> For the complete documentation index, see [llms.txt](https://msdocs.aohwv.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://msdocs.aohwv.com/quick-start/step-3-defender-xdr.md).
# Step 3 — Defender XDR
Microsoft Defender XDR brings together Microsoft's security products: **Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps**. One setting in the Defender portal streams their alerts and activity to your SIEM.
{% hint style="info" %}
**Time:** about 15 minutes
{% endhint %}
### Before you start
* **Step 1 — Event Hub Setup** is complete
* **Security Administrator** or **Global Administrator** in the Microsoft Defender portal
* **Contributor** (or Owner) on the Event Hub namespace in Azure
* At least one Defender product licensed (included in Microsoft 365 E5, or as add-ons)
### 1. Copy the Event Hub namespace resource ID
1. In the [Azure portal](https://portal.azure.com), open your Event Hub namespace from Step 1.
2. Select **Settings** → **Properties**.
3. Copy the **Resource ID**. It starts with `/subscriptions/...`
### 2. Add the streaming setting
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com).
2. Go to **Settings** → **Microsoft Defender XDR** → **Streaming API**.
3. Select **+ Add**.
4. **Name:** `siem-stream`
5. Check **Forward events to Event Hub**, then enter:
* **Event Hub resource ID:** the Resource ID you copied
* **Event Hub name:** `defender-xdr`
6. Under **Event Types**, select the categories below.
7. Select **Submit**.
{% hint style="info" %}
You can have up to **5** streaming settings (shown as **Available Capacity** on the Streaming API page). One is enough for your SIEM.
{% endhint %}
### 3. Choose the event types
The event types are grouped into five categories. Expand each one with the arrow to see the individual tables. You'll only get data for the Defender products you're licensed for.
| Category | Select? | What it shows |
| ------------------------- | -------------------------- | -------------------------------------------------------------------------------------------------------------- |
| **Alerts & Behaviors** | **Yes, all** | Every Defender alert and the users, devices, files and IPs involved |
| **Apps & Identities** | **Yes, all** | On-premises Active Directory activity (Defender for Identity) and cloud app activity (Defender for Cloud Apps) |
| **Email & collaboration** | **Yes, all** | Phishing and malware emails, and who clicked malicious links (Defender for Office 365) |
| **Devices** | Yes, after checking volume | Processes, files, network connections and logons on devices (Defender for Endpoint) |
| **Cloud Infrastructure** | Optional | Activity from cloud workloads. Select if you use Defender for Cloud |
{% hint style="warning" %}
**Devices are high volume.** Device events are the most detailed endpoint data, but they can be much larger than all other sources combined. If ingestion cost is a concern, start with the other categories, then add Devices once you've estimated the volume.
{% endhint %}
### Estimate the volume (optional)
To estimate how much data each table will send, run this query in the Defender portal under **Investigation & response** → **Hunting** → **Advanced hunting**:
```kusto
union withsource=Table Device*, Email*, Identity*, CloudAppEvents, AlertInfo, AlertEvidence
| where Timestamp > ago(1d)
| summarize EventsPerDay = count() by Table
| sort by EventsPerDay desc
```
Share the results with RedLegg to estimate ingestion costs.
### What your SOC can detect with these logs
* Malware, ransomware and suspicious activity on devices
* Phishing emails
### Verify
1. In the Azure portal, open the Event Hub namespace → **defender-xdr** → **Overview**, and confirm **Incoming Messages** shows activity. This can take up to 30 minutes.
2. In your SIEM, confirm events are arriving from the categories you selected.
To explore the data yourself, see **Advanced hunting** on the [**Microsoft Dashboards**](/secure-and-measure/microsoft-dashboards.md) page.
## Related
* [Step 2 — Entra ID](/quick-start/step-2-entra-id.md) — Sign-in and directory logs
* [Step 4 — Microsoft 365](/quick-start/step-4-microsoft-365.md) — Email, file and Teams activity
* [Get Expert Help](/get-expert-help/overview.md) — Want to know if your SOC would catch a real attack? RedLegg Penetration Testing can test it
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://msdocs.aohwv.com/quick-start/step-3-defender-xdr.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
