Connecting to a Microsoft Defender for Endpoint data source

Connect the Microsoft Defender for Endpoint data source to IBM Security QRadar® Suite Software to enable your applications and dashboards to collect and analyze Microsoft Defender for Endpoint security data. Universal Data Insights connectors enable federated search across your security products.

Before you begin

Collaborate with a Microsoft Security Center administrator to get the permissions that are required for your user account to receive data through the connector.

To enable access to the Advanced hunting API for Microsoft Defender for Endpoint:
  1. Register an application for Microsoft Defender for Endpoint in the Azure Active Directory by following the directions in Use Microsoft Defender for Endpoint APIs (https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-create-app-nativeapp?view=o365-worldwide).

    When the new app dashboard is displayed, the Tenant and Client ID of this application are displayed. You need the Tenant and Client ID of this application in step 8.

  2. Select API Permissions.
  3. Click Add a permission > APIs my organization uses, then search for and select WindowsDefenderATP.
  4. Click Delegated permissions and select AdvancedQuery > AdvancedQuery.Read.
  5. Click Application permissions and select AdvancedQuery > AdvancedQuery.Read.All.
  6. Click Add permissions.
  7. Collaborate with the administrator to grant admin consent for the configured permissions.
  8. Click Certificates & secrets.
  9. To generate the client secret for this configured application, click New client secret. You need the client secret in step 8.
  10. Enter a description and choose a value from the Expires options for the client secret.

If you have a firewall between your cluster and the data source target, use the IBM® Security Edge Gateway to host the containers. The Edge Gateway must be V1.6 or later. For more information, see Edge Gateway.

About this task

The QRadar Suite Software connector for Microsoft Defender for Endpoint is designed to work with the Advanced hunting API. For more information about the Advanced hunting API, see Advanced hunting API (https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-advanced-query-api?view=o365-worldwide).

Structured Threat Information eXpression (STIX) is a language and serialization format that organizations use to exchange cyberthreat intelligence. The connector uses STIX patterning to query Microsoft Defender for Endpoint data and returns results as STIX objects. For more information about how the Microsoft Defender for Endpoint data schema maps to STIX, see Microsoft Defender for Endpoint stix-shifter repository (https://github.com/opencybersecurityalliance/stix-shifter/tree/develop/stix_shifter_modules/msatp).

Procedure

  1. Log in to IBM Security QRadar Suite Software.
  2. From the menu, click Connections > Integration data sources.
  3. On the Integration data sources page, on the Microsoft Defender for Endpoint tile, click Set up a connection.
  4. On the Connection services page, select the Federated searches service tile, and then click Enable.
    The available connection services include:
    1. Connected assets & risk
    2. Federated searches
    Note: If there are multiple data sources to connect, select the connector from the Sources list, and then click Enable.
  5. Click Next.
  6. On the Connection details page, configure the following parameters.
    1. Configure the connection to the data source.
      Table 1. Connection parameters
      Parameter Description
      Data source name Enter a unique name to identify the data source connection. You can create multiple connections to a data source, so it is useful to clearly set them apart by name.

      Only alphanumeric characters and the following special characters are allowed: - . _

      Data source description Enter a description to indicate the purpose of the data source connection. You can create multiple connections to a data source, so it is useful to clearly indicate the purpose of each connection by description.

      Only alphanumeric characters and the following special characters are allowed: - . _

      Edge gateway If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the Edge gateway field, specify an Edge Gateway to host the connector.

      It can take up to five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.

      Management IP address or Hostname Enter the IP address or hostname of the data source so that the QRadar Suite Software can communicate with it.
      Host port Enter the port number that is associated with the Base URL. The default is 443.
      Join events with alerts? Enable to search for correlated alerts in the DeviceAlertsEvent table and include the alert data in the results.
      Join events with host os info? Enable to include devise OS details from the DeviceInfo table along with every event.
      Join events with device network info? Enable to include the active network adapters IP and MAC addresses pf the device at the time of the event from DeviceNetworkInfo table.
      Keep the original json payload as original_ref? Enable to encode the original json results from the EDR before they are translated to STIX and put them in an artifact object referenced as original_ref from x-oca-event.
    2. Set the query parameters to control the behavior of the federated search query on the data source.
      Table 2. Query parameters
      Query parameter Description
      Concurrent search limit Enter the number of simultaneous connections that can be made to the data source. The default limit for the number of connections is 4. The value must not be less than 1 and must not be greater than 100.
      Query search timeout limit Enter the time limit in minutes for how long the query is run on the data source. The default time limit is 30. When the value is set to zero, no timeout occurs. The value must not be less than 1 and must not be greater than 120.
      Result size limit Enter the maximum number of entries or objects that are returned by search query. The default result size limit is 10,000. The value must not be less than 1 and must not be greater than 500,000.
      Query time range Enter the time range in minutes for the search, represented as the last X minutes. The default is 5 minutes. The value must not be less than 1 and must not be greater than 10,000.
      Custom mapping (Optional) If you need to customize the STIX attributes mapping, click Customize attribute mapping and edit the JSON blob to map new or existing properties to their associated target data source fields.
      Important: If you increase the Concurrent search limit and the Result size limit, a greater amount of data can be sent to the data source, which increases the strain on the data source. Increasing the query time range also increases the amount of data.
    3. Click Next.
  7. On the Connection configurations page, configure identity and access.
    1. Click Add a configuration.
    2. In the Configuration details window, configure the following parameters.
      Table 3. Configuration parameters
      Parameter Description
      Configuration Name Enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Configuration Description Enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Tenant Enter the tenant ID of the Azure Active Directory application with access to the Advanced hunting API.
      Client Id Enter the client ID of the Azure Active Directory application with access to the Advanced hunting API.
      Client Secret Enter the client secret of the Azure Active Directory application with access to the Advanced hunting API.
    3. To save your configuration and establish the connection, click Save.
  8. Click Next.
  9. To assign user access, on the User access control page, select one or more data source configurations from the Access list, and then click Finish.
  10. To manage your active connections, complete the following steps:
    1. On the Integration data sources page, on the tile of the relevant data source, click Manage <x> of <x> active connections.
    2. On the Connection status page, on the tile of the relevant data source, you can edit, refresh, or delete your data source connection.

Results

After you connect a data source, it might take up to 30 seconds to retrieve the data. Before the full data set is returned, the data source might display as unavailable. After the data is returned, the data source shows as being connected, and a polling mechanism occurs to validate the connection status. The connection status is valid for 60 seconds after every poll.

You can add other connection configurations for this data source that have different users and different data access permissions.

What to do next

Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In Data Explorer, click an IP address to view its associated assets and risk.

To use Data Explorer, you must have data sources that are connected so that the application can run queries and retrieve results across a unified set of data sources. The search results vary depending on the data that is contained in your configured data sources. For more information about how to build a query in Data Explorer, see Build a query.