Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-microsoft-defender

Microsoft Defender XDR

You can integrate Microsoft Defender XDR with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Microsoft Defender XDR product overview

Microsoft Defender XDR is a unified security platform that provides endpoint protection and extended detection and response (XDR) across identity, email, applications, and cloud workloads.

What we ingest

Sophos XDR receives endpoint telemetry and security alerts from Microsoft Defender XDR via Azure Storage Account or Event Hubs. In Microsoft Defender XDR, data export to Azure Storage Account or Event Hubs is configured using the Streaming API.

If the integration is based on an Azure Storage Account, Sophos XDR periodically discovers new blobs in the Storage Account, then periodically reads Microsoft Defender events that are appended to each discovered blob.

If the integration is based on Azure Event Hubs, Sophos XDR continuously streams Microsoft Defender events using the Apache Kafka protocol.

Sophos XDR can authenticate to Azure Storage Account and Event Hubs using either Microsoft Entra ID Federated Credential or Connection String.

Event and data types

We ingest the following event and data types from Microsoft Defender XDR:

  • AlertInfo: Information about alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Normalized to third-party security alert telemetry.
  • AlertEvidence: Information about various entities, such as files, IP addresses, URLs, users, or devices, associated with alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Normalized to third-party security alert telemetry.
  • DeviceInfo: Information about devices in the organization, including OS version, active users, and computer name. Normalized to Microsoft Defender endpoint information.
  • DeviceNetworkInfo: Information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Normalized to Microsoft Defender endpoint information.
  • DeviceProcessEvents: Information about process creation and related events. Normalized to process telemetry.

  • DeviceNetworkEvents1: Information about network connections and related events. Normalized to netflow telemetry.

  • DeviceFileEvents: Information about file creation, modification, and other file system events. Normalized to file modification telemetry.

  • DeviceRegistryEvents: Information about the creation and modification of registry entries. Normalized to registry telemetry.
  • DeviceLogonEvents: Information about user logons and other authentication events on devices. Normalized to authentication telemetry.
  • DeviceImageLoadEvents: Information about DLL loading events. Normalized to process module telemetry.

  • DeviceFileCertificateInfo1: Information about DLL loading events. Normalized to generic telemetry.

  • DeviceEvents: Information about various event types, including events triggered by security controls, such as Microsoft Defender Antivirus and exploit protection. Normalized to various telemetry types, depending on the ActionType value:

    • UserAccountCreated, UserAccountModified, UserAccountDeleted, UserAccountAddedToLocalGroup, UserAccountRemovedFromLocalGroup, SecurityGroupCreated, SecurityGroupDeleted, SecurityLogCleared, PasswordChangeAttempt: Normalized to authentication telemetry.
    • ScheduledTaskCreated, ScheduledTaskDeleted, ScheduledTaskEnabled, ScheduledTaskDisabled: Normalized to registry telemetry.
    • ExploitGuardNetworkProtectionBlocked, ExploitGuardNetworkProtectionAudited: Normalized to HTTP telemetry.
    • CreateRemoteThreadApiCall: Normalized to thread injection telemetry.
    • Values ending in ApiCall: Normalized to API call telemetry.
    • DnsQueryResponse: Normalized to DNS telemetry.
    • ScriptContent, PowerShellCommand: Normalized to script block telemetry.
    • AntivirusDetection: Normalized to antivirus telemetry.
    • ServiceInstalled: Normalized to persistence telemetry.
    • ShellLinkCreateFileEvent: Normalized to file modification telemetry.
    • RemoteWmiOperation, WmiBindEventFilterToConsumer, LdapSearch: Normalized to management event telemetry.
    • FirewallInboundConnectionBlocked, FirewallInboundConnectionToAppBlocked, FirewallOutboundConnectionBlocked: Normalized to netflow telemetry. 1
    • Other: Normalized to generic telemetry. 1

Data provided by this integration

Data provided by Microsoft Defender XDR gets normalized to the following schemas:

  • antivirus
  • apicall
  • auth
  • dns
  • filemod
  • generic 1
  • http
  • managementevent
  • netflow 1
  • persistence
  • process
  • processmodule
  • registry
  • scriptblock
  • thirdpartyalert
  • threadinjection

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation

  1. Netflow and generic telemetry are only available with a Sophos Next-Gen SIEM subscription. See Sophos Next-Gen SIEM overview. ↩↩↩↩↩↩