Microsoft Defender for Cloud Event Collector

Details

ID	`Microsoft Defender for Cloud Event Collector`
Provider	Microsoft
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/crypto:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

XSIAM collector for Microsoft Defender for Cloud alerts.

Configure Microsoft Defender for Cloud Event Collector in Cortex

Parameter	Description	Required
Microsoft Azure Management URL		False
Client ID	Microsoft Defender for Cloud client ID	True
Tenant ID	Microsoft Defender for Cloud Tenant ID	True
Client Secret	Microsoft Defender for Cloud Client Secret	True
Certificate Thumbprint	Used for certificate authentication. As appears in the “Certificates & secrets” page of the app.	False
Private Key	Used for certificate authentication. The private key of the registered certificate.	False
Subscription ID to use		True
First fetch time interval	First time to start fetching alerts from.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Known limitations

This integration does not have a fetch limit parameter due to the limitations of the API functionality.

The collector fetches all events between the current time and the last time it was fetched during every fetch operation.

If the command is run for the first time, all events from first_fetch until the current time be fetched in one execution.
It is possible that the above limitations may cause the fetch to take some time. You may need to increase the collector time out value in the server configuration if the collector fetch times out.

ms-defender-for-cloud-get-events

Lists alerts for the subscription according to the specified filters.

Base Command

ms-defender-for-cloud-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of results to return.	Optional

Context Output

Path	Type	Description
MicrosoftDefenderForCloud.Alert.AlertDisplayName	string	The display name of the alert.
MicrosoftDefenderForCloud.Alert.CompromisedEntity	string	The entity on which the incident occurred.
MicrosoftDefenderForCloud.Alert.DetectedTimeUtc	date	The time the vendor detected the incident.
MicrosoftDefenderForCloud.Alert.ReportedSeverity	string	The estimated severity of this alert.
MicrosoftDefenderForCloud.Alert.ID	string	The alert ID.

ms-defender-for-cloud-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

ms-defender-for-cloud-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Configuration parameters

server_url — Microsoft Azure Management URL
client_id — (required)
tenant_id — (required)
enc_key — (required)
certificate_thumbprint —
private_key — Private Key
sub_id — (required)
first_fetch — First fetch time interval
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (2)

ms-defender-for-cloud-auth-reset
Run this command if for some reason you need to rerun the authentication process.
ms-defender-for-cloud-get-events
Lists alerts for the subscription according to the specified filters.

Source

MicrosoftDefenderForCloudEventCollector.py MicrosoftDefenderForCloudEventCollector_test.py MicrosoftDefenderForCloudEventCollector.yml MicrosoftDefenderForCloudEventCollector_description.md

Download History Raw

Microsoft Defender for Cloud Event Collector provides unified security management and advanced threat protection across hybrid cloud workloads.
This collector retrieves a list of all the alerts that are associated with a subscription.

#### Authentication with Microsoft Defender For Cloud (Self deployed Azure App)

Self-deployed configuration:
 * [Self-Deployed Application](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#self-deployed-application)

#### Required permissions.

After you finish configuring your application,
add a “Security Reader” role to the application from the subscription.
1. In the Azure portal, go to the subscription > **Access control (IAM)**.
2. Click **Add**.
3. Click **Add role assignment**.
4.  in the *Role* tab search for and select **Security Reader**.
5.  In the *Members* tab, click **Select members** and  select the the created application.
6. Click **Review + assign**.

For additional information about roles, refer to:
* [Azure AD built-in roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference)

#### Additional information

For additional information on the API, refer to:
* [Alerts](https://learn.microsoft.com/en-us/rest/api/defenderforcloud/alerts/list?tabs=HTTP)