Microsoft 365 Defender

This document describes how to integrate Microsoft 365 Defender with Google Security Operations (Google SecOps).

Integration version: 19.0

Use cases

Integrating Microsoft 365 Defender with Google SecOps can help you solve the following use cases:

• Automated incident response:use the Google SecOps capabilities to automatically isolate the affected endpoint and initiate a scan for further compromise.

• Phishing investigation and remediation:use the Google SecOps capabilities to automatically extract relevant information, such as the sender, subject, and attachments, and enrich it with threat intelligence data.

• Vulnerability management:use the Google SecOps capabilities to automate vulnerability scanning and remediation workflows.

• Compliance reporting and auditing:use the Google SecOps capabilities to automate the collecting and reporting of security data from Microsoft 365 Defender, simplifying compliance audits, and demonstrating adherence to security standards.

• Alert prioritization and triage:use the Google SecOps capabilities to analyze alerts from Microsoft 365 Defender and prioritize them based on severity and potential impact.

• Automated malware analysis:use the Google SecOps capabilities to automatically submit the sample of a malware that Microsoft 365 Defender has detected to a sandbox environment for dynamic analysis.

Before you begin

Before configuring the integration in the Google SecOps platform, complete the following steps:

1. Create the Microsoft Entra application.

2. Configure the API permissions for your app.

3. Create a client secret.

Create the Microsoft Entra application

To create the Microsoft Entra application, complete the following steps:

1. Sign in to the Azure portal as a user administrator or a password administrator.

2. Select Microsoft Entra ID.

3. Go to App registrations > New registration.

4. Enter the name of the application.

5. Click Register.

6. Save the Application (client) IDand Directory (tenant) IDvalues to use them later when configuring the integration parameters.

Configure the API permissions

To configure the API permissions for the integration, complete the following steps:

1. In the Azure portal, go to Manage > API Permissions > Add a permission.

2. In the Request API permissionswindow, select APIs my organization uses.

3. Select Microsoft Graph > Application permissions.

4. Select the following permissions:

   • SecurityAlert.Read.All
   • SecurityIncident.ReadWrite.All

5. Click Add permissions.

6. In the Request API permissionswindow, select APIs my organization uses.

7. Select Microsoft Threat Protection > Application permissions.

8. Select the following permission:

   • ThreatHunting.Read.All

9. Click Add permissions.

10. Click Grant admin consent for YOUR_ORGANIZATION_NAME .

    When the Grant admin consent confirmationdialog appears, click Yes.

Create a client secret

To create a client secret, complete the following steps:

1. Navigate to Certificates and secrets > New client secret.

2. Provide a description for a client secret and set its expiration deadline.

3. Click Add.

4. Save the value of the client secret (not the secret ID) to use it as the Client Secret parameter value when configuring the integration.

   The client secret value is only displayed once.

Integrate Microsoft 365 Defender with Google SecOps

The Microsoft 365 Defender integration requires the following parameters:

For instructions about configuring an integration in Google SecOps, see Configure integrations .

You can make changes at a later stage if needed. After you configure an integration instance, you can use it in playbooks. For more information about configuring and supporting multiple instances, see Supporting multiple instances .

Actions

For more information about actions, see Respond to pending actions from your workdesk and Perform a manual action .

Add Comment To Incident

Use the Add Comment To Incidentaction to add a comment to an incident in Microsoft 365 Defender.

This action doesn't run on Google SecOps entities.

Action inputs

The Add Comment To Incidentaction requires the following parameters:

Action outputs

The Add Comment To Incidentaction provides the following outputs:

Output messages

The Add Comment To Incidentaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add Comment To Incidentaction:

Execute Custom Query

Use the Execute Custom Queryaction to execute a custom hunting query in Microsoft 365 Defender.

This action doesn't run on Google SecOps entities.

Action inputs

The Execute Custom Queryaction requires the following parameters:

Action outputs

The Execute Custom Queryaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Execute Custom Queryaction:

  { 
 "Results" 
 : 
  
 [ 
  
 { 
  
 "Timestamp" 
 : 
  
 "2021-04-12T07:25:00Z" 
 , 
  
 "AlertId" 
 : 
  
 "fa7a318954-6c4c-eaab-3200-08d8fd82af35" 
 , 
  
 "Title" 
 : 
  
 "CC_Sensitive information" 
 , 
  
 "Category" 
 : 
  
 "InitialAccess" 
 , 
  
 "Severity" 
 : 
  
 "Medium" 
 , 
  
 "ServiceSource" 
 : 
  
 "Microsoft Defender for Office 365" 
 , 
  
 "DetectionSource" 
 : 
  
 "Microsoft Defender for Office 365" 
 , 
  
 "AttackTechniques" 
 : 
  
 "" 
  
 } 
 ]} 
 

Output messages

The Execute Custom Queryaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Execute Custom Queryaction:

Execute Entity Query

Use the Execute Entity Queryaction to execute a hunting query that is based on entities in Microsoft 365 Defender.

