Duplicate logs XDR

Brass Contributor

Will I get duplicate logs if I enable XDR connector and MDE, MDI, MDO, MDCA connectors separately in Sentinel?

Thanks

2 Replies
The Defender XDR connector controls the others, its the master, let it do its job. Source: https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE Note When you enable the Microsoft Defender XDR connector, all of the Microsoft Defender XDR components’ connectors (the ones mentioned at the beginning of this article) are automatically connected in the background. In order to disconnect one of the components’ connectors, you must first disconnect the Microsoft Defender XDR connector.
makes sense, thanks a lot Clive!