Skip to main content
Solved

Defender for Endpoint Containers

  • February 3, 2026
  • 2 replies
  • 31 views

marcus_aurelius
Forum|alt.badge.img+1

Hello,

Setting up a feed integration for Defender for Endpoint following the google docs page found here. When we get to the Azure URI (https://somethingstorage.blob.core.windows.net) can we setup a wildcard here or do we need to create a feed for each container in the blob? We have multiple containers and my fingers are quite lazy.

Thank you!

Mark

Best answer by Eoved

You need to create a feed for each event type with the correct log label to ensure proper parsing.

 

2 replies

Eoved
Forum|alt.badge.img+8
  • Bronze 2
  • Answer
  • February 4, 2026

You need to create a feed for each event type with the correct log label to ensure proper parsing.

 


marcus_aurelius
Forum|alt.badge.img+1

thanks, was fairly sure that was the deal but just checking.