Collect Microsoft Defender for Office 365 logs

This document describes how you can collect Microsoft Defender for Office 365 logs by setting up a Google Security Operations feed using Microsoft Azure Blob Storage V2.

Microsoft Defender for Office 365 is an email security solution that protects organizations against advanced threats such as phishing, business email compromise, and malware attacks. Email event data from Defender for Office 365 is available through the Microsoft Defender XDR Streaming API, which streams Advanced Hunting events to an Azure Storage account. Google SecOps reads the streamed events directly from the storage account, so no intermediate collector is required.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Privileged access to Microsoft Azure portal with permissions to:
  • Create Storage Accounts in the same tenant as Microsoft Defender XDR
  • Register resource providers on the subscription
  • Manage access keys
  • The Contributor role on the storage account (required by the Streaming API configuration)
• Access to the Microsoft Defender portal with at least the Security Administrator role

• Microsoft Defender for Office 365 deployed in your tenant: the Email* and UrlClickEvents Advanced Hunting tables are populated by records from Defender for Office 365 and stay empty without it

Configure an Azure Storage Account

Register the Microsoft.Insights resource provider

The Streaming API requires the Microsoft.Insights resource provider on the subscription that holds the storage account:

1. Sign in to the Azure portal.
2. Go to Subscriptions > Your subscription > Resource providers.
3. Search for Microsoft.Insights.
4. Click Register.

Create a Storage Account

1. In the Azure portal, search for Storage accounts.
2. Click + Create.

3. Provide the following configuration details:

   Setting	Value
   Subscription	Select your Azure subscription (same tenant as Microsoft Defender XDR)
   Resource group	Select existing or create new
   Storage account name	Enter a unique name (for example, defenderemaillogs)
   Region	Select the region (for example, East US)
   Performance	Standard (recommended)
   Redundancy	GRS (Geo-redundant storage) or LRS (Locally redundant storage)

4. Click Review + create.

5. Review the overview of the account and click Create.

6. Wait for the deployment to complete.

Allow trusted Microsoft services

1. Go to the Storage Account you just created.
2. Select Networking under Security + networking.
3. On the Firewalls and virtual networks tab, under Exceptions, ensure Allow Azure services on the trusted services list to access this storage account is selected.
4. Click Save.

Get the Storage Account credentials

1. In the same Storage Account, select Access keys under Security + networking.
2. Click Show keys.
3. Copy and save the following for later use:
   • Storage account name: The name entered during creation (for example, defenderemaillogs)
   • Key 1 or Key 2: The shared access key

Get the Storage Account Resource ID

1. In the same Storage Account, on the Overview page, click JSON View.

2. Copy and save the Resource ID. It has the following format:

   /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Storage/storageAccounts/<STORAGE_ACCOUNT_NAME>
   

Configure the Microsoft Defender XDR Streaming API

1. Sign in to the Microsoft Defender portal using an account with at least Security Administrator permissions.
2. Go to Settings > Microsoft Defender XDR > Streaming API.
3. Click Add.
4. In the Add new Streaming API settings flyout, provide the following configuration details:
   • Name: Enter a name for the settings (for example, secops-email-events).
   • Select Forward events to Azure Storage.
   • Storage Account Resource ID: Paste the Resource ID saved earlier.
5. Select the following Event types:
   • EmailEvents
   • EmailAttachmentInfo
   • EmailUrlInfo
   • EmailPostDeliveryEvents
   • UrlClickEvents
6. Click Submit.

After streaming starts, a blob container is created in the storage account for each selected event type (documented by Microsoft). The container names follow the insights-logs-advancedhunting-<event type> pattern (for example, insights-logs-advancedhunting-emailevents). Microsoft's documentation shows the pattern for other tables, so always take the exact names from your storage account. Each blob row carries the event as JSON with time, tenantId, category (the table name with the AdvancedHunting- prefix), and the event fields inside a properties object.

Configure feeds in Google SecOps to ingest Microsoft Defender for Office 365 logs

Create one feed per event type container:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed (for example, Defender for Office 365 - EmailEvents).
5. Select Microsoft Azure Blob Storage V2 as the Source type.
6. Select Microsoft Defender for Office 365 as the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • Azure URI: Enter the Blob Service endpoint URL with the container path:

   https://<STORAGE_ACCOUNT_NAME>.blob.core.windows.net/insights-logs-advancedhunting-emailevents/
   

   Replace the following:

   • <STORAGE_ACCOUNT_NAME>: Your Azure storage account name.

   • The container segment: the exact container name copied from the storage account.

   • Source deletion option: Select the deletion option according to your preference:

     • Never delete files: Never delete files from the source.
     • Delete transferred files and empty directories: Delete files and empty directories from the source after a successful fetch completes.

   • Maximum File Age: Include files modified in the last number of days (default is 180 days)

   • From the authentication drop-down (defaults to Access/Shared key), select the method you want to use and provide the corresponding credential:

     • Access/Shared key: In the Key field, paste a storage account access key (Key 1 or Key 2) captured earlier.
     • SAS token: In the Token field, paste a shared access signature (SAS) token issued for the container.
     • Azure V2 Workload Identity Federation: Enter the Microsoft Entra application Client ID and Tenant ID. Copy the read-only Subject ID that the feed displays and grant the matching identity access to the storage account on the Azure side.

   • Asset namespace: The asset namespace

   • Ingestion labels: The label to be applied to the events from this feed

9. Click Next.

10. Review your new feed configuration in the Finalize screen, and then click Submit.

11. Repeat the steps for each remaining container (insights-logs-advancedhunting-emailattachmentinfo, insights-logs-advancedhunting-emailurlinfo, insights-logs-advancedhunting-emailpostdeliveryevents, insights-logs-advancedhunting-urlclickevents), using the same Log type and a distinct Feed name.

Configure Azure Storage firewall (if enabled)

If your Azure Storage Account uses a firewall, you must add Google SecOps IP ranges.

1. In the Azure portal, go to your Storage Account.
2. Select Networking under Security + networking.
3. Under Firewalls and virtual networks, select Enabled from selected virtual networks and IP addresses.
4. In the Firewall section, under Address range, click + Add IP range.
5. Add each Google SecOps IP range in CIDR notation.

To get the current IP ranges:

• See IP Allowlisting documentation
• Or retrieve them programmatically using the Feed Management API

1. Click Save.

UDM mapping table

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.