Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Microsoft Defender - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="microsoft-defender-for-endpoint-jupiterone-integration-benefits">Microsoft Defender for Endpoint + JupiterOne Integration Benefits</h2> <ul><li>Visualize Microsoft Defender for Endpoint resources in the JupiterOne graph.</li> <li><p>Map Microsoft Defender for Endpoint users to employees in your JupiterOne<br> account.</p></li> <li><p>Monitor changes to Microsoft Defender for Endpoint users using JupiterOne<br> alerts.</p></li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>JupiterOne periodically fetches resources from Microsoft Defender for Endpoint<br> to update the graph.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph, or<br> leverage existing queries.</p></li> <li><p>Configure alerts to take action when JupiterOne graph changes, or leverage<br> existing alerts.</p></li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li><p>An Azure account with an App Registration that will provide credentials for<br> the integration to authenticate with Microsoft Graph APIs. The App<br> Registration also defines the permissions the integration requires and which<br> the target tenant must authorize.</p></li> <li><p>An Active Directory tenant to target for ingestion. It is possible to target<br> the Active Directory tenants defined in the Azure account holding the App<br> Registration.</p></li> <li><p>A Microsoft Defender for Endpoint account to create devices and run attacks<br> via simulation technique. Can track vulnerabilities data, user groups creation<br> and mapping users to devices.</p></li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h3 data-id="in-microsoft-defender-for-endpoint">In Microsoft Defender for Endpoint</h3> <ol><li><a rel="nofollow" href="https://www.microsoft.com/en-us/security/business/threat-protection/endpoint-defender">Create a Microsoft Defender for Endpoint account</a></li> <li>Add devices</li> </ol><p>In the Azure portal:</p> <h3 data-id="create-a-new-app-registration">Create a new app registration</h3> <ol><li>Navigate to<br><a rel="nofollow" href="https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade">App Registrations</a></li> <li>Click <code class="code codeInline" spellcheck="false" tabindex="0">New Registration</code></li> </ol><ul><li>Enter a name</li> <li>Select the supported account type</li> <li>Click <code class="code codeInline" spellcheck="false" tabindex="0">Register</code></li> </ul><h3 data-id="add-api-permissions">Add API permissions</h3> <p>In your new app registration, go to <strong>API Permissions</strong> under <strong>Manage</strong> on the<br> left side panel.</p> <ul><li><p>If your app has already been assigned the <code class="code codeInline" spellcheck="false" tabindex="0">User.Read</code> permission, remove it<br> using the context menu. It is not needed for the integration to run.</p> <ul><li>If a warning appears saying "This scope is required for proper application<br> functionality.", it can be safely ignored.</li> </ul></li> <li><p>Click <code class="code codeInline" spellcheck="false" tabindex="0">Add a permission</code></p></li> <li>Click <code class="code codeInline" spellcheck="false" tabindex="0">Microsoft Graph</code></li> <li><p>When presented with <strong>What type of permissions does your application<br> require?</strong>, select <strong>Application permissions</strong>.</p> <ul><li>Add the <code class="code codeInline" spellcheck="false" tabindex="0">Organization.Read.All</code> permission</li> <li>Add the <code class="code codeInline" spellcheck="false" tabindex="0">Directory.Read.All</code> permission</li> <li>Press <code class="code codeInline" spellcheck="false" tabindex="0">Add permissions</code></li> </ul></li> <li><p>Now, click <code class="code codeInline" spellcheck="false" tabindex="0">Add a permission</code> again.</p></li> <li><p>Under <code class="code codeInline" spellcheck="false" tabindex="0">APIs my organization uses</code> search <strong>WindowsDefenderATP</strong> and click the<br> result.</p></li> <li><p>When presented with <strong>What type of permissions does your application<br> require?</strong>, select <strong>Application permissions</strong></p> <ul><li>Add the <code class="code codeInline" spellcheck="false" tabindex="0">Machine.Read.All</code> permission</li> <li>Add the <code class="code codeInline" spellcheck="false" tabindex="0">User.Read.All</code> permission</li> <li>Add the <code class="code codeInline" spellcheck="false" tabindex="0">Vulnerability.Read.All</code> permission</li> <li>Press <code class="code codeInline" spellcheck="false" tabindex="0">Add permission</code></li> </ul></li> <li><p>Now, <code class="code codeInline" spellcheck="false" tabindex="0">Grant admin consent</code> for the API permissions.