You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-xdr/microsoft-sentinel-onboard.md
+31-18Lines changed: 31 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Connect Microsoft Sentinel to Microsoft Defender XDR
3
-
description: Learn how to connect your Microsoft Sentinel environment to Microsoft Defender XDR to unify your security operations.
2
+
title: Connect Microsoft Sentinel to the Microsoft Defender portal
3
+
description: Learn how to connect your Microsoft Sentinel environment to the Defender portal to unify your security operations.
4
4
ms.service: defender-xdr
5
5
f1.keywords:
6
6
- NOCSH
@@ -22,22 +22,23 @@ search.appverid:
22
22
appliesto:
23
23
- Microsoft Defender XDR
24
24
- Microsoft Sentinel in the Microsoft Defender portal
25
-
ms.date: 07/10/2024
25
+
ms.date: 10/16/2024
26
26
---
27
27
28
-
# Connect Microsoft Sentinel to Microsoft Defender XDR
28
+
# Connect Microsoft Sentinel to the Microsoft Defender portal
29
29
30
-
Microsoft Sentinel is generally available within the Microsoft unified security operations platform in the Microsoft Defender portal. When you onboard Microsoft Sentinel to the Defender portal, you unify capabilities with Microsoft Defender XDR like incident management and advanced hunting. Reduce tool switching and build a more context-focused investigation that expedites incident response and stops breaches faster. For more information, see:
30
+
Microsoft Sentinel is generally available within Microsoft's unified security operations (SecOps) platform in the Microsoft Defender portal. When you onboard Microsoft Sentinel to the Defender portalwith Microsoft Defender XDR, you unify capabilities like incident management and advanced hunting. Reduce tool switching and build a more context-focused investigation that expedites incident response and stops breaches faster. For more information, see:
31
31
32
-
- Blog post: [General availability of the Microsoft unified security operations platform](https://aka.ms/unified-soc-announcement)
32
+
- Blog post: [General availability of the Microsoft's unified security operations platform](https://aka.ms/unified-soc-announcement)
33
33
- Blog post: [Frequently asked questions about the unified security operations platform](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/frequently-asked-questions-about-the-unified-security-operations/ba-p/4212048)
34
34
-[Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690)
35
35
-[Microsoft Defender XDR integration with Microsoft Sentinel](/azure/sentinel/microsoft-365-defender-sentinel-integration)
36
36
37
+
For preview, Microsoft Sentinel is available in the Defender portal without Microsoft Defender XDR or an E5 license.
37
38
38
39
## Prerequisites
39
40
40
-
Before you begin, review the feature documentation to understand the product changes and limitations:
41
+
Before you begin, review the feature documentation to understand the product changes and limitations.
41
42
42
43
-[Microsoft Sentinel in the Microsoft Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal)
43
44
-[Advanced hunting in the Microsoft Defender portal](advanced-hunting-microsoft-defender.md)
@@ -46,16 +47,17 @@ Before you begin, review the feature documentation to understand the product cha
46
47
47
48
The Microsoft Defender portal supports a single Microsoft Entra tenant and the connection to one workspace at a time. In the context of this article, a workspace is a Log Analytics workspace with Microsoft Sentinel enabled.
48
49
49
-
To onboard and use Microsoft Sentinel in the Microsoft Defender portal, you must have the following resources and access:
50
+
### Microsoft Sentinel prerequisites
51
+
52
+
To onboard and use Microsoft Sentinel in the Defender portal, you must have the following resources and access:
50
53
51
54
- A Log Analytics workspace that has Microsoft Sentinel enabled
52
-
- The data connector for Microsoft Defender XDR (formerly named Microsoft 365 Defender) enabled in Microsoft Sentinel for incidents and alerts. For more information, see [Connect data from Microsoft Defender XDR to Microsoft Sentinel](/azure/sentinel/connect-microsoft-365-defender).
