Connecting Microsoft 365 Defender to Sentinel

To establish the connection between Microsoft 365 Defender and Sentinel, you need to complete some actions in Sentinel, which you can do in the Azure portal. You should be a Global or Security Administrator to complete these processes.

There are three types of integrations you can configure:

• Incidents and alerts
• Advanced hunting events
• User and Entity Behavior Analytics (UEBA), based on MDI

Of these, incidents and alerts do not have an additional cost. These are the SecurityIncident and SecurityAlert data types, respectively. Advanced hunting and UEBA have a cost based on the amount of data and analysis, the details of which you should review independently, including using the pricing information provided in the Further reading section in this chapter.

We’ll begin the discussion on how to connect Microsoft 365 Defender to Sentinel with incidents and alerts.

Using incidents and alerts

In this section...