Skip to content

Commit bd65da7

Browse files
v-ccolinv-ccolin
authored
Merge pull request #305060 from snicklezzz/wi448845-xdr-alert-schema-differences
created xdr alert schema differences page
2 parents 5f1f9c0 + 3628339 commit bd65da7

4 files changed

Lines changed: 93 additions & 0 deletions

File tree

‎articles/sentinel/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,6 +1009,8 @@
10091009
href: sentinel-tables-connectors-reference.md
10101010
- name: Security alert schema reference
10111011
href: security-alert-schema.md
1012+
- name: Standalone vs XDR alert schema reference
1013+
href: security-alert-schema-differences.md
10121014
- name: CEF log field mapping
10131015
href: cef-name-mapping.md
10141016
- name: Windows security event sets

‎articles/sentinel/connect-microsoft-365-defender.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ To ingest and synchronize Microsoft Defender XDR incidents with all their alerts
7272

7373
When you enable the Microsoft Defender XDR connector, any Microsoft Defender components’ connectors that were previously connected are automatically disconnected in the background. Although they continue to *appear* connected, no data flows through them.
7474

75+
> [!NOTE]
76+
> Replacing standalone connectors with the XDR connector changes the schema of your alerts and might impact your existing queries. For a detailed comparison, see [Alert schema differences: Standalone vs. XDR connector](security-alert-schema-differences.md).
77+
7578
### Connect entities
7679

7780
Use Microsoft Defender for Identity to sync user entities from your on-premises Active Directory to Microsoft Sentinel.

‎articles/sentinel/move-to-defender.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,9 @@ From a Log Analytics perspective, Microsoft Sentinel’s integration into Micros
107107

108108
Alerts related to Defender products are streamed directly from the [Microsoft Defender XDR connector](/azure/sentinel/connect-microsoft-365-defender) to ensure consistency. Make sure that you have incidents and alerts from this connector turned on in your workspace. Once you have this data connector configured in your workspace, [offboarding the workspace from Microsoft Defender](/unified-secops/microsoft-sentinel-onboard#offboard-microsoft-sentinel) also disconnects the Microsoft Defender XDR connector.
109109

110+
> [!NOTE]
111+
> This change in connectors results in schema differences for some alerts. For a detailed comparison, see [Alert schema differences: Standalone vs. XDR connector](security-alert-schema-differences.md).
112+
110113
For more information, see [Connect data from Microsoft Defender XDR to Microsoft Sentinel](connect-microsoft-365-defender.md).
111114

112115
#### Integrate with Microsoft Defender for Cloud
@@ -302,3 +305,4 @@ The Microsoft Sentinel [similar incidents](investigate-cases.md#similar-incident
302305
- [The Best of Microsoft Sentinel - now in Microsoft Defender](https://techcommunity.microsoft.com/blog/MicrosoftThreatProtectionBlog/the-best-of-microsoft-sentinel-%E2%80%94-now-in-microsoft-defender/4415822) (blog)
303306
- Watch the webinar: [Transition to the Unified SOC Platform: Deep Dive and Interactive Q&A for SOC Professionals](https://www.youtube.com/watch?v=WIM6fbJDkK4).
304307
- See frequently asked questions in the [TechCommunity blog](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/unified-security-operations-platform---technical-faq/4189136) or the [Microsoft Community Hub](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/frequently-asked-questions-about-the-unified-security-operations-platform/4212048).
308+
- Review [alert schema differences between Standalone and XDR connectors](security-alert-schema-differences.md)

