You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Create a [Storage account](/azure/storage/common/storage-account-overview) in your tenant.
34
-
35
-
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions** > **Your subscription** > **Resource Providers** > **Register to Microsoft.Insights**.
33
+
- Create a [Storage account](/azure/storage/common/storage-account-overview) in your tenant.
34
+
- Sign in to your [Azure tenant](https://ms.portal.azure.com/), and go to **Subscriptions** > **Your subscription** > **Resource Providers** > **Register to Microsoft.Insights**.
36
35
37
36
### Add contributor permissions
38
37
39
-
Once the storage account is created, you'll need to define the user who is signing in as a contributor.
38
+
Once the storage account is created, you need to define the user who is signing in as a contributor.
40
39
41
40
1. Go to **Storage Account** > **Access control (IAM)**, and then select **Add**.
42
41
@@ -81,14 +80,14 @@ Once the storage account is created, you'll need to define the user who is signi
81
80
82
81
- The schema of each row in a blob is the following JSON:
83
82
84
-
```JSON
85
-
{
83
+
```JSON
84
+
{
86
85
"time": "<The time Microsoft Defender XDR received the event>"
87
86
"tenantId": "<Your tenant ID>"
88
87
"category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
0 commit comments