Elevate your telemetry using custom data collection in Microsoft Defender

Security teams today are data savvy and are always looking for full visibility into their telemetry. Defender has long provided over 200 types of raw event types, each enriched with numerous properties and accessible through the threat hunting experience in the Defender portal. But each organization has unique data requirements, so many security teams use complex add-on products to collect and analyze additional data, contributing to the already overwhelming number of solutions they’re using. That’s why today we’re announcing the ability to collect and hunt across custom data right within the Defender portal. You can now easily build custom data collection rules based on your organization’s specific needs using natural language; no PhD required!

We are releasing several new data types that can be collected, for example the highly requested AMSI for hunting over script content, and Kerberos for hunting auth-based and network attacks. Image 4: Easily create custom data collection rules in the Defender portal This truly integrated custom data offering is possible thanks to Microsoft’s platform approach, as the additional telemetry can be collected and analyzed via Defender and stored via Microsoft Sentinel. This expansion puts you in complete control of any customized, add-on data, including exactly which data types are collected and how long they are stored. No other security solution has fully integrated and customizable telemetry collection and analysis.