Microsoft Defender for Endpoint

Serverless Security Stack

This page explains how to make data from the Microsoft Defender for Endpoint integration appear in the following places within Elastic Security:

• Findings page: Data appears on the Vulnerabilities tab.
• Alert and Entity details flyouts: Data appears in the Insights section of the Alert and Entity details flyouts.

In order for Microsoft Defender for Endpoint data to appear in these workflows:

• Follow the steps to set up the Microsoft Defender for Endpoint integration.
• Make sure the integration version is at least 3.0.0.
• Ensure you have read privileges for the following index: security_solution-*.vulnerability_latest.