Question

Your organization already uses Microsoft Defender XDR to generate incidents from Defender for Endpoint, Defender for Office 365, and Defender for Identity. You are onboarding Microsoft Sentinel and must ensure that all Defender XDR incidents (including their alerts and entity information) appear in Sentinel with bi-directional sync, so that closing an incident in one portal updates the other. What should you do?

Accepted Answer

Install the Microsoft Defender XDR data connector in Sentinel and enable the incident and alert connection, including bi-directional sync.

Answer

Create a scheduled analytics rule in Sentinel that queries the SecurityAlert table and groups related alerts into incidents.

Answer

Deploy the Azure Monitor Agent to each device and configure a data collection rule to forward Defender alerts to the DeviceEvents table.

Answer

Enable the individual Defender for Endpoint, Defender for Office 365, and Defender for Identity connectors separately and let Sentinel's Fusion engine correlate them.