| 1 | --- |
| 2 | title: Microsoft Defender for Endpoint |
| 3 | description: Ingest Microsoft Defender for Endpoint alerts into the SOCFortress SIEM stack. |
| 4 | --- |
| 5 | |
| 6 | ## What this integration is |
| 7 | |
| 8 | This integration ingests **Microsoft Defender for Endpoint** alerts via the Defender for Endpoint API. |
| 9 | |
| 10 | Vendor reference: |
| 11 | - Get alerts API: https://learn.microsoft.com/en-us/defender-endpoint/api/get-alerts |
| 12 | |
| 13 | --- |
| 14 | |
| 15 | ## Data path (how it flows) |
| 16 | |
| 17 | 1) Microsoft Defender for Endpoint → API polling (OAuth2) |
| 18 | 2) Collector → syslog/ingest into Graylog (implementation-dependent) |
| 19 | 3) Graylog → stream/index/dashboards |
| 20 | |
| 21 | --- |
| 22 | |
| 23 | ## Prerequisites |
| 24 | |
| 25 | - Azure app registration for API access |
| 26 | - API permissions granted: |
| 27 | - `Alert.Read.All` |
| 28 | - `Alert.ReadWrite.All` |
| 29 | |
| 30 | --- |
| 31 | |
| 32 | ## Credentials & config you’ll need |
| 33 | |
| 34 | - Tenant ID |
| 35 | - Client ID |
| 36 | - Client secret |
| 37 | - Token URL: `https://login.microsoftonline.com/<TENANT_ID>/oauth2/token` |
| 38 | - Syslog host/port (Graylog) |
| 39 | |
| 40 | Example (for context; CoPilot provisioning typically fills this): |
| 41 | |
| 42 | ```yaml |
| 43 | filebeat.modules: |
| 44 | - module: microsoft |
| 45 | defender_atp: |
| 46 | enabled: true |
| 47 | var.oauth2.client.id: "CLIENT_ID" |
| 48 | var.oauth2.client.secret: "CLIENT_SECRET" |
| 49 | var.oauth2.token_url: "https://login.microsoftonline.com/TENANT_ID/oauth2/token" |
| 50 | |
| 51 | output.logstash: |
| 52 | hosts: ["REPLACE_SYSLOG_HOST:REPLACE_SYSLOG_PORT"] |
| 53 | ``` |
| 54 | |
| 55 | --- |
| 56 | |
| 57 | ## CoPilot setup (recommended workflow) |
| 58 | |
| 59 | 1) Provision the customer. |
| 60 | 2) Add **Defender for Endpoint** integration under the customer. |
| 61 | 3) Provide tenant/client credentials. |
| 62 | 4) Deploy/start the connector container generated during provisioning. |
| 63 | |
| 64 | Provisioning typically creates: |
| 65 | - Graylog input + stream + index |
| 66 | - Grafana datasource + dashboards |
| 67 | - A customer-specific docker compose + Filebeat config |
| 68 | |
| 69 | --- |
| 70 | |
| 71 | ## Deployment notes (connector container) |
| 72 | |
| 73 | ```bash |
| 74 | docker compose -f /opt/CoPilot/data/data/<CUSTOMER_NAME>/<CUSTOMER_NAME>_docker-compose-defender-for-endpoint.yml up -d |
| 75 | ``` |
| 76 | |
| 77 | --- |
| 78 | |
| 79 | ## Success criteria |
| 80 | |
| 81 | - [ ] Defender alerts are arriving |
| 82 | - [ ] Events are routed to the correct customer index/stream |
| 83 | |
| 84 | --- |
| 85 | |
| 86 | ## Troubleshooting |
| 87 | |
| 88 | - Confirm the Azure app has the required permissions and admin consent. |
| 89 | - Confirm tenant ID/client ID/secret match. |
| 90 | - Check connector logs for OAuth failures. |