Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Defender XDRHard
A Microsoft 365 administrator needs to integrate security alerts and raw event data from Microsoft Defender XDR with an external Security Information and Event Management (SIEM) system for centralized logging and long-term retention. The integration must provide a continuous, real-time stream of all available security data. Which Defender XDR feature should the administrator configure for this purpose?
- AStreaming API for raw data
- BAPI for custom detections
- CMicrosoft Graph Security API
- DAlerts API
Show answer & explanationAnswer & explanation
Correct answer: A. Streaming API for raw data
The Streaming API in Microsoft Defender XDR (formerly Defender for Endpoint) is specifically designed to stream raw event data and alerts to external systems like SIEMs or Azure Storage. It provides a continuous, real-time feed of all available security data, which is essential for centralized logging and long-term retention requirements.
Why the other options are wrong
- B. The API for custom detections allows programmatic management of custom detection rules, not streaming raw event data.
- C. The Microsoft Graph Security API provides a unified interface to connect with security solutions, but the Streaming API is specifically for continuous, raw event data export from Defender XDR.
- D. The Alerts API allows fetching and managing alerts, but not the raw event data required for comprehensive centralized logging and long-term retention.
Defender XDR Streaming API
The Microsoft Defender XDR Streaming API enables continuous, real-time export of raw event data and alerts to Azure Storage, Azure Event Hubs, or a SIEM, facilitating centralized logging, long-term retention, and custom analytics.
- Exports raw event data and security alerts.
- Provides a continuous, real-time stream.
- Integrates with SIEMs, Azure Storage, Event Hubs.
- Essential for centralized logging and long-term retention.
Memory trick: Streaming API is like a live broadcast, continuously sending all security data to your external systems.