Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Developer and API

Use the Streaming API with Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

6 October 2026Doc update+15 / −15 lines

In brief

The page updates its title, description, terminology, links, and setup instructions for using the Streaming API with Defender for Business and Microsoft 365 Business Premium.

What Defender admins need to know

Administrators get clearer guidance on prerequisites and configuring Azure Event Hubs destinations.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Use the streamingStreaming API with Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

If your organization has a Security Operations Center (SOC), the ability toyou can use the Microsoft Defender for Endpoint streaming API is available forwith Defender for Business and Microsoft 365 Business Premium. The Microsoft Defender for Endpoint streaming API enables you to stream data, such as device file, registry, network, sign-in events, and more to one of the following services:

  • Microsoft Sentinel: A scalable, cloud-native solution that provides security information and event management (SIEM) and security orchestration, automation, and response (SOAR) capabilities.
  • Azure Event Hubs: A modern, big data streaming platform and event ingestion service that can seamlessly integrate with other Azure and Microsoft services. For example, Azure Stream Analytics, Power BI, and Azure Event Grid, along with outside services like Apache Spark.
  • Azure Storage: Microsoft's cloud storage solution for modern data storage scenarios, with highly available, massively scalable, durable, and secure storage for a variety of data objects in the cloud.

WithBy using the Microsoft Defender for Endpoint streaming API, you can use advanced hunting and attack detection with Defender for Business and Microsoft 365 Business Premium. The streaming API enables security operations centers to view more data about devices, understand better how an attack occurred, and take steps to improve device security.

Use the streaming API with Microsoft Sentinel

Microsoft Sentinel is a paid service. Several plans and pricing options are available. See Microsoft Sentinel pricing.

  1. Make sureEnsure that Defender for Business isyou set up and configured,configure Defender for Business, and that devices are already onboarded.you onboard devices. See Set up and configure Microsoft Defender for Business.
  2. Create a Log Analytics workspace to use with Microsoft Sentinel. See Create a Log Analytics workspace.
  3. Onboard to Microsoft Sentinel. See Quickstart: Onboard Microsoft Sentinel.
  4. Enable the Microsoft Defender connector. See Connect data from Microsoft Defender to Microsoft Sentinel.

Use the streaming API with Event Hubs

To use Azure Event Hubs requires, you need an Azure subscription. Before you begin, make sure toensure you create an event hub in your organization. Then, sign in to the Azure portal, go to Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights.

To configure streaming to Azure Event Hubs, complete the following steps.

  1. Select Add data export settings.

  2. Choose a name for your new settings.

  3. Choose Forward events to Azure Event Hubs.

  4. TypeEnter your Event Hubs name and your Event Hubs ID.

    Note

    LeavingIf you leave the Event Hubs name field emptyempty, the system creates an event hub for each category in the selected namespace. If you don're not usingt use a Dedicated Event Hubs Cluster (a, which is a single-tenant deployment with dedicated capacity), keep in mindcapacity, remember that there's a limit of 10 Event Hubs namespaces.

    To get your Event Hubs ID, go to your Azure Event Hubs namespace page in the Azure portal. On the Properties tab, copy the text under ID.

  5. Choose the events you want to stream and then select Save.

View the event schema in Azure Event Hubs

The following JSON sample shows the format of each event hub message that Azure Event Hubs receives when event forwarding is enabled. Each message contains a records array with one or more event entries:

{
}

Each event hub message in Azure Event Hubs contains a list of records. Each record contains the event name, the time Defender for Business received the event, the organization to which it belongs (you get events from your organization only), and the event in JSON format in a property called "properties". For more information about the schema of Advanced Hunting events streamed to Azure Event Hubs, see Proactively hunt for threats with advanced hunting in Microsoft Defender.

Use the streaming API with Azure Storage

Note

Azure Storage requires an Azure subscription. Before you begin, make sure toensure you create a Storage account in your organization. Then, sign in to your Azure organization, and go to Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights.

Enable raw data streaming

  1. Select Add data export settings.
  2. Choose a name for your new settings.
  3. Choose Forward events to Azure Storage.
  4. Type your Storage Account Resource ID. In order toTo get your Storage Account Resource ID, go to your Storage account page in the Azure portal. Then, on the Properties tab, copy the text under Storage account resource ID.
  5. Choose the events you want to stream and then select Save.

View the event schema in Azure Storage