Microsoft Defender for Cloud Event Collector

Details

ID	`Microsoft Defender for Cloud Event Collector`
Provider	Microsoft
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/crypto:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

XSIAM collector for Microsoft Defender for Cloud alerts.

Configure Microsoft Defender for Cloud Event Collector in Cortex

Parameter	Description	Required
Microsoft Azure Management URL		False
Client ID	Microsoft Defender for Cloud client ID	True
Tenant ID	Microsoft Defender for Cloud Tenant ID	True
Client Secret	Microsoft Defender for Cloud Client Secret	True
Certificate Thumbprint	Used for certificate authentication. As appears in the “Certificates & secrets” page of the app.	False
Private Key	Used for certificate authentication. The private key of the registered certificate.	False
Subscription ID to use		True
First fetch time interval	First time to start fetching alerts from.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Known limitations

This integration does not have a fetch limit parameter due to the limitations of the API functionality.

The collector fetches all events between the current time and the last time it was fetched during every fetch operation.

If the command is run for the first time, all events from first_fetch until the current time be fetched in one execution.
It is possible that the above limitations may cause the fetch to take some time. You may need to increase the collector time out value in the server configuration if the collector fetch times out.

ms-defender-for-cloud-get-events

Lists alerts for the subscription according to the specified filters.

Base Command

ms-defender-for-cloud-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of results to return.	Optional

Context Output

Path	Type	Description
MicrosoftDefenderForCloud.Alert.AlertDisplayName	string	The display name of the alert.
MicrosoftDefenderForCloud.Alert.CompromisedEntity	string	The entity on which the incident occurred.
MicrosoftDefenderForCloud.Alert.DetectedTimeUtc	date	The time the vendor detected the incident.
MicrosoftDefenderForCloud.Alert.ReportedSeverity	string	The estimated severity of this alert.
MicrosoftDefenderForCloud.Alert.ID	string	The alert ID.

ms-defender-for-cloud-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

ms-defender-for-cloud-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Configuration parameters

server_url — Microsoft Azure Management URL
client_id — (required)
tenant_id — (required)
enc_key — (required)
certificate_thumbprint —
private_key — Private Key
sub_id — (required)
first_fetch — First fetch time interval
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (2)

ms-defender-for-cloud-auth-reset
Run this command if for some reason you need to rerun the authentication process.
ms-defender-for-cloud-get-events
Lists alerts for the subscription according to the specified filters.

Source

MicrosoftDefenderForCloudEventCollector.py MicrosoftDefenderForCloudEventCollector_test.py MicrosoftDefenderForCloudEventCollector.yml MicrosoftDefenderForCloudEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Defender for Cloud Event Collector
  version: -1
configuration:
- defaultvalue: https://management.azure.com/
  display: Microsoft Azure Management URL
  name: server_url
  type: 0
  section: Connect
  required: false
- displaypassword: Client ID
  name: client_id
  required: true
  hiddenusername: true
  type: 9
  section: Connect
  additionalinfo: Microsoft Defender for Cloud client ID
- displaypassword: Tenant ID
  name: tenant_id
  required: true
  hiddenusername: true
  type: 9
  section: Connect
  additionalinfo: Microsoft Defender for Cloud Tenant ID
- displaypassword: Client Secret
  name: enc_key
  required: true
  hiddenusername: true
  type: 9
  section: Connect
  additionalinfo: Microsoft Defender for Cloud Client Secret
- displaypassword: Certificate Thumbprint
  name: certificate_thumbprint
  hiddenusername: true
  type: 9
  section: Connect
  additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  required: false
- additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  display: Private Key
  name: private_key
  type: 14
  section: Connect
  required: false
- displaypassword: Subscription ID to use
  name: sub_id
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: First fetch time interval
  name: first_fetch
  type: 0
  defaultvalue: 3 days
  section: Collect
  additionalinfo: First time to start fetching alerts from.
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  section: Collect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Collect
  required: false
description: XSIAM collector for Microsoft Defender for Cloud alerts.
display: Microsoft Defender for Cloud Event Collector
name: Microsoft Defender for Cloud Event Collector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: Maximum number of results to return.
      name: limit
    description: Lists alerts for the subscription according to the specified filters.
    name: ms-defender-for-cloud-get-events
    outputs:
    - contextPath: MicrosoftDefenderForCloud.Alert.AlertDisplayName
      description: The display name of the alert.
      type: string
    - contextPath: MicrosoftDefenderForCloud.Alert.CompromisedEntity
      description: The entity on which the incident occurred.
      type: string
    - contextPath: MicrosoftDefenderForCloud.Alert.DetectedTimeUtc
      description: The time the vendor detected the incident.
      type: date
    - contextPath: MicrosoftDefenderForCloud.Alert.ReportedSeverity
      description: The estimated severity of this alert.
      type: string
    - contextPath: MicrosoftDefenderForCloud.Alert.ID
      description: The alert ID.
      type: string
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: ms-defender-for-cloud-auth-reset
    arguments: []
  dockerimage: demisto/crypto:1.0.0.10120494
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam