MicrosoftDefenderThreatIntelligence

Details

ID	`MicrosoftDefenderThreatIntelligence`
Provider	Microsoft
Category	Data Enrichment & Threat Intelligence
From Version	6.1.0
Docker Image	`demisto/crypto:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

This integration requires Defender Threat Intelligence—premium version

Use the Microsoft Defender Threat Intelligence integration to query enriched threat intelligence data such as articles, threat actor profiles, WHOIS records, and host-related infrastructure.

Configure MicrosoftDefenderThreatIntelligence in Cortex

Parameter	Description	Required
Application ID (Client ID for Client credentials mode)		False
Tenant ID (required for Client Credentials mode)		False
Client Secret (required for Client Credentials mode)	Client Secret. Required for Client Credentials mode)	False
Certificate Thumbprint	Used for certificate authentication. As appears in the “Certificates & secrets” page of the app.	False
Private Key		False
Use Azure Managed Identities	Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.	False
Azure Managed Identities Client ID	The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.	False
Azure AD endpoint	Azure AD endpoint associated with a national cloud.	False
Incident type		False
Use Client Credentials Authorization Flow	Use a self-deployed Azure application and authenticate using the Client Credentials flow.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msg-defender-threat-intel-auth-start

Run this command to start the authorization process and follow the instructions in the command results.

Base Command

msg-defender-threat-intel-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msg-defender-threat-intel-auth-complete

Run this command to complete the authorization process.\nShould be used after running the msg-defender-threat-intel-auth-start command.

Base Command

msg-defender-threat-intel-auth-complete

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msg-defender-threat-intel-auth-test

Run this command to test if the authorization process is successful.

Base Command

msg-defender-threat-intel-auth-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msg-defender-threat-intel-auth-reset

Run this command to reset the authorization process.

Base Command

msg-defender-threat-intel-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msg-defender-threat-intel-article-list

Get articles including their properties and relationships.

Base Command

msg-defender-threat-intel-article-list

Input

Argument Name	Description	Required
article_id	Article ID to retrieve specific article details.	Optional
limit	Number of incidents in the list.	Optional
odata	Use “odata” query to customize the response	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.Article.id	String	The unique identifier of the threat intelligence article.
MSGDefenderThreatIntel.Article.title	String	The title of the Microsoft Defender Threat Intelligence article.

msg-defender-threat-intel-article-indicators-list

Get indicators of threat or compromise related to the contents of an article.

Base Command

msg-defender-threat-intel-article-indicators-list

Input

Argument Name	Description	Required
article_id	The unique identifier of the article.	Optional
article_indicator_id	The unique identifier of a specific indicator within the article.	Optional
limit	Number of incidents in the list.	Optional
odata	Use “odata” query to customize the response	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.ArticleIndicator.id	String	The unique identifier of the indicator associated with the article.
MSGDefenderThreatIntel.ArticleIndicator.artifact.id	String	The unique identifier of the artifact (e.g., file, domain, IP) related to the indicator.

msg-defender-threat-intel-profile-list

Get Intelligence Profiles including their properties and relationships.

Base Command

msg-defender-threat-intel-profile-list

Input

Argument Name	Description	Required
intel_profile_id	The unique identifier of the intelligence profile.	Optional
limit	Number of incidents in the list.	Optional
odata	Use “odata” query to customize the response	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.Profile.id	unknown	The unique identifier of the threat actor profile.
MSGDefenderThreatIntel.Profile.title	String	The title or name of the threat actor profile.

msg-defender-threat-intel-profile-indicators-list

Get Intelligence Profiles Indicators and their properties.

Base Command

msg-defender-threat-intel-profile-indicators-list

Input

Argument Name	Description	Required
intel_profile_id	The unique identifier of the intelligence profile.	Optional
intel_profile_indicator_id	The unique identifier of a specific indicator related to an intelligence profile.	Optional
limit	Number of incidents in the list.	Optional
odata	Use “odata” query to customize the response	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.ProfileIndicator.id	unknown	The unique identifier of the indicator associated with the threat actor profile.
MSGDefenderThreatIntel.ProfileIndicator.artifact.id	String	The unique identifier of the artifact (e.g., IP address, domain, file hash) linked to the indicator.

msg-defender-threat-intel-host

Read the properties and relationships of a host object.

Base Command

msg-defender-threat-intel-host

Input

Argument Name	Description	Required
host_id	The unique identifier of the host.	Required
odata	Use “odata” query to customize the response	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.Host.id	unknown	The unique identifier of the host object in Microsoft Defender Threat Intelligence.
MSGDefenderThreatIntel.Host.registrar	String	The name of the domain registrar responsible for registering the host.
MSGDefenderThreatIntel.Host.registrant	String	The entity (person or organization) that registered the host domain.

msg-defender-threat-intel-host-whois

Get the specified whoisRecord resource.

Base Command

msg-defender-threat-intel-host-whois

Input

Argument Name	Description	Required
host_id	hostname or IP address.	Optional
whois_record_id	The unique identifier of a specific WHOIS record.	Optional
odata	Use “odata” query to customize the response.	Optional
limit	Number of records in the list.	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.Whois.id	unknown	The unique identifier of the WHOIS record in Microsoft Defender Threat Intelligence.
MSGDefenderThreatIntel.Whois.whoisServer	String	The WHOIS server that provided the domain registration information.
MSGDefenderThreatIntel.Whois.domainStatus	String	The current status of the domain (e.g., active, clientHold, expired) as reported in the WHOIS record.

msg-defender-threat-intel-host-whois-history

Get the history for a whoisRecord, as represented by a collection of whoisHistoryRecord resources.

