M365 Defender Alerts Signal (UAL)

Identifies alerts generated by Microsoft Defender products including Windows Defender for Endpoint (WDATP), Microsoft Cloud App Security (MCAS), Microsoft Defender for Identity, Microsoft 365 Defender custom detections, and Defender Experts for XDR via M365 Unified Audit Logs (UAL). These cross-platform alerts indicate detected threats across endpoints, cloud applications, and identity systems. This building block rule generates security events for correlation, threat hunting, and telemetry collection to support comprehensive threat detection.