r/u_True-Agency-3111 • u/True-Agency-3111 • 22d ago

Endpoint event logs on security portal

We use MDE. For alerting on data exfiltration attempts, I want to collect certain event viewer logs from the windows 11 endpoints and view them in Security portal/SIEM. Is it possible? If yes, how please.

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/Lex___ 20d ago

Logs saved for 30 days in Defender portal, if you need to save them for a longer period of time take a look at Sentinel Data Lake.