> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/getting-started/onboarding/connectors/microsoft-defender-xdr-advanced-hunting.md).
# Microsoft Defender XDR - Advanced Hunting
The Advanced Threat Hunting connector works by syncronising data from your Entra account to your SIEM in CybaOps.
It is one-way, and only takes information from Entra to CybaOps. It does not push data from CybaOps to Entra.
The syncronisation runs every 24 hours, however you can check the status of this on your schedules screen. If you have made changes in Entra and you want these to be reflected in your CybaOps portal before the next syncronisation in 24 hours you can bump the syncronisation by going to the schedules screen and then on the Entra connector line, clicking the three dots and then “Bump”.
## Guide
You will need to gather:
* **Tenant ID**
* **Client ID**
* **Client Secret**
These are created from an **App Registration** in Entra.
### 1. Sign in to the Entra Admin Portal
1. Go to: [https://entra.microsoft.com](https://entra.microsoft.com/)
2. Sign in with your Microsoft administrator account.
If you manage multiple tenants, ensure you are in the correct directory.
### 2. Create an App Registration (to get a Client ID)
1. In the left menu select: Applications → App registrations
2. Click + New registration
3. Enter the following fields
| **Field** | **What to enter** |
| ----------------------- | --------------------------------------------------------- |
| Name | A recognisable name (e.g. CybaOps Connector) |
| Supported account types | Select **Accounts in this organisational directory only** |
| Redirect URI | Leave blank |
4. Click **Register**
**You will now need to add the required API permission.**
After creating the application, you must grant it permission to read **user and device information**.
1. Inside the **App Registration**, click **API permissions** in the left menu.
2. Click + **Add a permission**.
3. Select **Microsoft Graph**.
4. Choose **Application permissions**.
5. Search for and add the following permissions:
1. ThreatHunting.Read.All
This will allow the connector to read Threat Hunting information.
After adding the permission, click **Grant admin consent**.
{% hint style="info" %}
*Admin consent is required for these permissions. If the button is unavailable, you may need a **Global Administrator** or **Application Administrator** to approve them.*
{% endhint %}
### 3. Create a Client Secret
1. Inside the new **App Registration**, select: **Certificates & secrets**. \
Click + **New client secret**
2. Enter:
1. Description – e.g. CybaOps
2. Expires – Choose recommended duration (e.g. 12 or 24 months)
3. Click **Add**
4. **Copy the secret value immediately**
#### **⚠️ Important:**
{% hint style="warning" %}
**The secret value is only visible once. Store it securely.**
{% endhint %}
This value is your **Client Secret**.
In the overview section for the application, you will see the other details required to set up the Connector.
* Application (Client) ID
* Directory (Tenant) ID
### Information You Will Provide to Us
After completing the steps you should have:
* Tenant ID (Identity → Overview)
* Client ID (App registration → Overview)
* Client Secret (Certificates & Secrets)
#### Required Permissions
To complete this process, your account typically needs one of the following roles in Entra:
* Global administrator
* Application administrator
* Cloud Application Administrator
* User with App Registration permission enabled (Sometimes)
If you cannot create an **App Registration**, contact your **Microsoft 365 / Entra administrator**.
Once you have these three values, enter them into the **Entra Connector setup** in our platform.
#### What data is taken from Entra?
Data syncronised from Entra Threat Hunting
**Threat Hunting Events**
* Security telemetry, authentication activity, suspicious behaviours, and threat indicators used for advanced threat detection and investigation.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybaops.com/getting-started/onboarding/connectors/microsoft-defender-xdr-advanced-hunting.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.