Forum Discussion

Sergei2435's avatar
Sergei2435
Brass Contributor
Apr 10, 2024

Duplicate logs XDR

Will I get duplicate logs if I enable XDR connector and MDE, MDI, MDO, MDCA connectors separately in Sentinel?

Thanks

data collection

2 Replies

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Apr 11, 2024
    The Defender XDR connector controls the others, its the master, let it do its job. Source: https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE Note When you enable the Microsoft Defender XDR connector, all of the Microsoft Defender XDR components’ connectors (the ones mentioned at the beginning of this article) are automatically connected in the background. In order to disconnect one of the components’ connectors, you must first disconnect the Microsoft Defender XDR connector.

Resources