Skip to content
SOC FluentSpeak SIEM and EDR
Join the waitlist

Defender XDR advanced huntingvsMicrosoft Sentinel

Sentinel vs Defender tables

Microsoft Sentinel and Microsoft Defender XDR both use KQL, but they don’t search the same tables. Defender’s advanced hunting has its own tables for devices, email, identities and cloud apps, and keeps 30 days. Sentinel has whatever you connect to it, like sign-in logs, Windows security events and firewall logs, and keeps data for as long as your workspace is set to. If you send Defender data to Sentinel, the Defender tables show up there too.

Side by side

Defender XDRSentinel
Time columnTimestampTimeGenerated
How far back30 daysAs long as the workspace keeps it, 90 days included
Processes startedDeviceProcessEventsSecurityEvent with EventID == 4688, or DeviceProcessEvents if Defender data is connected
Network connectionsDeviceNetworkEventsCommonSecurityLog for firewalls, or DeviceNetworkEvents if connected
Logons to devicesDeviceLogonEventsSecurityEvent with EventID 4624 or 4625
Entra ID sign-insEntraIdSignInEvents, which replaced AADSignInEventsBetaSigninLogs and AADNonInteractiveUserSignInLogs
EmailEmailEvents, EmailAttachmentInfo and EmailUrlInfoThe same tables if Defender for Office 365 is connected, or OfficeActivity
Cloud and admin activityCloudAppEventsAuditLogs, AzureActivity and OfficeActivity
Alerts and incidentsAlertInfo and AlertEvidenceSecurityAlert and SecurityIncident
Device nameDeviceNameComputer in SecurityEvent
Account nameAccountName and AccountDomainAccount, TargetUserName or TargetAccount, depending on the table
What happenedActionType, like LogonFailedEventID, like 4625

Same question, both sets of tables

Which accounts failed to log on to the servers today?
Defender XDR
DeviceLogonEvents
| where Timestamp > ago(1d)
| where DeviceName startswith "srv-"
| where ActionType == "LogonFailed"
| summarize Failures = count() by AccountName, DeviceName
Sentinel
SecurityEvent
| where TimeGenerated > ago(1d)
| where Computer startswith "srv-"
| where EventID == 4625
| summarize Failures = count() by TargetAccount, Computer
Was PowerShell started with an encoded command this week?
Defender XDR
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine contains "-enc"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
Sentinel
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where NewProcessName endswith @"powershell.exe"
| where CommandLine contains "-enc"
| project TimeGenerated, Computer, SubjectUserName, CommandLine

Event 4688 only includes the command line if command-line auditing is turned on.

What catches people out when switching

  • Defender’s own tables use Timestamp. Sentinel tables use TimeGenerated, so that’s the first thing to change when you move a query across.
  • Advanced hunting only goes back 30 days. For older Defender data, look in Sentinel if it’s connected.
  • Not every Sentinel workspace has the same tables. They depend on what’s connected, so check the table list before you write the query.
  • Defender uses ActionType where Windows uses event IDs. LogonFailed in DeviceLogonEvents is close to event 4625.
  • In the Defender portal, with Sentinel connected, advanced hunting can search both sets of tables in one place.
  • Some columns hold JSON, like AdditionalFields and RawEventData. Read them with parse_json().

Practise both on the same exercise

SOC Fluent launches with KQL for both Defender and Sentinel. Exercises use both sets of tables, so you learn where to look as well as what to write.

Join the waitlistSee pricing

Free to join. Students get 50% off at launch.