Microsoft Defender XDR
Hunting and detectionConfigure Microsoft Defender XDR to stream Advanced Hunting events to your Azure event hub
In brief
The article now includes expanded configuration guidance for streaming Advanced Hunting events to Azure Event Hubs, portal steps for raw data streaming, and a JSON event-payload example. It also updates terminology and schema links.
What Defender admins need to know
Administrators have clearer instructions for configuring streaming and understanding event data used for downstream processing and storage.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Configure Microsoft Defender XDR to stream Advanced Hunting events to your Azure event hub
Learn how to configure Microsoft Defender XDR to stream Advanced Hunting events to Azure Event Hubs for downstream processing, integration, and long-term storage.
[!INCLUDE Microsoft Defender XDR rebranding]
This article explains how to configure the Microsoft Defender XDR streaming API to forward Advanced Hunting events to Azure Event Hubs for downstream processing, integration, and long-term storage. Security administrators can use this guide to set up streaming, understand the event schema, and estimate the required Event Hub capacity. Before you begin, review the prerequisites to ensure your Event Hubs environment and permissions are in place.
Applies to:
Prerequisites
Before you configure Microsoft Defender XDR to stream data to Event Hubs, ensure the following prerequisites are fulfilled:
- Create an Event Hubs (for information, see Set up Event Hubs).
Enable raw data streaming
To enable raw data streaming to your Azure event hub, complete the following steps in the Microsoft Defender portal:
Sign in Microsoft Defender portal as a Security Administrator or higher.
Go to the Streaming API settings page.
Event schema in Azure Event Hub
The following JSON sample shows the structure of an event payload delivered to Azure Event Hubs by the streaming API:
{
"records": [
- Each Event Hubs message in Azure Event Hubs contains list of records.
- Each record contains the event name, the time Microsoft Defender XDR received the event, the tenant it belongs (you only get events from your tenant), and the event in JSON format in a property called "**properties**".
- For more information about the schema of Microsoft Defender XDR events, see [Advanced Hunting overview](advanced-hunting-overview.md).
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here, every event is decorated with this column as well.
<a name="data-types-mapping"></a>
## Data type mappings
To get the data types for event properties, do the following steps:properties:
1. Sign in <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft Defender XDR</a> and go to [Advanced Hunting page](https://security.microsoft.com/hunting-package).
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
- [Microsoft Defender XDR streaming API](streaming-api.md)
- [Supported Microsoft Defender XDR event types in event streaming API](supported-event-types.md)
- [Stream Microsoft Defender XDR events to your Azure storage account](streaming-api-storage.md)
- [Azure Event Hubs documentation](/azure/event-hubs/)
- [Troubleshoot connectivity issues - Azure Event Hubs](/azure/event-hubs/troubleshooting-guide)
@@ -8,16 +8,20 @@ ms.localizationpriority: medium ms.collection: - m365-security - tier3-ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1014+ms.custom: admindeeplinkDEFENDER, msecd-doc-authoring-1016 ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 ai-usage: ai-assisted --- # Configure Microsoft Defender XDR to stream Advanced Hunting events to your Azure event hub +Learn how to configure Microsoft Defender XDR to stream Advanced Hunting events to Azure Event Hubs for downstream processing, integration, and long-term storage.+ [!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] +This article explains how to configure the Microsoft Defender XDR streaming API to forward Advanced Hunting events to Azure Event Hubs for downstream processing, integration, and long-term storage. Security administrators can use this guide to set up streaming, understand the event schema, and estimate the required Event Hub capacity. Before you begin, review the prerequisites to ensure your Event Hubs environment and permissions are in place.+ **Applies to:** - [Microsoft Defender XDR](microsoft-365-defender.md) @@ -28,7 +32,7 @@ ai-usage: ai-assisted ## Prerequisites -Before you configure Microsoft Defender XDR to stream data to Event Hubs, ensure the following prerequisites are fulfilled:+Before you configure Microsoft Defender to stream data to Event Hubs, ensure the following prerequisites are fulfilled: 1. Create an Event Hubs (for information, see [Set up Event Hubs](configure-event-hub.md#set-up-event-hubs)). @@ -41,6 +45,8 @@ Before you configure Microsoft Defender XDR to stream data to Event Hubs, ensure ## Enable raw data streaming +To enable raw data streaming to your Azure event hub, complete the following steps in the Microsoft Defender portal:+ 1. Sign in <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft Defender portal</a> as a ***Security Administrator*** or higher. 1. Go to the [Streaming API settings page](https://sip.security.microsoft.com/settings/mtp_settings/raw_data_export).@@ -66,6 +72,8 @@ Before you configure Microsoft Defender XDR to stream data to Event Hubs, ensure <a name="the-schema-of-the-events-in-azure-event-hub"></a> ## Event schema in Azure Event Hub +The following JSON sample shows the structure of an event payload delivered to Azure Event Hubs by the streaming API:+ ```JSON { "records": [@@ -82,16 +90,16 @@ Before you configure Microsoft Defender XDR to stream data to Event Hubs, ensure - Each Event Hubs message in Azure Event Hubs contains list of records. -- Each record contains the event name, the time Microsoft Defender XDR received the event, the tenant it belongs (you only get events from your tenant), and the event in JSON format in a property called "**properties**".+- Each record contains the event name, the time Microsoft Defender received the event, the tenant it belongs (you only get events from your tenant), and the event in JSON format in a property called "**properties**". -- For more information about the schema of Microsoft Defender XDR events, see [Advanced Hunting overview](advanced-hunting-overview.md).+- For more information about the schema of Microsoft Defender events, see [Advanced Hunting overview](advanced-hunting-overview.md). - In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here, every event is decorated with this column as well. <a name="data-types-mapping"></a> ## Data type mappings -To get the data types for event properties, do the following steps:+To get the data types for event properties: 1. Sign in <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft Defender XDR</a> and go to [Advanced Hunting page](https://security.microsoft.com/hunting-package). @@ -137,7 +145,7 @@ To learn how to export log data for analyzing streaming API resources, see [Log - [Overview of Advanced Hunting](advanced-hunting-overview.md) - [Microsoft Defender XDR streaming API](streaming-api.md)-- [Supported Microsoft Defender XDR event types in event streaming API](supported-event-types.md)+- [Supported Microsoft Defender event types in event streaming API](supported-event-types.md) - [Stream Microsoft Defender XDR events to your Azure storage account](streaming-api-storage.md) - [Azure Event Hubs documentation](/azure/event-hubs/) - [Troubleshoot connectivity issues - Azure Event Hubs](/azure/event-hubs/troubleshooting-guide)