Base Command

msg-defender-threat-intel-host-whois-history

Input

Argument Name	Description	Required
host_id	hostname or IP address.	Optional
whois_record_id	The unique identifier of the WHOIS record whose history you want to retrieve.	Optional
odata	Use “odata” query to customize the response.	Optional
limit	Number of records in the list.	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.WhoisHistory.id	unknown	The unique identifier of the historical WHOIS record.
MSGDefenderThreatIntel.WhoisHistory.whoisServer	String	The WHOIS server that provided the historical domain registration data.
MSGDefenderThreatIntel.WhoisHistory.domainStatus	String	The domain’s status at the time of the historical WHOIS record (e.g., clientTransferProhibited, inactive).

msg-defender-threat-intel-host

Read the properties and relationships of a host object.

Base Command

msg-defender-threat-intel-host-reputation

Input

Argument Name	Description	Required
host_id	The unique identifier of the host.	Required
odata	Use “odata” query to customize the response.	Optional

Context Output

Path	Type	Description
MSGDefenderThreatIntel.HostReputation.id	unknown	The unique identifier of the host object in Microsoft Defender Threat Intelligence.
MSGDefenderThreatIntel.HostReputation.classification	String	The reputation classification of the host (e.g., Malicious, Suspicious, Unknown).
MSGDefenderThreatIntel.HostReputation.score	String	TA numerical score representing the confidence or severity of the host’s reputation.

Configuration parameters

app_id — Application ID (Client ID for Client Credentials mode)
tenant_id — Tenant ID (required for Client Credentials mode)
credentials —
creds_certificate — Certificate Thumbprint
use_managed_identities — Use Azure Managed Identities
managed_identities_client_id —
azure_ad_endpoint — Azure AD endpoint
client_credentials — Use Client Credentials Authorization Flow
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (12)

msg-defender-threat-intel-article-indicators-list
Get indicators of threat or compromise related to the contents of an article.
msg-defender-threat-intel-article-list
Get articles including their properties and relationships.
msg-defender-threat-intel-auth-complete
Completes the authorization process. Should be used after running the msg-defender-threat-intel-auth-start command.
msg-defender-threat-intel-auth-reset
Reruns the authentication process.
msg-defender-threat-intel-auth-start
Starts the authorization process. Follow the instructions in the command results.
msg-defender-threat-intel-auth-test
Tests connectivity to Microsoft.
msg-defender-threat-intel-host
Read the properties and relationships of a host object.
msg-defender-threat-intel-host-reputation
Retrieves the reputation details, properties, and related information for a specified host.
msg-defender-threat-intel-host-whois
Get the specified whoisRecord resource.
msg-defender-threat-intel-host-whois-history
Get the history for a whoisRecord, as represented by a collection of whoisHistoryRecord resources.
msg-defender-threat-intel-profile-indicators-list
Get Intelligence Profiles Indicators and their properties.
msg-defender-threat-intel-profile-list
Get Intelligence Profiles including their properties and relationships.

Source

MicrosoftDefenderThreatIntelligence.py MicrosoftDefenderThreatIntelligence_test.py MicrosoftDefenderThreatIntelligence.yml MicrosoftDefenderThreatIntelligence_description.md command_examples.txt

Download History Raw

**This integration requires Defender Threat Intelligence—premium version**

## Authorization
To use Microsoft Graph Services, you need to configure authentication. There are three authentication methods available:
- Client Credentials Flow (Recommended)
- Device Code Flow
- Azure Managed Identities

### Device Code Flow
___
In both options below, the [device authorization grant flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code) is used.

To connect to Microsoft Defender Threat Intelligence using either Cortex XSOAR Azure app or the Self-Deployed Azure app:
1. Fill in the required parameters.
2. Run the ***!msg-defender-threat-intel-auth-start*** command.
3. Follow the instructions that appear.
4. Run the ***!msg-defender-threat-intel-auth-complete*** command.

At the end of the process you'll see a message that you've logged in successfully.

#### Cortex XSOAR Azure App

To use the Cortex XSOAR Azure application, use the default application ID (7f55ea8c-2e5c-4a52-aafa-d0bfc632b242).  
A detailed explanation on how to register an app can be found [here](https://docs.microsoft.com/en-us/power-apps/developer/data-platform/walkthrough-register-app-azure-active-directory).

#### Self-Deployed Azure App

To use a self-configured Azure application, you need to add a new Azure App registration in the Azure portal, with mobile and desktop flows enabled.

### Client Credentials Flow

1. Enter your Client/Application ID in the ***Application ID*** parameter.
2. Enter your Client Secret in the ***Client Secret*** parameter.
3. Enter your Tenant ID in the ***Tenant ID*** parameter.

### Azure Managed Identities Authentication

**Note**: This option is relevant only if the integration is running on Azure VM.
Follow one of these steps for authentication based on Azure Managed Identities:

- ##### To use System Assigned Managed Identity
   - Select the **Use Azure Managed Identities** checkbox and leave the **Azure Managed Identities Client ID** field empty.

- ##### To use User Assigned Managed Identity
   1. Go to [Azure Portal](https://portal.azure.com/) -> **Managed Identities**.
   2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the **Azure Managed Identities Client ID** field in the instance settings.
   3. Select the **Use Azure Managed Identities** checkbox.

For more information, see [Managed identities for Azure resources](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).