3.3.8. Microsoft Defender Telemetry

3.3.8.1. What is it

You can import data that was previously recorded by Microsoft Defender for Endpoint.

Note

This feature requires an Enterprise-tier license.

3.3.8.2. How to Get The Data

To use this feature you need to either:

  • Export data from the Defender console

  • Configure API access so that Cyber Triage can query it directly

3.3.8.3. How to Import

To add Microsoft Defender data, choose Add New Host from the Incident Overview and choose the Microsoft Defender box. This brings up a single dialog with an Import Type toggle for API vs. CSV.

3.3.8.3.1. Import via API

To import directly via API from the EDR server, you must first configure it. See:

../../_images/import_add_edr_api_browse.png

  1. Choose Defender data via API for the Import Type, then search for the hostname (using “Starts With” or “Contains”) and pick it from the results list. This list comes from Defender.

  2. Choose how much data to import from the Data To Import dropdown (defaults to Last 30 days).

  3. Update the display name and reference date as needed.

  4. Press Continue to then configure automated analysis settings (see Ingest-Time Settings).

3.3.8.3.2. Import via CSV

If you do not have access to the API, choose Defender device timeline CSV as the Import Type and export data from the EDR and import those files. See:

../../_images/import_add_edr_csv.png

  1. Select the exported file(s). You can select multiple files from different time periods as long as they are for the same host.

  2. Update the display name and reference date as needed.

  3. Press Continue to then configure automated analysis settings (see Ingest-Time Settings).