Skip to content

Commit bcd5063

Browse files
Juan SalazarCopilot
andcommitted
Microsoft Defender XDR: add 'Microsoft Defender XDR' to ProductName filter in data connector source
Add the renamed product name to all three SecurityAlert ProductName filter clauses in MicrosoftThreatProtection.JSON (baseQuery, query, lastDataReceivedQuery) so alerts from the renamed product surface correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 44ea471 commit bcd5063

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

Solutions/Microsoft Defender XDR/Data Connectors/MicrosoftThreatProtection.JSON

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
{
1717
"metricName": "Total data received",
1818
"legend": "Alerts",
19-
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")"
19+
"baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
2020
},
2121
{
2222
"metricName": "Total data received",
@@ -47,7 +47,7 @@
4747
"sampleQueries": [
4848
{
4949
"description": "All Microsoft Defender XDR alerts",
50-
"query": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n | sort by TimeGenerated"
50+
"query": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n | sort by TimeGenerated"
5151
},
5252
{
5353
"description": "Find possible clear text passwords in Windows registry.",
@@ -135,7 +135,7 @@
135135
},
136136
{
137137
"name": "SecurityAlert",
138-
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
138+
"lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
139139
},
140140
{
141141
"name": "DeviceEvents",

0 commit comments

Comments
 (0)