Skip to content

Commit 92b5a1d

Browse files
committed
Update streaming-api-storage.md
1 parent cf87780 commit 92b5a1d

File tree

1 file changed

+8
-9
lines changed

1 file changed

+8
-9
lines changed

defender-xdr/streaming-api-storage.md

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ ms.topic: conceptual
1616
ms.date: 06/21/2024
1717
---
1818

19-
# Configure Microsoft Defender XDR to stream Advanced Hunting events to your Storage account
19+
# Stream Microsoft Defender XDR events to your storage account
2020

2121
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
2222

@@ -30,13 +30,12 @@ ms.date: 06/21/2024
3030

3131
## Before you begin
3232

33-
1. Create a [Storage account](/azure/storage/common/storage-account-overview) in your tenant.
34-
35-
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions** > **Your subscription** > **Resource Providers** > **Register to Microsoft.Insights**.
33+
- Create a [Storage account](/azure/storage/common/storage-account-overview) in your tenant.
34+
- Sign in to your [Azure tenant](https://ms.portal.azure.com/), and go to **Subscriptions** > **Your subscription** > **Resource Providers** > **Register to Microsoft.Insights**.
3635

3736
### Add contributor permissions
3837

39-
Once the storage account is created, you'll need to define the user who is signing in as a contributor.
38+
Once the storage account is created, you need to define the user who is signing in as a contributor.
4039

4140
1. Go to **Storage Account** > **Access control (IAM)**, and then select **Add**.
4241

@@ -81,14 +80,14 @@ Once the storage account is created, you'll need to define the user who is signi
8180

8281
- The schema of each row in a blob is the following JSON:
8382

84-
```JSON
85-
{
83+
```JSON
84+
{
8685
"time": "<The time Microsoft Defender XDR received the event>"
8786
"tenantId": "<Your tenant ID>"
8887
"category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
8988
"properties": { <Microsoft Defender XDR Advanced Hunting event as Json> }
90-
}
91-
```
89+
}
90+
```
9291

9392
- Each blob contains multiple rows.
9493

0 commit comments

Comments
 (0)