.0.1_CVE-0000-00001", "deviceId": "00000000000001", "rbacGroupId": 1000, "rbacGroupName": "group_name", "deviceName": "device-0001", "osPlatform": "macOS", "osVersion": "10.0.0.0", "osArchitecture": "x64", "softwareVendor": "vendor", "softwareName": "software_name", "softwareVersion": "1.0.0.0", "cveId": "CVE-0000-00001", "vulnerabilitySeverityLevel": "High", "recommendedSecurityUpdate": "https://example.com/security-update", "recommendedSecurityUpdateId": null, "recommendedSecurityUpdateUrl": null, "diskPaths": ["/Applications/Example.app"], "registryPaths": [], "lastSeenTimestamp": "2020-01-02 00:00:00", "firstSeenTimestamp": "2020-01-01 00:00:00", "endOfSupportStatus": null, "endOfSupportDate": null, "exploitabilityLevel": "NoExploit", "recommendationReference": "va-_-vendor-_-software_name", "cvssScore": 8.3, "securityUpdateAvailable": true, "cveMitigationStatus": null, "status": "Fixed", "eventTimestamp": "2020-01-03T00:00:00.000000Z"}
{"id": "00000000000002_vendor_software_name_10.0.0.1_CVE-0000-00002", "deviceId": "00000000000002", "rbacGroupId": 1000, "rbacGroupName": "group_name", "deviceName": "device-0001", "osPlatform": "macOS", "osVersion": "10.0.0.0", "osArchitecture": "x64", "softwareVendor": "vendor", "softwareName": "software_name", "softwareVersion": "1.0.0.0", "cveId": "CVE-0000-00002", "vulnerabilitySeverityLevel": "High", "recommendedSecurityUpdate": "https://example.com/security-update", "recommendedSecurityUpdateId": null, "recommendedSecurityUpdateUrl": null, "diskPaths": ["/Applications/Example.app"], "registryPaths": [], "lastSeenTimestamp": "2020-01-02 00:00:00", "firstSeenTimestamp": "2020-01-01 00:00:00", "endOfSupportStatus": null, "endOfSupportDate": null, "exploitabilityLevel": "NoExploit", "recommendationReference": "va-_-vendor-_-software_name", "cvssScore": 8.8, "securityUpdateAvailable": true, "cveMitigationStatus": null, "status": "Fixed", "eventTimestamp": "2020-01-03T00:00:00.000000Z"}
```

## Send data to Hunters

Microsoft Defender events are exported by Microsoft to Azure Blob Storage and consumed by Hunters from your storage. Follow the steps below to allow the export of events:

1. Ship real-time events and alerts directly to Azure storage account by logging in to [Microsoft Defender Security Center](https://security.microsoft.com/settings/mtp_settings/raw_data_export) and adding a data export. For detailed instructions follow the [official tutorial from Microsoft](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage) explaining how to forward events to Azure storage.
2. Enable the collection of Alert Evidence and Alert Info to the storage. You should see corresponding container names being created with data - `insights-logs-advancedhunting-alertevidence`, `insights-logs-advancedhunting-alertinfo`.
3. Share your Azure storage **Azure connection string** with Hunters Support.

📘Learn more

Learn more about the Azure connection string [here](https://learn.microsoft.com/en-us/azure/storage/common/storage-configure-connection-string#configure-a-connection-string-for-an-azure-storage-account).

A Hunters environment. A customer can have multiple sub-tenants under a main tenant.