MicrosoftCloudAppSecurity

Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.

Category

Authentication & Identity Management

Pack

MicrosoftCloudAppSecurity

Configuration parameters

• auth_mode — Authentication Mode
• endpoint_type — Endpoint Type
• url — Server URL (e.g., https://yourdomain.eu2.portal.cloudappsecurity.com) (required)
• creds_token —
• token — User's key to access the API (for legacy method)
• app_id — Application ID
• tenant_id — Tenant ID (for Client Credentials mode)
• client_id —
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• severity — Incident severity
• max_fetch — Maximum alerts to fetch
• first_fetch — First fetch time
• resolution_status — Incident resolution status
• custom_filter — Custom Filter
• look_back — Advanced: Minutes to look back when fetching

Commands (13)

• microsoft-cas-activities-list — Returns a list of activities that match the specified filters. In case of timeout errors, please consider increasing the timeout argument.
• microsoft-cas-alert-close-benign — An alert on a suspicious but not malicious activity, such as a penetration test or other authorized suspicious action.
• microsoft-cas-alert-close-false-positive — Close multiple alerts matching the specified filters as false positive (an alert on a non-malicious activity).
• microsoft-cas-alert-close-true-positive — Close multiple alerts matching the specified filters as true positive (an alert on a confirmed malicious activity.
• microsoft-cas-alert-dismiss-bulk — Deprecated. Use one of the alert-close commands instead. Dismisses multiple alerts (bulk dismiss) that match the specified filters.
• microsoft-cas-alert-resolve-bulk — Deprecated. Use one of the alert-close commands instead. Resolves multiple alerts (bulk resolve) that match the specified filters. Filters include origin IP address, IP subnet category, action taken on the activity, source type, or a custom filter.
• microsoft-cas-alerts-list — Returns a list of alerts that match the specified filters.
• microsoft-cas-auth-complete — Run this command to complete the authorization process. Should be used after running the microsoft-365-defender-auth-start command. (for device-code mode).
• microsoft-cas-auth-reset — Run this command if for some reason you need to rerun the authentication process.
• microsoft-cas-auth-start — Run this command to start the authorization process and follow the instructions in the command results. (for device-code mode).
• microsoft-cas-auth-test — Tests the connectivity to the Microsoft 365 Defender.
• microsoft-cas-files-list — Returns a list of files that match the specified filters. Filters include file type, file share value, file extension, file quarantine status, and a custom filter. If you pass the custom_filter argument it will override the other filters in this command. This command is supported only when using the legacy authentication.
• microsoft-cas-users-accounts-list — Returns a list of user accounts that match the specified filters. Filters include user account type, group ID, external/internal, user account status, and custom filter. The accounts object schema includes information about how users and accounts use your organization's cloud apps.