Question

Your SOC uses Microsoft Sentinel with the Microsoft Defender XDR connector already enabled to stream incidents into Sentinel. Analysts also want the ability to build Sentinel scheduled analytics rules that correlate individual Microsoft Defender for Endpoint alerts with firewall Syslog data in the same workspace. Currently only Defender XDR incidents appear in Sentinel, not the raw underlying Defender for Endpoint alerts as separate events. What should you configure to make the individual Defender for Endpoint alerts available for custom KQL correlation?

Accepted Answer

Enable the 'Connect incidents & alerts' (Microsoft Defender XDR alert streaming) option so individual alerts populate the SecurityAlert table

Answer

Create an automation rule that copies incident details into a custom table on each incident creation

Answer

Increase the workspace data retention period so historical Defender for Endpoint alerts are retained longer

Answer

Deploy the Azure Monitor Agent to each onboarded endpoint to forward Defender for Endpoint alerts via a data collection rule