Microsoft Defender
Bring Microsoft Defender security incidents into DataOS
This guide brings your Microsoft Defender security incidents (groups of related alerts that need investigation) into DataOS.
microsoft.com
?
What you need
Three values from a Microsoft Entra app (tenant ID, client ID and client secret)
Who can get it
Your Microsoft 365 or Azure administrator
Where data lands
A governed table in your DataOS lakehouse
Connection type
REST API
How the connection works
?
Source
Microsoft Defender
DataOS connector
Keeps it up to date
DataOS lakehouse
Governed data product
The connector signs in with your Microsoft app details, reads the incidents from Defender, and refreshes the table in DataOS. It only reads incidents.
What's next
Ready to bring this data into DataOS?
