Skip to content

Commit 96c6715

Browse files
Juan SalazarCopilot
andcommitted
Microsoft Defender XDR: apply ProductName filter change to mainTemplate.json
Manually update the same 4 ProductName filter clauses in the generated mainTemplate.json to include 'Microsoft Defender XDR', matching the data connector source. No repackage per maintainer guidance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent bcd5063 commit 96c6715

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

Solutions/Microsoft Defender XDR/Package/mainTemplate.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2043,7 +2043,7 @@
20432043
{
20442044
"metricName": "Total data received",
20452045
"legend": "Alerts",
2046-
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"
2046+
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
20472047
},
20482048
{
20492049
"metricName": "Total data received",
@@ -2143,7 +2143,7 @@
21432143
},
21442144
{
21452145
"name": "SecurityAlert",
2146-
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
2146+
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
21472147
},
21482148
{
21492149
"name": "DeviceEvents",
@@ -2320,7 +2320,7 @@
23202320
{
23212321
"metricName": "Total data received",
23222322
"legend": "Alerts",
2323-
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"
2323+
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
23242324
},
23252325
{
23262326
"metricName": "Total data received",
@@ -2355,7 +2355,7 @@
23552355
},
23562356
{
23572357
"name": "SecurityAlert",
2358-
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
2358+
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
23592359
},
23602360
{
23612361
"name": "DeviceEvents",

0 commit comments

Comments
 (0)