Connecting to a Microsoft Graph Security data source

Connect the Microsoft Graph Security data source to IBM Security QRadar® Suite Software to enable your applications and dashboards to collect and analyze Microsoft Graph Security security data. Universal Data Insights connectors enable federated search across your security products.

Important: The Microsoft Graph Security connector was called Microsoft Azure Sentinel connector in QRadar Suite Software 1.10.9 and earlier.

Before you begin

Collaborate with a Microsoft Graph Security administrator to set permissions that are required for your user account to receive alerts through the connector. You also need to obtain the following security credentials:
  • Tenant ID
  • Client ID
  • Client Secret
Configure the Microsoft Graph API.
  1. To register the app in Azure Active Directory follow Microsoft documentation to Register an App.

    The new app dashboard is displayed, the Client ID of this application is available in the dashboard.

  2. Click API Permissions.
  3. Add the permissions in the following table. To add permissions, click Add a permission.
    API Permissions name Type
    Azure Service Management user_impersonation Delegated
    Microsoft Graph Security.Events.Read.All Delegated
    Microsoft Graph Security.Events.Read.All Application
    Microsoft Graph User.Read Delegated
  4. Choose the API Microsoft Graph.
  5. Click Delegated permissions and Application permissions categories.
  6. Click Grant admin consent for the user account for the configured permissions.
  7. Click Certificates & secrets.
  8. To generate the client secret for this configured application, click New client secret.
  9. Enter a description and choose a value from the Expires options for the client secret.

    For more information about app access, see Get access without a user.

If you have a firewall between your cluster and the data source target, use the IBM® Security Edge Gateway to host the containers. The Edge Gateway must be V1.6 or later. For more information, see Edge Gateway.

About this task

The IBM Security QRadar Suite Software connector for Microsoft Graph Security is designed to work with the Security Alerts v1.0/security/alerts endpoint.

For more information about Microsoft Graph Security, see Microsoft Defender for Cloud.

Structured Threat Information eXpression (STIX) is a language and serialization format that organizations use to exchange cyberthreat intelligence. The connector uses STIX patterning to query Microsoft Graph Security data and returns results as STIX objects. For more information about how the Microsoft Graph Security data schema maps to STIX, see Microsoft Graph Security stix-shifter repository (https://github.com/opencybersecurityalliance/stix-shifter/tree/develop/stix_shifter_modules/azure_sentinel).

Procedure

  1. Log in to IBM Security QRadar Suite Software.
  2. From the menu, click Connections > Data sources.
  3. On the Data Sources tab, click Connect a data source.
  4. Click Microsoft Graph Security, then click Next.
  5. Configure the connection to allow IBM Security QRadar Suite Software to connect to the data source.
    1. Configure the connection to the data source.
      Table 1. Connection parameters
      Parameter Description
      Data source name Enter a unique name to identify the data source connection. You can create multiple connections to a data source, so it is useful to clearly set them apart by name.

      Only alphanumeric characters and the following special characters are allowed: - . _
      Data source description Enter a description to indicate the purpose of the data source connection. You can create multiple connections to a data source, so it is useful to clearly indicate the purpose of each connection by description.

      Only alphanumeric characters and the following special characters are allowed: - . _
      Edge gateway If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the Edge gateway field, specify an Edge Gateway to host the connector.

      It can take up to five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.
      Management IP address or Hostname Enter the hostname or IP address of the data source so that the QRadar Suite Software can communicate with it.
      Host port Enter the port number that is associated with the data source host.
      Microsoft Entra authentication endpoint Enter the Microsoft Entra authentication endpoint for national clouds..
    2. Set the query parameters to control the behavior of the federated search query on the data source.
      Table 2. Query parameters
      Query parameter Description
      Concurrent search limit Enter the number of simultaneous connections that can be made to the data source. The default limit for the number of connections is 4. The value must not be less than 1 and must not be greater than 100.
      Query search timeout limit Enter the time limit in minutes for how long the query is run on the data source. The default time limit is 30. When the value is set to zero, no timeout occurs. The value must not be less than 1 and must not be greater than 120.
      Result size limit Enter the maximum number of entries or objects that are returned by search query. The default result size limit is 10,000. The value must not be less than 1 and must not be greater than 500,000.
      Query time range Enter the time range in minutes for the search, represented as the last X minutes. The default is 5 minutes. The value must not be less than 1 and must not be greater than 10,000.
      Custom mapping (Optional) If you need to customize the STIX attributes mapping, click Customize attribute mapping and edit the JSON blob to map new or existing properties to their associated target data source fields.
      Important: If you increase the Concurrent search limit and the Result size limit, a greater amount of data can be sent to the data source, which increases the strain on the data source. Increasing the query time range also increases the amount of data.
  6. Optional: If Microsoft Graph Security is configured with a self-signed Security Sockets Layer (SSL) certificate, add a connection certificate.
    1. Specify the self-signed certificate that is configured in Microsoft Graph Security.
    2. If the value of your hostname or IP address does not match the common name value in your certificate, add the hostname to the server that hosts the Edge Gateway.
      Table 3. Adding your hostname to the Edge Gateway server
      If you are running the Edge client If you are not running the Edge client
      Run the following command:
      manageAppHost dns --set --ip <ip_address> --hostname <hostname1> --hostname <hostname2>
      Tip: The <ip_address> is the address of the server that you want to access, and <hostname> is the name of the server. If a server has multiple names, you can add each name by using --hostname.

      You can use --show to see the defined hostnames and --clear to remove a hostname previously set with the manageAppHost command.

      		 Add the hostname to the server that hosts the Edge Gateway by adding entries to Pod /etc/hosts with HostAliases. To edit the Universal Data Insights worker deployment, run the following command:
      oc edit deployment udi-udiworker
      Add the following information to the host deployment HostAliases, in the spec.template.spec section:
      hostAliases:
   - hostnames:
    - qradar.iseccs.local
    ip: <1.2.3.4>

      For more information, see Adding entries to Pod /etc/hosts with HostAliases (https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/).
    3. Copy the certificate details and paste it in the space that is provided.
  7. Click Add a configuration.
    1. Configure identity and access.
      Table 4. Configuration parameters
      Parameter Description
      Configuration Name Enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Configuration Description Enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Tenant Enter the Tenant ID of Azure Active directory Application with access to the Microsoft Graph API.
      Client ID Enter the Client ID of Azure Active directory Application with access to the Microsoft Graph API.
      Client secret Enter the Client Secret of Azure Active directory Application with access to the Microsoft Graph API.
    2. Click Add.
    3. To save your configuration and establish the connection, click Done.
  8. To edit your configurations, complete the following steps:
    1. On the Data Sources tab, select the data source connection that you want to edit.
    2. In the Configurations section, click Edit Configuration (Edit configuration icon).
    3. Edit the identity and access parameters and click Save.

Results

You can see the data source connection configuration that you added under Connections > Data Sources page.

Tip: After the data source is connected, it takes some time for the initial data retrieval based on the frequency that is specified in the Frequency parameter. During this time, the data source appears as unavailable. After the data retrieval is complete, the data source shows as connected. To maintain the connection status, a polling mechanism is initiated to verify the connection periodically.

What to do next

Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In Data Explorer, click an IP address to view its associated assets and risk.

To use Data Explorer, you must have data sources that are connected so that the application can run queries and retrieve results across a unified set of data sources. The search results vary depending on the data that is contained in your configured data sources. For more information about how to build a query in Data Explorer, see Build a query.