ThreatDefence supports raw SIEM data exports from the Customer Portal. This allows customers to export selected security events when raw evidence is required for investigations, custom reporting, audit requests, compliance reviews, or deeper offline analysis.

The export function is available from the Customer Portal:

https://portal.threatdefence.io/my-tenants/data-export

From this page, authorised users can select the required data index, define the time range, and apply a query filter to export only the events they need. Exported data is provided in structured JSON format.

How the Data Export Works

The data export page allows users to define what they want to export before the job is created.

The main options are:

1. Index: Select the SIEM index that contains the required events. For example, this may be an endpoint, Microsoft 365, firewall, network, identity, or other supported log source.
2. Time frame:Select the timeframe for the export. This should normally be kept as narrow as possible to reduce export size and focus only on the relevant investigation period.
3. Query filter: Add a query filter to export only the specific events required. This can be used to limit the export to a single user, device, source IP, event type, application, tenant, or other relevant field.

Note: Using a query filter is strongly recommended. Exporting an entire index across a broad time range may produce a very large file and include unnecessary data.

Before creating an export, it is usually best to explore the data in the ThreatDefence Analyst Console.The Analyst Console can be used to confirm which index contains the required data, identify the correct field names, test the query logic, check that the result set is accurate, reduce noise before exporting, and confirm the time range needed for the export.

Search query syntax is covered in the Analyst Guide:

https://docs.threatdefence.com/soc-analyst-guide/search-queries

Once the right search has been built in the Analyst Console, the same logic can be used in the data export filter.

Example 1: Exporting Forensic Logs for a Specific Endpoint Agent

A forensic export of endpoint telemetry may be required when investigating activity on a specific device.The export can be scoped by endpoint index, investigation time range, hostname, agent ID, device ID, or other endpoint identifier. Example filter structure:

agent.name:TEST001

Example 2: Exporting SharePoint Activity for a Single Microsoft 365 User

A detailed user activity export may be required when reviewing activity for a specific user.

For example, this may include SharePoint file access, downloads, sharing activity, or suspicious access to sensitive documents. The export should be scoped to the relevant Microsoft 365 index, investigation time range, user principal name or email address, and any available fields such as workload, operation, site URL, file name, or activity type.

This helps produce a focused export that shows what the user accessed or changed, without including unnecessary Microsoft 365 activity from other users or services.

Example filter structure:

user.email:user@example.com AND event.provider:SharePoint