What’s new: Microsoft 365 Defender connector now in Public Preview for Microsoft Sentinel

Sarah_Young What KerimTupkovic  meant by "suite data connector" is this new M365 Defender connector which supports all Defender products under one connector. Defender suite of products.

KerimTupkovic  This new connector will not replace the individual Data connectors for all the four security solution under this new umbrella connector.

Microsoft 365 Defender (New Connector) : Is meant to collect advanced hunting logs only.

https://docs.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender

While the individual connectors like Microsoft Defender for Endpoint / MDATP : 

These are for collecting the alerts alone

https://docs.microsoft.com/en-us/azure/sentinel/connect-microsoft-defender-advanced-threat-protection

Sarah_Young I too was a bit confused initially as I thought that this would collect alerts too and so would replace the separate connector.

Maybe a good idea to update the post with a note on the above point, for those who don't reach the comments section 🙂

Also maybe as a feedback on the design of connectors why not bring in the option to have a checkbox with "Alerts" under the new connector and do away with multiple different connectors. One place to rule them all. 🙂