Forum Discussion
MDE ingestion and MMA logs
If I use the MDE (Defender for endpoint) data connector but already have MMA agents will this create duplicate logs? If I do use the MDE data connector, should I uninstall the MMA agents or is it bes...
Data collected by the 2 diferent agents are not the same, but there might be overlapping data in some scenarios. With MMA (and AMA) you can recieve eventlog data, flatfile logs etc. With the legacy MDE connector you only get incidents from MDE and you need to use Security portal to look at data in the incident logs. With the new Microsoft 365 Defender connector you'll get the actual sensor data from MDE into your Log Analytics workspace. Please be aware that there is a cost involved with importing the logs from M365 Defender connector not covered by the Defender for Cloud P2 allowance. /Kenneth ML