---
title: Microsoft 365 Defender connector for Azure Sentinel in public preview
description: A new connector for Microsoft 365 Defender is in public preview in Azure Sentinel. This connector makes it possible to ingest the hunting data into SentinelCurrently, the Defender for Endpoi...
---

[Onevinn blog ](https://www.onevinn.com/blog)

# [Microsoft 365 Defender connector for Azure Sentinel in public preview](https://www.onevinn.com/blog/microsoft-365-defender-connector-for-azure-sentinel-in-public-preview)

 Written by [Security Labs - Stefan och Mattias](https://www.onevinn.com/blog/author/security-labs) | 10 Nov 2020

A new connector for Microsoft 365 Defender is in public preview in Azure Sentinel. This connector makes it possible to ingest the hunting data into Sentinel

Currently, the Defender for Endpoint Data is available

**To enable**

- Go to you Azure Sentinel Instance and select ***Connectors***
- Search for ***Microsoft 365 Defender***

******

- Click ***Open Connector Page***
- Select which Events you want to ingest

- Click ***Apply Changes***

**Example queries**

```
//Registry events
DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryValueName == "DefaultPassword"
| where RegistryKey has @"SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon"
| project Timestamp, DeviceName, RegistryKey
| top 100 by Timestamp
```

```
//Process and Network events
union DeviceProcessEvents, DeviceNetworkEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any("WebClient",
"DownloadFile",
"DownloadData",
"DownloadString",
"WebRequest",
"Shellcode",
"http",
"https")
| project Timestamp, DeviceName, InitiatingProcessFileName,
InitiatingProcessCommandLine,
FileName, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, RemoteIPType
```

If we look at the tables we can see the new created tables

**More information about the data in these tables is available in this post **[https://blog.sec-labs.com/2018/06/threat-hunting-with-windows-defender-atp/](https://blog.sec-labs.com/2018/06/threat-hunting-with-windows-defender-atp/)

For further reading:

- Azure Sentinel [https://docs.microsoft.com/sv-se/azure/sentinel](https://docs.microsoft.com/en-us/azure/sentinel/overview?WT.mc_id=ES-MVP-5003832)
- Microsoft 365 Defender [https://docs.microsoft.com/en-us/microsoft-365/security/mtp/microsoft-threat-protection](https://docs.microsoft.com/en-us/microsoft-365/security/mtp/microsoft-threat-protection?WT.mc_id=ES-MVP-5003832)

 

[View full post](https://www.onevinn.com/blog/microsoft-365-defender-connector-for-azure-sentinel-in-public-preview)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Security Labs - Stefan och Mattias"
  },
  "dateModified" : "2020-11-27T09:24:07.735Z",
  "datePublished" : "2020-11-10T14:49:00Z",
  "headline" : "Microsoft 365 Defender connector for Azure Sentinel in public preview",
  "image" : {
    "@type" : "ImageObject",
    "height" : 272,
    "url" : "https://blog.sec-labs.com/wp-content/uploads/2020/11/image-1.png",
    "width" : 467
  },
  "mainEntityOfPage" : "https://www.onevinn.com/blog/microsoft-365-defender-connector-for-azure-sentinel-in-public-preview",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Onevinn blog"
  }
}
```