Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Log ingestion is how Defend receives event data from cloud platforms and endpoints. Connectors pull data from external sources (M365, Google Workspace, Azure) on a recurring sync schedule. Endpoint agents push telemetry directly. Everything lands in a normalized event store that detection rules and threat hunting queries run against.
This article covers cloud connectors. For endpoint telemetry ingested through RMM agents, see Integrations.
Supported Connector Types
| Connector | Data pulled |
|---|---|
| Microsoft 365 | Audit logs, sign-in events, mailbox activity, admin actions |
| Google Workspace | Admin audit, login events, Drive activity |
| Azure | Azure AD / Entra ID sign-in and audit logs, activity logs |
Connectors sync on a 15-minute interval by default. You can trigger an immediate sync from the connector detail page.
Adding a Connector
- Go to Defend and open Connectors in the left navigation.
- Click Add Connector.
- Select the connector type (M365, Google Workspace, or Azure).
- Enter a display name for this connection. Use a name that identifies the client org it belongs to.
- Follow the credential prompts. Each connector type requires different API credentials:
- M365: OAuth client ID and secret, or a delegated service account with audit log read permissions
- Google Workspace: service account JSON key with domain-wide delegation
- Azure: app registration client ID, client secret, and tenant ID
- Click Test. The system makes a sample API call and reports whether credentials are valid and consent is in place.
- Click Save. The first sync runs within the next 15-minute window, or immediately if you click Sync Now.
Checking Ingestion Status
- Each connector card shows Last Synced time and a status badge (Active, Failed, Pending).
- If the status is Failed, click the connector to see the last sync error message. Common causes: expired credentials, missing API consent, or a permission scope not granted in the source tenant.
- After a successful sync, normalized events appear in Threat Hunt and raw events are available for query.
How Events Are Normalized
Raw events from each connector are normalized into a common schema stored in the event store. Normalization maps source-specific field names to standard fields and tags applicable MITRE ATT&CK techniques. Detection rules that reference normalized fields work across all connector types.
If a Sigma rule is not firing as expected, verify that the fields it depends on exist in your normalized events — field availability varies by connector and log level.
Endpoint Telemetry
RMM agents push endpoint telemetry (process, network, file events) directly to the Defend ingest endpoint using an agent key. This path does not require a connector to be configured. See Integrations for how RMM connects.
FAQ
How long does it take for events to appear after saving a connector? Events from the first sync are visible in Threat Hunt within 15 minutes. Click Sync Now on the connector to pull data immediately.
Can I have multiple connectors for the same platform? Yes. Add one connector per client tenant. Each connector is scoped to a single source tenant and named so you can tell them apart.
Why does the connector show Active but I see no events? Check that the API account has the required audit log scopes in the source tenant. A successful test call may use a lighter permission than a full audit log pull. The sync error on the connector detail page will show the specific failure if one occurs.