Defender ATP data integration

[Teezius]

Is it/will it ever be possible to query or pull in data from the underlying workspace that ingests all data from Defender endpoint agents?

[#2 · Accepted solution]

@Teezius 

Not sure yet.  We are exploring this.  you can import the data today by using MDATP streaming API -> Event Hub -> Logic App -> Log Analytics.

NOTE:  you will incur costs for EH, Logic App, Log A, and Azure Sentinel.  So copying all the data might not make sense.  It might be better to have a playbook to query MDATP and bring only needed data back to Azure Sentinel.

[#3]

Or try using MTP Advanced Hunting 
Depends what you're looking for?