Integrating with Microsoft 365 Defender

Overview

Blumira integrates with Microsoft 365 Defender using Microsoft Event Hubs.

Before you begin

First, integrate Azure Event Hubs with Blumira by completing the steps in Integrating with Microsoft Azure Event Hubs. 

Next, gather the Event Hub Name and the Resource ID of the Azure event hub namespace that you created for Blumira, which are in your Azure Event Hubs Namespace page > Properties menu. 

Forwarding Microsoft Defender events to Blumira

To connect Microsoft 365 Defender to your Blumira event hub in Azure:

1. Log in to security.microsoft.com as a Global Admin.

2. Navigate to Settings.

3. Click Microsoft 365 Defender.

4. Click Streaming API.

5. Click Add.

6. Type a name for your new settings.

7. Click Forward events to Event Hubs.

8. Type your Blumira Event Hub Namespace Resource ID and Event Hub Name. 

9. Select the event types you want to stream.

10. Click Save.