MC1137606: Streaming API support for Data Security tables in Microsoft Defender XDR Advanced Hunting
Microsoft Defender XDR will support Streaming API for DataSecurityEvents and DataSecurityBehaviors tables starting late August 2025, enabling real-time insider risk alert data delivery via event hubs. This push-based feature is off by default, requires setup, and allows integration with external ...