Integrating with Microsoft 365 Defender

Overview

Defender for Microsoft 365 is an add-on license that extends the security capabilities of Microsoft 365. This product was also known as Advanced Threat Protection. This provides organizations the ability to create policies to protect users, email attachment sandboxing, advanced threat block capabilities, and more.

Requirement: To receive Microsoft 365 Defender logs in Blumira, you must have the Microsoft Azure Event Hubs Module configured on a Blumira sensor.

Before you begin

First, integrate Azure Event Hubs with Blumira by completing the steps in Integrating with Microsoft Azure Event Hubs. 

Next, gather the Event Hub Name and the Resource ID of the Azure event hub namespace that you created for Blumira, which are in your Azure Event Hubs Namespace page > Properties menu. 

Forwarding Microsoft Defender events to Blumira

To connect Microsoft 365 Defender to your Blumira event hub in Azure:

1. Log in to security.microsoft.com as a Global Admin.

2. Navigate to Settings.

3. Click Microsoft 365 Defender.

4. Click Streaming API.

5. Click Add.

6. Type a name for your new settings.

7. Click Forward events to Azure Event Hubs.

8. Type your Blumira Event Hub Namespace Resource ID and Event Hub Name. 

9. Select the event types you want to stream.

10. Click Save.