mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 06:13:41 +00:00
92 lines
4.3 KiB
Markdown
92 lines
4.3 KiB
Markdown
---
|
|
title: Stream Microsoft Defender Advanced Threat Protection events to your Storage account
|
|
description: Learn how to configure Microsoft Defender ATP to stream Advanced Hunting events to your Storage account.
|
|
keywords: raw data export, streaming API, API, Event Hubs, Azure storage, storage account, Advanced Hunting, raw data sharing
|
|
search.product: eADQiWindows 10XVcnh
|
|
search.appverid: met150
|
|
ms.prod: w10
|
|
ms.mktglfcycl: deploy
|
|
ms.sitesec: library
|
|
ms.pagetype: security
|
|
ms.author: macapara
|
|
author: mjcaparas
|
|
ms.localizationpriority: medium
|
|
manager: dansimp
|
|
audience: ITPro
|
|
ms.collection: M365-security-compliance
|
|
ms.topic: article
|
|
---
|
|
|
|
# Configure Microsoft Defender ATP to stream Advanced Hunting events to your Storage account
|
|
|
|
**Applies to:**
|
|
|
|
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
|
|
|
Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
|
|
|
## Before you begin:
|
|
|
|
1. Create a [Storage account](https://docs.microsoft.com/azure/storage/common/storage-account-overview) in your tenant.
|
|
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights**.
|
|
3. Go to **Settings > Advanced Features > Preview features** and turn Preview features **On**.
|
|
|
|
## Enable raw data streaming:
|
|
|
|
1. Log in to [Microsoft Defender ATP portal](https://securitycenter.windows.com) with Global Admin user.
|
|
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
|
3. Click on **Add data export settings**.
|
|
4. Choose a name for your new settings.
|
|
5. Choose **Forward events to Azure Storage**.
|
|
6. Type your **Storage Account Resource Id**. In order to get your **Storage Account Resource Id**, go to your Storage account page on [Azure portal](https://ms.portal.azure.com/) > properties tab > copy the text under **Storage account resource ID**:
|
|
|
|
|
|
|
|
7. Choose the events you want to stream and click **Save**.
|
|
|
|
## The schema of the events in the Storage account:
|
|
|
|
- A blob container will be created for each event type:
|
|
|
|
|
|
|
|
- The schema of each row in a blob is the following JSON:
|
|
|
|
```
|
|
{
|
|
"time": "<The time WDATP received the event>"
|
|
"tenantId": "<Your tenant ID>"
|
|
"category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
|
|
"properties": { <WDATP Advanced Hunting event as Json> }
|
|
}
|
|
```
|
|
|
|
- Each blob contains multiple rows.
|
|
- Each row contains the event name, the time Microsoft Defender ATP received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "properties".
|
|
- For more information about the schema of Microsoft Defender ATP events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
|
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the machine. Here every event will be decorated with this column as well. See [Machine Groups](machine-groups.md) for more information.
|
|
|
|
## Data types mapping:
|
|
|
|
In order to get the data types for our events properties do the following:
|
|
|
|
1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) and go to [Advanced Hunting page](https://securitycenter.windows.com/hunting-package).
|
|
2. Run the following query to get the data types mapping for each event:
|
|
|
|
```
|
|
{EventType}
|
|
| getschema
|
|
| project ColumnName, ColumnType
|
|
|
|
```
|
|
|
|
- Here is an example for Machine Info event:
|
|
|
|
|
|
|
|
## Related topics
|
|
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
|
|
- [Microsoft Defender Advanced Threat Protection Streaming API](raw-data-export.md)
|
|
- [Stream Microsoft Defender Advanced Threat Protection events to your Azure storage account](raw-data-export-storage.md)
|
|
- [Azure Storage Account documentation](https://docs.microsoft.com/azure/storage/common/storage-account-overview)
|