SOLVED

Defender ATP data integration

Senior Member

Is it/will it ever be possible to query or pull in data from the underlying workspace that ingests all data from Defender endpoint agents?

2 Replies
best response confirmed by Teezius (Senior Member)
Solution

@Teezius 

Not sure yet.  We are exploring this.  you can import the data today by using MDATP streaming API -> Event Hub -> Logic App -> Log Analytics.

 

NOTE:  you will incur costs for EH, Logic App, Log A, and Azure Sentinel.  So copying all the data might not make sense.  It might be better to have a playbook to query MDATP and bring only needed data back to Azure Sentinel.

Or try using MTP Advanced Hunting :cool:
Depends what you're looking for?