Microsoft Defender XDR connector: add 'Microsoft Defender XDR' to ProductName filter

Juan Salazar · Juan Salazar · commit 50cb46bc0da3 · 2026-05-29T11:37:06.000-07:00
Fixes ICM 21000000998563. Post-rebrand alerts arrive with ProductName='Microsoft Defender XDR', which was missing from the SecurityAlert queries in the MicrosoftThreatProtection connector definition. This caused the connector status (lastDataReceivedQuery) to show grey/disconnected and the 'Total data received' chart / sample query to miss alerts.

Updated lastDataReceivedQuery, graphQueries baseQuery, and sampleQueries query in MicrosoftThreatProtection.JSON, plus the matching entries in Package/mainTemplate.json.
diff --git a/Solutions/Microsoft Defender XDR/Data Connectors/MicrosoftThreatProtection.JSON b/Solutions/Microsoft Defender XDR/Data Connectors/MicrosoftThreatProtection.JSON
@@ -16,7 +16,7 @@
         {
             "metricName": "Total data received",
             "legend": "Alerts",
-            "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"
+            "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
         },
         {
             "metricName": "Total data received",
@@ -47,7 +47,7 @@
     "sampleQueries": [
         {
             "description": "All Microsoft Defender XDR alerts",
-            "query": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n            | sort by TimeGenerated"
+            "query": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | sort by TimeGenerated"
         },
         {
             "description": "Find possible clear text passwords in Windows registry.",
@@ -135,7 +135,7 @@
         },
         {
             "name": "SecurityAlert",
-            "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
         },
         {
             "name": "DeviceEvents",
diff --git a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json
@@ -2043,7 +2043,7 @@
                     {
                       "metricName": "Total data received",
                       "legend": "Alerts",
-                      "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"
+                      "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
                     },
                     {
                       "metricName": "Total data received",
@@ -2143,7 +2143,7 @@
                     },
                     {
                       "name": "SecurityAlert",
-                      "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                      "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                     },
                     {
                       "name": "DeviceEvents",
@@ -2320,7 +2320,7 @@
             {
               "metricName": "Total data received",
               "legend": "Alerts",
-              "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"
+              "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
             },
             {
               "metricName": "Total data received",
@@ -2355,7 +2355,7 @@
             },
             {
               "name": "SecurityAlert",
-              "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
             },
             {
               "name": "DeviceEvents",

Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@`
`16`	`16`	`{`
`17`	`17`	`"metricName": "Total data received",`
`18`	`18`	`"legend": "Alerts",`
`19`		`- "baseQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"`
	`19`	`+ "baseQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"`
`20`	`20`	`},`
`21`	`21`	`{`
`22`	`22`	`"metricName": "Total data received",`
`@@ -47,7 +47,7 @@`
`47`	`47`	`"sampleQueries": [`
`48`	`48`	`{`
`49`	`49`	`"description": "All Microsoft Defender XDR alerts",`
`50`		`- "query": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n \| sort by TimeGenerated"`
	`50`	`+ "query": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n \| sort by TimeGenerated"`
`51`	`51`	`},`
`52`	`52`	`{`
`53`	`53`	`"description": "Find possible clear text passwords in Windows registry.",`
`@@ -135,7 +135,7 @@`
`135`	`135`	`},`
`136`	`136`	`{`
`137`	`137`	`"name": "SecurityAlert",`
`138`		`- "lastDataReceivedQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n \| summarize Time = max(TimeGenerated)\n \| where isnotempty(Time)"`
	`138`	`+ "lastDataReceivedQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n \| summarize Time = max(TimeGenerated)\n \| where isnotempty(Time)"`
`139`	`139`	`},`
`140`	`140`	`{`
`141`	`141`	`"name": "DeviceEvents",`
Original file line number	Diff line number	Diff line change
`@@ -2043,7 +2043,7 @@`
`2043`	`2043`	`{`
`2044`	`2044`	`"metricName": "Total data received",`
`2045`	`2045`	`"legend": "Alerts",`
`2046`		`- "baseQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"`
	`2046`	`+ "baseQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"`
`2047`	`2047`	`},`
`2048`	`2048`	`{`
`2049`	`2049`	`"metricName": "Total data received",`
`@@ -2143,7 +2143,7 @@`
`2143`	`2143`	`},`
`2144`	`2144`	`{`
`2145`	`2145`	`"name": "SecurityAlert",`
`2146`		`- "lastDataReceivedQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n \| summarize Time = max(TimeGenerated)\n \| where isnotempty(Time)"`
	`2146`	`+ "lastDataReceivedQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n \| summarize Time = max(TimeGenerated)\n \| where isnotempty(Time)"`
`2147`	`2147`	`},`
`2148`	`2148`	`{`
`2149`	`2149`	`"name": "DeviceEvents",`
`@@ -2320,7 +2320,7 @@`
`2320`	`2320`	`{`
`2321`	`2321`	`"metricName": "Total data received",`
`2322`	`2322`	`"legend": "Alerts",`
`2323`		`- "baseQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"`
	`2323`	`+ "baseQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"`
`2324`	`2324`	`},`
`2325`	`2325`	`{`
`2326`	`2326`	`"metricName": "Total data received",`
`@@ -2355,7 +2355,7 @@`
`2355`	`2355`	`},`
`2356`	`2356`	`{`
`2357`	`2357`	`"name": "SecurityAlert",`
`2358`		`- "lastDataReceivedQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n \| summarize Time = max(TimeGenerated)\n \| where isnotempty(Time)"`
	`2358`	`+ "lastDataReceivedQuery": "SecurityAlert \n\| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n \| summarize Time = max(TimeGenerated)\n \| where isnotempty(Time)"`
`2359`	`2359`	`},`
`2360`	`2360`	`{`
`2361`	`2361`	`"name": "DeviceEvents",`