</p></li> </ul><h3 data-id="add-client-secret">Add Client Secret</h3> <p>In your app registration, click <strong>Certificates & secrets</strong></p> <ul><li><p>Under <strong>Client Secrets</strong>, click <code class="code codeInline" spellcheck="false" tabindex="0">New client secret</code></p> <ul><li>Add a description for the secret</li> <li>Select a secret expiration that matches your needs for secret rotation</li> <li>Click <code class="code codeInline" spellcheck="false" tabindex="0">Add</code></li> </ul></li> <li><p>Copy the secret <code class="code codeInline" spellcheck="false" tabindex="0">Value</code> using the <code class="code codeInline" spellcheck="false" tabindex="0">Copy to Clipboard</code> icon. (Highlighting and<br> copying will not copy the full value)</p></li> </ul><h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Microsoft Defender for Endpoint</strong> integration tile and click<br> it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this Microsoft<br> Defender for Endpoint account in JupiterOne. Ingested entities will have this<br> value stored in <code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Fill the <strong>Client Secret</strong> value in with the secret <code class="code codeInline" spellcheck="false" tabindex="0">Value</code> you copied<br> earlier.</p></li> <li><p>Using data from you <strong>App Registration's</strong> Overview tab, fill the <strong>Tenant</strong><br> (Directory (tenant) ID) and <strong>Client ID</strong> (Application (client) ID).</p></li> </ul><ol start="4"><li>Click <strong>Create</strong> once all values are provided.</li> </ol><h2 data-id="api-permissions">API Permissions</h2> <h3 data-id="microsoft-graph">Microsoft Graph</h3> <ol><li><code class="code codeInline" spellcheck="false" tabindex="0">Organization.Read.All</code> <ol><li>Read organization information</li> <li>Needed for creating the <code class="code codeInline" spellcheck="false" tabindex="0">Account</code> entity</li> </ol></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">Directory.Read.All</code> <ol><li>Read directory data</li> <li>Needed for creating <code class="code codeInline" spellcheck="false" tabindex="0">User</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Group</code>, and <code class="code codeInline" spellcheck="false" tabindex="0">GroupUser</code> entities</li> </ol></li> </ol><h3 data-id="windowsdefenderatp">WindowsDefenderATP</h3> <ol><li><code class="code codeInline" spellcheck="false" tabindex="0">Machine.Read.All</code> <ol><li>Read machine information</li> <li>Needed for creating <code class="code codeInline" spellcheck="false" tabindex="0">Device</code> and <code class="code codeInline" spellcheck="false" tabindex="0">HostAgent</code> entities</li> </ol></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">User.Read.All</code> <ol><li>Read user profiles</li> <li>Needed for creating <code class="code codeInline" spellcheck="false" tabindex="0">User</code> entities</li> </ol></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">Vulnerability.Read.All</code> <ol><li>Read Threat and Vulnerability Management vulnerability information</li> <li>Needed for creating <code class="code codeInline" spellcheck="false" tabindex="0">Vulnerability</code> entity</li> </ol></li> </ol><h1 data-id="how-to-uninstall">How to Uninstall</h1> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Microsoft Defender for Endpoint</strong> integration tile and click<br> it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><p><br></p> <h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>Device/Machine/Host</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">user_endpoint</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Device</code></td> </tr><tr><td>Logon User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_logon_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr><tr><td>Machine</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_machine</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HostAgent</code></td> </tr><tr><td>User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr><tr><td>Vulnerability</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_vulnerability</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_machine</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_machine</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_logon_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_machine</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_vulnerability</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_machine</code></td> <td><strong>MANAGES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">user_endpoint</code></td> </tr></tbody></table><h3 data-id="mapped-relationships">Mapped Relationships</h3> <p>The following mapped relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Direction</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">microsoft_defender_vulnerability</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*cve*</code></td> <td>FORWARD</td> </tr></tbody></table><p><br></p> </article> </main>
.png)