Microsoft Defender for Cloud Apps Event Collector

Details

ID	`Microsoft Defender for Cloud Apps Event Collector`
Provider	Microsoft
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/auth-utils:1.0.0.11671917`
Supported Modules	Agentix XSIAM

README

Microsoft Defender for Cloud Apps Event Collector integration.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Microsoft Defender for Cloud Apps Event Collector in Cortex

Parameter	Description	Required
Endpoint Type	The endpoint for accessing Microsoft Defender for Cloud Applications (MCAS), see table below.	Worldwide
Endpoint URI	The United States: api-us.security.microsoft.com Europe: api-eu.security.microsoft.com The United Kingdom: api-uk.security.microsoft.com	True
Client (Application) ID	The Client (Application) ID to use to connect.	True
Client Secret		True
Tenant ID		True
Scope		True
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)		False
Number of alerts for each fetch.	Due to API limitations, the maximum is 10,000.	False
Fetch events		False
Verify SSL Certificate		False
Use system proxy settings		False
Event types to fetch		True

Endpoint Type options

Endpoint Type	Description
Worldwide	The publicly accessible Microsoft Defender for Cloud Applications
US GCC	Microsoft Defender for Cloud Applications for the USA Government Cloud Community (GCC)
US GCC-High	Microsoft Defender for Cloud Applications for the USA Government Cloud Community High (GCC-High)

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

microsoft-defender-cloud-apps-get-events

Returns a list of alerts.

Base Command

microsoft-defender-cloud-apps-get-events

Input

Argument Name	Description	Required
limit	The maximum number of alerts per fetch. Default is 10000.	Optional
after	The first fetch time (<number> <time unit>, for example 12 hours, 1 day, 3 months). Default is 3 days.	Optional
push_to_xsiam	Whether to push the fetched event to XSIAM or not. Possible values are: false, true. Default is false.	Optional

Context Output

There is no context output for this command.

microsoft-defender-cloud-apps-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

microsoft-defender-cloud-apps-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Configuration parameters

endpoint_type — Endpoint Type
url — Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com) (required)
client_id — Client (Application) ID (required)
credentials — (required)
tenant_id — Tenant ID (required)
scope — Scope (required)
after — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
limit — Number of alerts for each fetch.
isFetchEvents — Fetch events
eventFetchInterval — Events Fetch Interval
verify — Verify SSL Certificate
proxy — Use system proxy settings
event_types_to_fetch — Event types to fetch

Commands (2)

microsoft-defender-cloud-apps-auth-reset
Run this command if for some reason you need to rerun the authentication process.
microsoft-defender-cloud-apps-get-events
Returns a list of alerts. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.

Source

MicrosoftDefenderEventCollector.py MicrosoftDefenderEventCollector_test.py MicrosoftDefenderEventCollector.yml MicrosoftDefenderEventCollector_description.md

Download History Raw


Follow these steps for instance configuration:

1. Enter your *Server URL*. Use one of the following: `https://portal.cloudappsecurity.com` or `https://yourdomain.eu2.portal.cloudappsecurity.com`
2. Enter your client/application ID in the *Client (Application) ID* parameter, refer to the following [Microsoft article](https://learn.microsoft.com/en-us/defender-cloud-apps/api-authentication-application). 
3. Enter your client secret in the *Client Secret* parameter, refer to the following [Microsoft article](https://learn.microsoft.com/en-us/defender-cloud-apps/api-authentication-application).
4. Enter your tenant ID in the *Tenant ID* parameter.
5. Click the ***test*** button to test the connection and the authorization process.
----