Skip to content

Commit b58de3d

Browse files
author
Juan Salazar
committed
Microsoft Defender XDR connector: add 'Microsoft Defender XDR' to ProductName filter
Fixes ICM 21000000998563. Post-rebrand alerts arrive with ProductName='Microsoft Defender XDR', which was missing from the SecurityAlert queries in the MicrosoftThreatProtection connector definition. This caused the connector status (lastDataReceivedQuery) to show grey/disconnected and the 'Total data received' chart / sample query to miss alerts. Updated lastDataReceivedQuery, graphQueries baseQuery, and sampleQueries query in MicrosoftThreatProtection.JSON, plus the matching entries in Package/mainTemplate.json.
1 parent 40a797f commit b58de3d

4 files changed

Lines changed: 1188 additions & 1187 deletions

File tree

Solutions/Microsoft Defender XDR/Data Connectors/MicrosoftThreatProtection.JSON

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
{
1717
"metricName": "Total data received",
1818
"legend": "Alerts",
19-
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"
19+
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
2020
},
2121
{
2222
"metricName": "Total data received",
@@ -47,7 +47,7 @@
4747
"sampleQueries": [
4848
{
4949
"description": "All Microsoft Defender XDR alerts",
50-
"query": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n | sort by TimeGenerated"
50+
"query": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n | sort by TimeGenerated"
5151
},
5252
{
5353
"description": "Find possible clear text passwords in Windows registry.",
@@ -135,7 +135,7 @@
135135
},
136136
{
137137
"name": "SecurityAlert",
138-
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
138+
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
139139
},
140140
{
141141
"name": "DeviceEvents",

0 commit comments

Comments
 (0)