Microsoft Defender for Cloud Apps Event Collector

Details

ID	`Microsoft Defender for Cloud Apps Event Collector`
Provider	Microsoft
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/auth-utils:1.0.0.11671917`
Supported Modules	Agentix XSIAM

README

Microsoft Defender for Cloud Apps Event Collector integration.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Microsoft Defender for Cloud Apps Event Collector in Cortex

Parameter	Description	Required
Endpoint Type	The endpoint for accessing Microsoft Defender for Cloud Applications (MCAS), see table below.	Worldwide
Endpoint URI	The United States: api-us.security.microsoft.com Europe: api-eu.security.microsoft.com The United Kingdom: api-uk.security.microsoft.com	True
Client (Application) ID	The Client (Application) ID to use to connect.	True
Client Secret		True
Tenant ID		True
Scope		True
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)		False
Number of alerts for each fetch.	Due to API limitations, the maximum is 10,000.	False
Fetch events		False
Verify SSL Certificate		False
Use system proxy settings		False
Event types to fetch		True

Endpoint Type options

Endpoint Type	Description
Worldwide	The publicly accessible Microsoft Defender for Cloud Applications
US GCC	Microsoft Defender for Cloud Applications for the USA Government Cloud Community (GCC)
US GCC-High	Microsoft Defender for Cloud Applications for the USA Government Cloud Community High (GCC-High)

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

microsoft-defender-cloud-apps-get-events

Returns a list of alerts.

Base Command

microsoft-defender-cloud-apps-get-events

Input

Argument Name	Description	Required
limit	The maximum number of alerts per fetch. Default is 10000.	Optional
after	The first fetch time (<number> <time unit>, for example 12 hours, 1 day, 3 months). Default is 3 days.	Optional
push_to_xsiam	Whether to push the fetched event to XSIAM or not. Possible values are: false, true. Default is false.	Optional

Context Output

There is no context output for this command.

microsoft-defender-cloud-apps-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

microsoft-defender-cloud-apps-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Configuration parameters

endpoint_type — Endpoint Type
url — Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com) (required)
client_id — Client (Application) ID (required)
credentials — (required)
tenant_id — Tenant ID (required)
scope — Scope (required)
after — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
limit — Number of alerts for each fetch.
isFetchEvents — Fetch events
eventFetchInterval — Events Fetch Interval
verify — Verify SSL Certificate
proxy — Use system proxy settings
event_types_to_fetch — Event types to fetch

Commands (2)

microsoft-defender-cloud-apps-auth-reset
Run this command if for some reason you need to rerun the authentication process.
microsoft-defender-cloud-apps-get-events
Returns a list of alerts. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.

Source

MicrosoftDefenderEventCollector.py MicrosoftDefenderEventCollector_test.py MicrosoftDefenderEventCollector.yml MicrosoftDefenderEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Defender for Cloud Apps Event Collector
  version: -1
configuration:
- additionalinfo: |-
    More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-defender-for-cloud-apps-event-collector
  display: Endpoint Type
  name: endpoint_type
  required: false
  type: 15
  section: Connect
  defaultvalue: Worldwide
  options:
  - Worldwide
  - US GCC
  - US GCC-High
- display: Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com)
  additionalinfo: In the Security Center, go to Settings > Clod Apps > About tab, where the API URL is displayed.
  name: url
  required: true
  type: 0
  section: Connect
- name: client_id
  required: true
  type: 0
  section: Connect
  additionalinfo: The Client (Application) ID to use to connect.
  display: Client (Application) ID
- name: credentials
  required: true
  type: 9
  section: Connect
  displaypassword: Client Secret
  hiddenusername: true
- display: Tenant ID
  name: tenant_id
  required: true
  type: 0
  section: Connect
- defaultvalue: '05a65629-4c1b-48c1-a78b-804c4abdd4af/.default'
  display: Scope
  name: scope
  type: 0
  section: Connect
  required: true
  additionalinfo: The scope of the application (only if self-deployed).
- defaultvalue: '3 days'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: after
  type: 0
  section: Collect
  required: false
- display: Number of alerts for each fetch.
  name: limit
  type: 0
  section: Collect
  required: false
  defaultvalue: '1000'
  additionalinfo: The number of events to retrieve. Events are retrieved in pages of up to 100 (the API page-size limit) until this number is reached.
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Verify SSL Certificate
  name: verify
  type: 8
  section: Connect
  advanced: true
  required: false
  defaultvalue: 'true'
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Event types to fetch
  name: event_types_to_fetch
  section: Collect
  type: 16
  defaultvalue: Alerts,Admin activities,Login activities
  options:
  - Alerts
  - Admin activities
  - Login activities
description: Collects the events log for alerts and activities provided Microsoft Defender for Cloud Apps API.
display: Microsoft Defender for Cloud Apps Event Collector
name: Microsoft Defender for Cloud Apps Event Collector
script:
  commands:
  - description: Returns a list of alerts. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    name: microsoft-defender-cloud-apps-get-events
    arguments:
    - description: The maximum number of events to return per event type. Events are retrieved in pages of up to 100 (the API page-size limit).
      defaultValue: '1000'
      name: limit
    - description: The first fetch time (<number> <time unit>, for example 12 hours, 1 day, 3 months).
      defaultValue: 3 days
      isArray: true
      name: after
    - auto: PREDEFINED
      default: true
      defaultValue: 'false'
      description: Whether to push the fetched event to XSIAM or not.
      name: should_push_events
      predefined:
      - 'false'
      - 'true'
    - name: event_types_to_fetch
      auto: PREDEFINED
      description: A comma-separated list of event types to scope this run to. If not provided, all configured event types are fetched.
      isArray: true
      predefined:
      - Alerts
      - Admin activities
      - Login activities
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: microsoft-defender-cloud-apps-auth-reset
    arguments: []
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/auth-utils:1.0.0.11671917
fromversion: 6.8.0
marketplaces:
- marketplacev2
- platform
tests:
- No Tests
supportedModules:
- xsiam