Connecting to a Microsoft Defender for Endpoint asset data source
The Microsoft Defender for Endpoint Connected Assets and Risk connector can be run in the platform cluster. The connector incrementally synchronizes the contents of the Microsoft Defender for Endpoint asset databases with the data that is managed by the Connected Assets and Risk service.
Before you begin
Collaborate with a Microsoft Defender administrator to set the permissions that are required for your user account. The following permissions are required for the Microsoft Defender for Endpoint Connected Assets and Risk connector.
- Microsoft Graph
-
- User.Read
- User.Read.All
- WindowsDefenderATP
-
- AdvancedQuery.Read
- AdvancedQuery.Read.All
- Alert.Read.All
- Alert.ReadWrite.All
- Machine.Read
- Machine.Read.All
- Machine.ReadWrite
- Machine.ReadWrite.All
- User. Read.All
The API access requires OAuth2.0 authentication.
Generate an ATP access token by completing the following steps.
- Create an Azure Active Directory application.
- Get an access token that uses this application. Use the token to access the Microsoft Defender for Endpoint API.
For more information, see Create an app to access Microsoft Defender for Endpoint without a user.
About this task
The Microsoft Defender for Endpoint connector is designed to
work with the api/advancedqueries/run
, api/machines
, and
api/alerts
API endpoints. For more information about these API endpoints, see Supported Microsoft Defender for Endpoint APIs
(https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-list?view=o365-worldwide).
Microsoft Defender for Endpoint is an endpoint security platform to prevent, detect, investigate, and respond to advanced threats. For more information about Microsoft Defender for Endpoint, see Microsoft Defender for Endpoint (https://www.microsoft.com/en-us/microsoft-365/windows/microsoft-defender-atp).
The Microsoft Defender for Endpoint schema is made up of multiple tables that provide either event information or information about devices and other entities. To effectively build queries that span multiple tables, you must understand the tables and the columns in the schema.
The following table outlines Microsoft Defender for Endpoint schema table names and descriptions.
Table name | Description |
---|---|
AlertEvents | Alerts on Microsoft Defender Security Center |
MachineInfo | Machine information, including OS information |
MachineNetworkInfo | Network properties of network devices, including adapters, IP addresses, MAC addresses, connected networks, and domains |
ProcessCreationEvents | Process creation and related events |
NetworkCommunicationEvents | Network connection and related events |
FileCreationEvents | File creation, modification, and other file system events |
RegistryEvents | Creation and modification of registry entries |
LogonEvents | Sign-ins and other authentication events |
ImageLoadEvents | DLL loading events |
MiscEvents | Multiple event types, including events that are triggered by security controls such as Windows Defender Antivirus and Exploit Protection |
Procedure
Results
The connector imports data from the data source. The connector imports data source again at the interval that you set in the Frequency field.
You can see the data source connection configuration that you added under Connections on the Assets tab of the Data source settings page. A message on the card indicates connection with the data source.
You can add other connection configurations for this data source that have different users and different data access permissions.
What to do next
Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In Data Explorer, click an IP address to view its associated assets and risk.
To use Data Explorer, you must have data sources that are connected so that the application can run queries and retrieve results across a unified set of data sources. The search results vary depending on the data that is contained in your configured data sources. For more information about how to build a query in Data Explorer, see Build a query.