Overview

Microsoft Defender for Endpoint is Microsoft’s EDR, collecting various logs from endpoints with MDATP agents - Devices Info, Process Info, Network Events, etc. Integrating MDATP events to Hunters will allow exploring the related data, as well as triaging alerts by MDATP and correlating to other related threats.

Prerequisites

MDATP events are exported by Microsoft to Azure Blob Storage and consumed by Hunters from your storage. Follow the next steps to allow the export of events:

  1. Ship real time events and alerts directly to Azure storage account by logging in to Microsoft Defender Security Center and adding a data export. For detailed instructions follow this official tutorial of Microsoft explaining how to forward events to Azure storage.

  2. Share your Azure storage with Hunters using this tutorial - Sharing Azure storage with Hunters.

Creating a Data flow in the Hunters portal

🔑 Key points to remember:

  • Blob Prefix field should always remain empty

  • File Format should always be NDJSON

Note: In the bottom of this page see an example of what a data type input should look like.

  1. In the Product box, select Microsoft MDATP

  2. In the Source box, select Azure Blob Storage

  3. Paste the Connection string from the prerequisites section (see connection string example below)

    DefaultEndpointsProtocol=https;AccountName=defenderlogs;AccountKey=g6DbhGsQ4u890mngU7szCxq/jUioeWTd/gFHyhgde46gvDs3EuKNfSfVcUPQWazMlopLl6if5e7JKdGYtrvdfj==;EndpointSuffix=core.windows.net
    CODE
  4. For each Data Type, fill in the appropriate File Format and Container name according to the table below.

  5. Blob Prefix should remain empty

  6. The file format for all data types should be NDJSON

Currently, backfilling is not supported for Azure storage account based data flows. Hence, the "Start date" field could be ignored.

Data Type

File Format

Container name

Alert Evidence

NDJSON

insights-logs-advancedhunting-alertevidence

Alert Info

NDJSON

insights-logs-advancedhunting-alertinfo

Device Alert Events

NDJSON

insights-logs-advancedhunting-devicealertevents

Device Info

NDJSON

insights-logs-advancedhunting-deviceinfo

Device Network Info

NDJSON

insights-logs-advancedhunting-devicenetworkinfo

Device Process Events

NDJSON

insights-logs-advancedhunting-deviceprocessevents

Device Network Events

NDJSON

insights-logs-advancedhunting-devicenetworkevents

Device File Events

NDJSON

insights-logs-advancedhunting-devicefileevents

Device Registry Events

NDJSON

insights-logs-advancedhunting-deviceregistryevents

Device Logon Events

NDJSON

insights-logs-advancedhunting-devicelogonevents

Device Image Load Events

NDJSON

insights-logs-advancedhunting-deviceimageloadevents

Device Events

NDJSON

insights-logs-advancedhunting-deviceevents

Example