53
-
- Access to Microsoft Defender XDR in the Defender portal
54
-
- Microsoft Defender XDR onboarded to the Microsoft Entra tenant
55
+
- The data connector for Microsoft Defender XDR enabled in Microsoft Sentinel for incidents and alerts. Install the Defender XDR solution and configure the data connector to connect Microsoft Sentinel to the Defender portal. For more information, see [Discover and manage Microsoft Sentinel out-of-the-box content](/azure/sentinel/sentinel-solutions-deploy). <!--Question to Simaya about configuring the other options on this connector - would we still need that for unified SOC. Would they go back and configure those settings? https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender-->
55
56
- An Azure account with the appropriate roles to onboard, use, and create support requests for Microsoft Sentinel in the Defender portal. The following table highlights some of the key roles needed.
56
57
57
-
|Task |Azure built-in role required |Scope |
58
+
|Task |Microsoft Entra or Azure built-in role required |Scope |
58
59
|---------|---------|---------|
60
+
|Onboard Microsoft Sentinel to the Defender portal|[Global administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator) or [security administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator) in Microsoft Entra ID|Tenant|
59
61
|Connect or disconnect a workspace with Microsoft Sentinel enabled|[Owner](/azure/role-based-access-control/built-in-roles#owner) or </br>[User Access Administrator](/azure/role-based-access-control/built-in-roles#user-access-administrator) and [Microsoft Sentinel Contributor](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-contributor)|- Subscription for Owner or User Access Administrator roles </br></br>- Subscription, resource group, or workspace resource for Microsoft Sentinel Contributor |
60
62
|View Microsoft Sentinel in the Defender portal|[Microsoft Sentinel Reader](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-reader)|Subscription, resource group, or workspace resource |
61
63
|Query Sentinel data tables or view incidents |[Microsoft Sentinel Reader](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-reader) or a role with the following actions:</br>- Microsoft.OperationalInsights/workspaces/read</br>- Microsoft.OperationalInsights/workspaces/query/read</br>- Microsoft.SecurityInsights/Incidents/read</br>- Microsoft.SecurityInsights/incidents/comments/read</br>- Microsoft.SecurityInsights/incidents/relations/read</br>- Microsoft.SecurityInsights/incidents/tasks/read|Subscription, resource group, or workspace resource |
@@ -64,28 +66,39 @@ To onboard and use Microsoft Sentinel in the Microsoft Defender portal, you must
64
66
65
67
After you connect Microsoft Sentinel to the Defender portal, your existing Azure role-based access control (RBAC) permissions allow you to work with the Microsoft Sentinel features that you have access to. Continue to manage roles and permissions for your Microsoft Sentinel users from the Azure portal. Any Azure RBAC changes are reflected in the Defender portal. For more information about Microsoft Sentinel permissions, see [Roles and permissions in Microsoft Sentinel | Microsoft Learn](/azure/sentinel/roles) and [Manage access to Microsoft Sentinel data by resource | Microsoft Learn](/azure/sentinel/resource-context-rbac).
To unify capabilities with Defender XDR in Microsoft's unified SecOps platform, you must have the following resources and access:
72
+
73
+
- Licensing for Defender XDR, as described in [Microsoft Defender XDR prerequisites](/microsoft-365/security/mtp/prerequisites)
74
+
- Account for Defender XDR is a member of the same Microsoft Entra tenant with which Microsoft Sentinel is associated
75
+
- Access to Microsoft Defender XDR in the Defender portal, as described in [Microsoft Defender XDR prerequisites](/microsoft-365/security/mtp/prerequisites#required-permissions)
76
+
67
77
## Onboard Microsoft Sentinel
68
78
69
-
To connect a workspace that has Microsoft Sentinel enabled to Defender XDR, complete the following steps:
79
+
To connect a Microsoft Sentinel workspace to the Defender portal, complete the following steps. If you're onboarding Microsoft Sentinel without Defender XDR (preview) there is an extra step to trigger the connection with Microsoft Sentinel and Defender portal.
70
80
71
81
1. Go to the [Microsoft Defender portal](https://security.microsoft.com/) and sign in.
72
-
1. In Microsoft Defender XDR, select **Overview**.
82
+
1. To onboard Microsoft Sentinel without Defender XDR in the Defender portal:
83
+
1. To trigger the connection with Microsoft Sentinel, select **Investigation & response** > **Incidents**.
84
+
1. Wait a few minutes for the connection to complete.
85
+
1. In the Defender portal, select **Overview**.
73
86
1. Select **Connect a workspace**.
74
87
1. Choose the workspace you want to connect and select **Next**.
75
88
1. Read and understand the product changes associated with connecting your workspace. These changes include:
76
89
77
-
- Log tables, queries, and functions in the Microsoft Sentinel workspace are also available in advanced hunting within Defender XDR.
