Microsoft Defender Network Intelligence connector

The Microsoft Defender Network Intelligence connector reads Defender for Endpoint telemetry through Advanced Hunting every 15 seconds. It counts how often your devices reached each domain, and how often Defender blocked it, for Network Intelligence.

This connector only reads. To block lookalike domains on devices, use the Microsoft Defender for Endpoint connector with a rule.

Prerequisites

• Microsoft Defender for Endpoint Plan 2 or Microsoft Defender XDR, with onboarded devices. Advanced Hunting must have the DeviceNetworkEvents and DeviceEvents tables.
• A Global Administrator, Privileged Role Administrator, or Cloud Application Administrator to grant admin consent.
• The Network Intelligence add-on.

Setup

1. In the app, open Connectors > Microsoft Defender Network Intelligence.
2. Select Connect tenant.
3. Sign in to Microsoft as an administrator and grant admin consent.

The connector uses the same Microsoft Entra application as Microsoft 365 Email Intelligence. It reads Advanced Hunting with the ThreatHunting.Read.All application permission. If your tenant already connected Email Intelligence, the application holds this permission and consent completes at once.

What it reads

Each read runs one Advanced Hunting query over these events:

• Connections: DeviceNetworkEvents with the ConnectionSuccess action.
• Blocks: DeviceEvents with the ExploitGuardNetworkProtectionBlocked and SmartScreenUrlWarning actions.

Events without a remote URL are skipped. For each hour and destination, the connector stores:

• Hits: the larger of the connection count and the block count. Defender records a successful connection even when network protection blocks the traffic afterwards, so the two can overlap.
• Blocked hits: the block count.
• Allowed hits: hits less blocked hits.
• Hosts and IP addresses: a sample of the host names and remote addresses reached.

Records have the flow kind and the microsoft_defender provider.

Device names, user names, local addresses, and full URLs stay in Defender.

Defender doesn't log every connection

Defender for Endpoint doesn’t record every connection in Advanced Hunting. In testing, connections made by some processes, such as PowerShell, were missing. A domain a device reached can be missing from Network Intelligence for the same reason.

Schedule

• Every 15 seconds, the connector reads the current and previous hour.
• Every 10 minutes, it reads the last three hours.

Each read replaces the counts for the hours it covers. Network rules evaluate each new record as it lands.

Advanced Hunting quotas are per tenant and shared with other Advanced Hunting callers, including Email Intelligence. The connector uses about four queries a minute.

Status

The connector page shows the tenant, when consent was granted, the permission, and the latest successful and failed runs. When a run fails, it names the cause:

Failure	Meaning
Authorization	Microsoft refused the application’s sign-in. Consent was revoked or never completed. Reconnect.
Permission	The application lacks ThreatHunting.Read.All. Reconnect and grant admin consent.
Provisioning	Advanced Hunting has no device tables. Check the Defender for Endpoint license and device onboarding.
Rate limited	Microsoft throttled Advanced Hunting queries. The next run retries.
Provider unavailable or network	Microsoft Graph was unavailable or unreachable. The next run retries.

Disconnecting

Disable pauses ingestion and keeps the connection. Disconnect stops ingestion and removes the connection. Counts already stored stay until retention removes them after 90 days.

The tenant’s consent belongs to the Email Intelligence application, so disconnecting leaves it in place and Email Intelligence keeps working. To remove the consent, delete the application from Microsoft Entra Enterprise applications.