The Microsoft 365 Defender data connector unifies data collection from Microsoft Defender SaaS security solutions into Microsoft Sentinel. It provides a shared integration path for Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, and Defender for Identity. section 8.3.3
Use the connector to:
- Generate Sentinel incidents from alerts and entities produced by connected Microsoft Defender solutions. section 8.4.1
- Verify incoming security data by opening Microsoft Sentinel, selecting Logs, choosing SecurityAlerts, and running the query. section 8.3.3
- Treat ingestion as one layer of operations; analytics rules, workbooks, and playbooks provide additional detection and response content. section 8.3.3
Before creating incident rules, connect the relevant security solutions to Microsoft Sentinel through data connectors or Content hub. The connector centralizes collection, while incident rules turn selected alerts and entities into operational cases. section 8.4.1
