Microsoft Defender Advanced Threat Hunting

1 About the Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About the Device

Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats.

You can use the threat-hunting queries to build custom detection rules. These rules run automatically to check for and then respond to suspected breach activity, misconfigured machines, and other findings.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Microsoft
Product Name	Defender Advanced Threat Hunting
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log collection method
Microsoft Defender for Endpoint	MICROSOFT_DEFENDER_ENDPOINT	JSON	CyberHub

Device Configuration

Prerequisites:

An Azure subscription that you can sign in to.
A user with either the Global Administrator or Microsoft Defender Advanced Threat Hunting Administrator role.
Azure Storage Account to store the logs or an Event Hub to stream the logs.
Log in to your Azure tenant, navigate to Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights.

Reference URLs

How to create storage account: https://docs.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal

How to configure Event Hub: https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-create

To enable raw data streaming

Log in to Microsoft Defender for Endpoint portal as a Global Administrator or Security Administrator.
Navigate to Data export settings on Microsoft Defender Security Center.
Click Add data export.
Choose a name for your new settings.
As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub.

To archive to a storage account

Choose Forward events to Azure Storage.
Type your Storage Account Resource ID. In order to get your Storage Account Resource ID, navigate to your Storage account page on Azure portal > properties tab > copy the text under Storage account resource ID.

Choose the events you want to stream and click Save.

The schema of the events in the Storage account

A blob container will be created for each event type:

The schema of each row in a blob is the following JSON:

{
"time": "<The time WDATP received the event>"
"tenantId": "<Your tenant ID>"
"category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
"properties": { <WDATP Advanced Hunting event as Json> }
}

Each blob contains multiple rows. Each row contains the event name, the time Defender for Endpoint received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "properties". For more information about the schema of Microsoft Defender for Endpoint events, see Advanced Hunting overview. In Advanced Hunting, the DeviceInfo table has a column named MachineGroup which contains the group of the device. Here every event will be decorated with this column as well. See Device Groups for more information.

To Stream logs to an event hub

Choose Forward events to Azure Event Hubs.
Type your Event Hubs name and your Event Hubs resource ID.
In order to get your Event Hubs resource ID, go to your Azure Event Hubs namespace page on Azure > properties tab > copy the text under Resource ID:

Choose the events you want to stream and click Save.

The schema of the events in Azure Event Hubs

{
    "records": [
                    {
                        "time": "<The time WDATP received the event>"
                        "tenantId": "<The Id of the tenant that the event belongs to>"
                        "category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
                        "properties": { <WDATP Advanced Hunting event as Json> }
                    }
                    ...
                ]
}

Each event hub message in Azure Event Hubs contains list of records. Each record contains the event name, the time Microsoft Defender for Endpoint received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "properties". For more information about the schema of Microsoft Defender for Endpoint events, see Advanced Hunting overview. In Advanced Hunting, the DeviceInfo table has a column named MachineGroup which contains the group of the device. Here every event will be decorated with this column as well. See Device Groups for more information.

Integration Parameters

Parameters required from customer for Integration.

Via Azure Storage:

Property	Default Value	Description

Property	Default Value	Description
Logging Source	N/A	Select Storage
eventHubConnectionString	N/A	N/A (keep blank)
consumerGroupName	N/A	N/A (keep blank)
Account Key	Custome value	Access Key to access storage account
Blob Container	N/A	Storage blob Container name e.g. insights-activity-logs
Storage Account Name	Custom Value	Azure storage account name
Subscription	N/A	Subscription ID that customer wants to be monitored
initialReadPolicy	N/A	Select Beginning to start reading from beginning and End to start reading logs from the end

Via Azure EventHub:

Property	Default Value	Description

Property	Default Value	Description
Logging Source	N/A	Select EventHub
eventHubConnectionString	N/A	Event hub connection string
consumerGroupName	N/A	Optional and used if consumer Group is other than default
Account Key	Custom Value	Access Key to access storage account
Blob Container	N/A	Storage blob Container name
Storage Account Name	Custom Value	Azure storage account name
Subscription	N/A	Set EventHub name
initialReadPolicy	N/A	N/A (keep default selection)