Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Defender XDRHard
A Microsoft 365 administrator is tasked with integrating Microsoft Defender for Endpoint with a third-party Security Information and Event Management (SIEM) system. The security operations center (SOC) team requires real-time streaming of all security alerts, incidents, and raw event data from Defender for Endpoint into their SIEM for centralized monitoring and analysis. Which integration method should the administrator implement?
- AMicrosoft 365 Defender API
- BExport alerts to Azure Storage account
- CStreaming API to Azure Event Hubs
- DMicrosoft Graph Security API
Show answer & explanationAnswer & explanation
Correct answer: C. Streaming API to Azure Event Hubs
The Streaming API to Azure Event Hubs is the recommended method for real-time streaming of security alerts, incidents, and raw event data from Microsoft Defender for Endpoint (and other Defender XDR components) to external systems like SIEMs.
Why the other options are wrong
- A. The Microsoft 365 Defender API (which includes the Defender for Endpoint API) offers programmatic access, but the Streaming API to Event Hubs is specifically designed for the high-volume, real-time data ingestion required by SIEMs.
- B. Exporting alerts to an Azure Storage account is typically for batch processing or long-term archival, not real-time streaming to a SIEM.
- D. The Microsoft Graph Security API allows for programmatic access to security data but is more for pulling data on demand or building custom applications, not for a continuous real-time stream of all events for a SIEM.
Defender XDR Streaming API
The Microsoft Defender XDR Streaming API allows organizations to stream security alerts, incidents, and raw event data in near real-time to Azure Event Hubs, enabling integration with SIEMs, SOAR platforms, and custom analytics solutions.
- Provides real-time data streaming.
- Leverages Azure Event Hubs for scalability.
- Includes alerts, incidents, and raw events.
- Ideal for SIEM/SOAR integration.
Memory trick: Exporting data needs to be real-time, programmatic, or for archival.