https://community.splunk.com/t5/Getting-Data-In/Why-is-my-azure-not-sending-all-Windows-Defender-for-Enpoint/m-p/557178#M92203 <P>Hi,<BR /><BR />I try to figure this out for a week now and I am stucked. I installed the Microsoft 365 Defender Add-on for Splunk, which is the official supported TA referring to the Microsoft Partner docs.<BR /><BR />I enabled the input for endpoint alerts and excepted the TA to index all alerts since the "start time" (2 weeks ago).<BR /><BR />But only one event was send, the earliest event in the 14 days period. So in my case an event from 6/9/2021, the input was enabled on 23rd of June.<BR /><BR />Splin internal is only telling me that the connection was successfull ( status 200) and how long it took.<BR /><BR />I double checked all the siem intergration docs from microsoft , like what permissions need to be set and so on.<BR /><BR />Here is the link <A href="https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-worldwide" target="_blank" rel="noopener">https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-worldwide</A><BR /><BR />Does anyone know, if there are more options in azure that need to be turned on to make it more talkativ?<BR /><BR />In Defender itself I can see way more alerts than 1 in the last 14 days.<BR /><BR />Thank you</P> Fri, 25 Jun 2021 11:46:54 GMT dkeck 2021-06-25T11:46:54Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-azure-not-sending-all-Windows-Defender-for-Enpoint/m-p/557178#M92203 <P>Hi,<BR /><BR />I try to figure this out for a week now and I am stucked. I installed the Microsoft 365 Defender Add-on for Splunk, which is the official supported TA referring to the Microsoft Partner docs.<BR /><BR />I enabled the input for endpoint alerts and excepted the TA to index all alerts since the "start time" (2 weeks ago).<BR /><BR />But only one event was send, the earliest event in the 14 days period. So in my case an event from 6/9/2021, the input was enabled on 23rd of June.<BR /><BR />Splin internal is only telling me that the connection was successfull ( status 200) and how long it took.<BR /><BR />I double checked all the siem intergration docs from microsoft , like what permissions need to be set and so on.<BR /><BR />Here is the link <A href="https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-worldwide" target="_blank" rel="noopener">https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-worldwide</A><BR /><BR />Does anyone know, if there are more options in azure that need to be turned on to make it more talkativ?<BR /><BR />In Defender itself I can see way more alerts than 1 in the last 14 days.<BR /><BR />Thank you</P> Fri, 25 Jun 2021 11:46:54 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-azure-not-sending-all-Windows-Defender-for-Enpoint/m-p/557178#M92203 dkeck 2021-06-25T11:46:54Z