Forum Discussion
non-MS AV Product
It sounds like you would like to know which events (= event IDs) are being sent to Defender XDR in passive mode so you can leverage them via Advanced Hunting. As far as I know, there is currently no list that Microsoft published that shows that kind of information.
There is an interesting blog series by Olaf Hartong (https://medium.com/falconforce/mdeinternals/home) about MDE and telemetry. In short, not all events are logged locally and not all events are being sent from the device to the portal. Data in Advanced Hunting is also not the same as the data in the device's timeline.
It might be a better solution to use AMA to push the events that you want to Sentinel. Using MDE in passive mode might also cause performance issues, and you probably receive a ton of redundant data that you might already receive through your third-party AV solution (or is it an EDR solution?).
- unaware of all the enablement within passive mode, will you provide links around this subset of passive mode?
- I meant the policies you configured in relation to edr, asr, av, exploit protection, device control etc.
- yea but we use another av solution not MS defender for endpoint. want to keep current vendor but leverage mde in passive mode to see if we can collect logs from endpoints instead of having to deploy ama with dcr to collect logs into sentinel
- SmartAppControl disabled with MDE in passive mode, unsure if this is even possible?