‎articles/sentinel/security-alert-schema-differences.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
title: Microsoft Sentinel alert schema differences between standalone and XDR connectors
3+
description: Learn how alert schema, field mappings, and ingestion behavior differ between standalone connectors and the XDR connector in Microsoft Sentinel.
4+
author: guywi-ms
5+
ms.author: guywild
6+
ms.topic: reference
7+
ms.date: 01/27/2026
8+
9+
# customer intent: As a security analyst, I want to understand how alerts differ when ingested through the XDR connector so that I can update my queries, analytic rules, and workbooks accordingly.
10+
---
11+
12+
# Alert schema differences: Standalone vs. XDR connector
13+
14+
This article explains the differences between alerts ingested through standalone connectors and alerts ingested through the Extended Detection and Response (XDR) connector in Microsoft Sentinel.
15+
16+
Standalone connectors ingest alerts directly from the original security products, whereas the XDR connector ingests alerts through the Microsoft Defender XDR pipeline. This includes connectors such as Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Defender for Identity, Information Rights Management (IRM), Data Loss Prevention (DLP), Microsoft Defender for Cloud (MDC), and Microsoft Defender for Cloud Apps (MDA).
17+
18+
These differences can affect field mappings, derived field behavior, schema structure, and alert ingestion, which might impact your existing queries, analytic rules, and workbooks. Review these differences before migrating to the XDR connector.
19+
20+
For the full alert schema, see the [Security alert schema reference](security-alert-schema.md).
21+
22+
## CompromisedEntity behavior
23+
24+
The CompromisedEntity field is handled differently across products when alerts are ingested through the XDR connector.
25+
26+
| Product | CompromisedEntity equivalent value in XDR alerts |
27+
|---------|----------------------------------------|
28+
| Microsoft Defender for Endpoint (MDE) | The device where `"LeadingHost": true` in the alert entities JSON |
29+
| Microsoft Entra ID (Identity Protection) | Always set to the user’s UPN |
30+
| Microsoft Defender for Identity (MDI) | Fixed string `"CompromisedEntity"` |
31+
32+
> [!NOTE]
33+
> In MDE alerts, CompromisedEntity is derived from the device where `"LeadingHost": true`. In some alerts, this field might not be populated.
34+
35+
In MDI alerts, CompromisedEntity doesn't represent a host or user and is always the literal string `"CompromisedEntity"`.
36+
37+
## Field mapping changes
38+
39+
Some fields are renamed or use different value sets in alerts from the XDR connector.
40+
41+
| Product | Legacy field/property | XDR behavior |
42+
|---------|-----------------------|--------------|
43+
| MDE | ExtendedProperties.MicrosoftDefenderAtp.Category | Mapped to `ExtendedProperties.Category` |
44+
| Microsoft Defender for Office (MDO) | ExtendedProperties.Status | Uses a different value set from legacy |
45+
| Microsoft Defender for Office (MDO) | ExtendedProperties.InvestigationName | Not available |
46+
47+
## Structural schema transformations (MDI)
48+
49+
The standalone Microsoft Defender for Identity (MDI) connector sometimes used placeholder entities to store additional information. In the XDR connector, this information is folded into properties under the `resourceAccessEvents` collection.
50+
51+
| Legacy entity/property | XDR representation |
52+
|------------------------|-------------------|
53+
| ResourceAccessInfo.Time | `resourceAccessEvents[].AccessDateTime` |
54+
| ResourceAccessInfo.IpAddress | `resourceAccessEvents[].IpAddress` |
55+
| ResourceAccessInfo.ResourceIdentifier.AccountId | `resourceAccessEvents[].AccountId` |
56+
| ResourceAccessInfo.ResourceIdentifier.ResourceName | `resourceAccessEvents[].ResourceIdentifier` |
57+
| DomainResourceIdentifier | `resourceAccessEvents[].ResourceIdentifier` |
58+
59+
ResourceAccessInfo.ComputerId is no longer required because it's 'identical to the Host entity that ResourceAccessInfo is defined in.
60+
61+
## Alert ingestion filtering
62+
63+
Some alerts available through standalone connectors aren't ingested through the XDR connector.
64+
65+
| Product | Filtering behavior |
66+
|---------|--------------------|
67+
| Microsoft Defender for Cloud (MDC) | Informational severity alerts aren't ingested |
68+
| Microsoft Entra ID | By default, alerts below High severity aren't ingested; customers can configure ingestion to include all severities |
69+
70+
## Scoping behavior (Microsoft Defender for Cloud)
71+
72+
Microsoft Defender for Cloud alerts use different scoping when ingested through the XDR connector.
73+
74+
| Standalone connector scope | XDR connector scope |
75+
|------------------------|---------------------|
76+
| Subscription level | Tenant level |
77+
78+
> [!NOTE]
79+
> All MDC alerts are available in the primary workspace for the tenant. Alerts are scoped according to MDC subscription scopes within Defender XDR.
80+
81+
## Next steps
82+
83+
- [Create and manage analytic rules](create-analytics-rules.md)
84+
- [Use workbooks in Microsoft Sentinel](monitor-your-data.md)

0 commit comments

Comments
 (0)