Event banner
Event details
What is the overlap with Defender for Identity and Sentinel log analytics? Do all logs need to be in the same region or in the same log analytics area for Defender to take advantage of logs, or does it operate outside of that?
In my opinion there is no overlap......those are 2 different products.......But you can utilize the raw data of MDI into Sentinel to correlate also other data sources with the raw data of MDI the second question i do not really understand.....but I think the answer is Yes 🙂
- YaronParyanty
Microsoft
The core of MDI is the powerful detection engine that is made possible by performing deep packet inspection and windows events collected from the domain control. Sentinel log analytics store events and provide users with tools to slice and dice the data and create queries. They are complementary solutions that can be used side by side for different purposes. You can stream the MDI alert information and evidence from M365D into Sentinel and you can use M365D Advanced Hunting to send additional data to Sentinel Log Analytics. It’s up for the customer to decide on which regions to use for each of the products.
