Commit b58de3d
Juan Salazar
Microsoft Defender XDR connector: add 'Microsoft Defender XDR' to ProductName filter
Fixes ICM 21000000998563. Post-rebrand alerts arrive with ProductName='Microsoft Defender XDR', which was missing from the SecurityAlert queries in the MicrosoftThreatProtection connector definition. This caused the connector status (lastDataReceivedQuery) to show grey/disconnected and the 'Total data received' chart / sample query to miss alerts.
Updated lastDataReceivedQuery, graphQueries baseQuery, and sampleQueries query in MicrosoftThreatProtection.JSON, plus the matching entries in Package/mainTemplate.json.1 parent 40a797f commit b58de3d
4 files changed
Lines changed: 1188 additions & 1187 deletions
File tree
- Solutions/Microsoft Defender XDR
- Data Connectors
- Data
- Package
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
16 | 16 | | |
17 | 17 | | |
18 | 18 | | |
19 | | - | |
| 19 | + | |
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
| |||
47 | 47 | | |
48 | 48 | | |
49 | 49 | | |
50 | | - | |
| 50 | + | |
51 | 51 | | |
52 | 52 | | |
53 | 53 | | |
| |||
135 | 135 | | |
136 | 136 | | |
137 | 137 | | |
138 | | - | |
| 138 | + | |
139 | 139 | | |
140 | 140 | | |
141 | 141 | | |
| |||
0 commit comments