This action uses a where filter that is based on entities.

This action runs on the following Google SecOps entities:

• IP Address
• Host
• User
• Hash
• URL

You can use the Execute Entity Queryaction to retrieve information that is related to entities, such as retrieve the results from a table and filter the results based on entities.

Unlike the Execute Query action that requires you to use specific formatting, the Execute Entity Queryaction doesn't use the query input.

When using the Execute Queryaction to retrieve the alerts that are related to an endpoint, format the | where clause as follows:

 AlertInfo | where DeviceName == "Host-1" or IPAddress == "192.0.2.1" | top 100
by Timestamp desc 

To retrieve the alerts that are related to an endpoint, the Execute Entity Queryaction requires you to configure the Table , IP Entity Key , Hostname Entity Key , and Cross Entity Operator parameters as follows:

To check how many endpoints the provided hashes affect, the Execute Entity Queryaction requires you to enter the SHA1 value for the File Hash Entity Key parameter.

The Cross Entity Operator only impacts the query when you configure multiple values for the Entity Keys parameter.

Action inputs

The Execute Entity Queryaction requires the following parameters:

Action outputs

The Execute Entity Queryaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Execute Entity Queryaction:

   
 { 
  
 "Timestamp" 
 : 
  
 "2021-04-12T07:25:00Z" 
 , 
  
 "AlertId" 
 : 
  
 "fa7a318954-6c4c-eaab-3200-08d8fd82af35" 
 , 
  
 "Title" 
 : 
  
 "CC_Sensitive information" 
 , 
  
 "Category" 
 : 
  
 "InitialAccess" 
 , 
  
 "Severity" 
 : 
  
 "Medium" 
 , 
  
 "ServiceSource" 
 : 
  
 "Microsoft Defender for Office 365" 
 , 
  
 "DetectionSource" 
 : 
  
 "Microsoft Defender for Office 365" 
 , 
  
 "AttackTechniques" 
 : 
  
 "" 
  
 } 
 

Output messages

The Execute Entity Queryaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Execute Entity Queryaction:

Execute Query

Use the Execute Queryaction to execute hunting queries in Microsoft 365 Defender.

This action doesn't run on Google SecOps entities.

Action inputs

The Execute Queryaction requires the following parameters:

Action outputs

The Execute Queryaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Execute Queryaction:

  { 
 "Results" 
 : 
  
 [ 
  
 { 
  
 "Timestamp" 
 : 
  
 "2021-04-12T07:25:00Z" 
 , 
  
 "AlertId" 
 : 
  
 "fa7a318954-6c4c-eaab-3200-08d8fd82af35" 
 , 
  
 "Title" 
 : 
  
 "CC_Sensitive information" 
 , 
  
 "Category" 
 : 
  
 "InitialAccess" 
 , 
  
 "Severity" 
 : 
  
 "Medium" 
 , 
  
 "ServiceSource" 
 : 
  
 "Microsoft Defender for Office 365" 
 , 
  
 "DetectionSource" 
 : 
  
 "Microsoft Defender for Office 365" 
 , 
  
 "AttackTechniques" 
 : 
  
 "" 
  
 } 
 ]} 
 

Output messages

The Execute Queryaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Execute Queryaction:

Ping

Use the Pingaction to test the connectivity to Microsoft 365 Defender.

The action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Pingaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Pingaction:

Output messages

The Pingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Pingaction:

Update Incident

Use the Update Incidentaction to update incidents in Microsoft 365 Defender.

Following the API limitations, this action doesn't fail even if you set an invalid username value to the Assign To parameter.

This action doesn't run on Google SecOps entities.

Action inputs

The Update Incidentaction requires the following parameters:

Action outputs

The Update Incidentaction provides the following outputs:

Output messages

The Update Incidentaction can return the following output messages:

Connectors

For detailed instructions on how to configure a connector in Google SecOps, see Ingest your data (connectors) .

Microsoft 365 Defender – Incidents Connector

Use the Microsoft 365 Defender – Incidents Connectorto pull information about incidents and their related alerts from Microsoft 365 Defender.

The dynamic list works with an incident name.

Connector limitations

The Microsoft 365 Defender – Incidents Connectoruses the API requests with strict API limits. To stabilize the connector, set the Max Incidents To Fetch parameter to 10 and the Run Every parameter to 1 minute . You can still reach the rate limit because the Microsoft Graph API endpoint that is used to fetch alerts only allows 20 requests for every minute.

To prevent data loss at reaching the rate limit, the connector stops processing the current incident and waits for 90 seconds before processing any other incident. In 90 seconds, the rate limit returns to its maximum value and the connector reprocesses the incident that was not properly processed in the previous iteration.

Connector inputs

The Microsoft 365 Defender – Incidents Connectorrequires the following parameters:

Connector rules

• The connector supports proxies.
• The connector supports the dynamic lists and blocklists.

Need more help? Get answers from Community members and Google SecOps professionals.