90
+
- Log tables, queries, and functions in the Microsoft Sentinel workspace are also available in advanced hunting within the Defender portal.
78
91
- The Microsoft Sentinel Contributor role is assigned to the Microsoft Threat Protection and WindowsDefenderATP apps within the subscription.
79
92
- Active [Microsoft security incident creation rules](/azure/sentinel/threat-detection#microsoft-security-rules) are deactivated to avoid duplicate incidents. This change only applies to incident creation rules for Microsoft alerts and not to other analytics rules.
80
93
- All alerts related to Defender XDR products are streamed directly from the main Defender XDR data connector to ensure consistency. Make sure you have incidents and alerts from this connector turned on in the workspace.
81
94
82
95
1. Select **Connect**.
83
96
84
-
After your workspace is connected, the banner on the **Overview** page shows that your unified security information and event management (SIEM) and extended detection and response (XDR) is ready. The **Overview** page is updated with new sections that include metrics from Microsoft Sentinel like the number of data connectors and automation rules.
97
+
After your workspace is connected, the banner on the **Overview** page shows that your environment is ready. The **Overview** page is updated with new sections that include metrics from Microsoft Sentinel like the number of data connectors and automation rules.
85
98
86
99
## Explore Microsoft Sentinel features in the Defender portal
87
100
88
-
After you connect your workspace to the Defender portal, **Microsoft Sentinel** is on the left-hand side navigation pane. Pages like **Overview**, **Incidents**, and **Advanced Hunting** have unified data from Microsoft Sentinel and Defender XDR. For more information about the unified capabilities and differences between portals, see [Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690).
101
+
After you connect your workspace to the Defender portal, **Microsoft Sentinel** is on the left-hand side navigation pane. If you have Defender XDR enabled, pages like **Overview**, **Incidents**, and **Advanced Hunting** have unified data from Microsoft Sentinel and Defender XDR. If you don't have Defender XDR enabled, these pages just include data from Microsoft Sentinel (preview). For more information about the unified capabilities and differences between portals, see [Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690).
89
102
90
103
Many of the existing Microsoft Sentinel features are integrated into the Defender portal. For these features, notice that the experience between Microsoft Sentinel in the Azure portal and Defender portal are similar. Use the following articles to help you start working with Microsoft Sentinel in the Defender portal. When using these articles, keep in mind that your starting point in this context is the [Defender portal](https://security.microsoft.com/) instead of the Azure portal.
91
104
@@ -135,5 +148,5 @@ If you want to connect to a different workspace, from the **Workspaces** page, s
135
148
-[Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690)
136
149
-[Advanced hunting in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2264410)
137
150
-[Automatic attack disruption in Microsoft Defender XDR](automatic-attack-disruption.md)
138
-
-[Investigate incidents in Microsoft Defender XDR](investigate-incidents.md)
151
+
-[Investigate incidents in Microsoft Defender portal](investigate-incidents.md)
139
152
-[Optimize your security operations](/azure/sentinel/soc-optimization/soc-optimization-access?tabs=defender-portal)
Microsoft Sentinel is now generally available within the Microsoft unified security operations platform in the Microsoft Defender portal. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690).
13
+
Microsoft Sentinel is generally available within Microsoft's unified security operations platform in the Microsoft Defender portal. For preview, Microsoft Sentinel is available in the Defender portal without Microsoft Defender XDR or an E5 license. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690).
> Microsoft Sentinel is now generally available within the Microsoft unified security operations platform in the Microsoft Defender portal. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690).
14
+
> Microsoft Sentinel is generally available within Microsoft's unified security operations platform in the Microsoft Defender portal. For preview, Microsoft Sentinel is available in the Defender portal without Microsoft Defender XDR or an E5 license. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2263690).
0 commit comments