Skip to content

Commit

Permalink
Merge pull request #2119 from SEKOIA-IO/chore/MicrosoftDefenderXDRRen…
Browse files Browse the repository at this point in the history
…aming

Microsoft Defender XDR: rename the integration
  • Loading branch information
squioc authored Dec 3, 2024
2 parents 278026a + 526cbb3 commit 72777f2
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 13 deletions.
24 changes: 12 additions & 12 deletions docs/integration/categories/endpoint/microsoft_365_defender.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
uuid: 05e6f36d-cee0-4f06-b575-9e43af779f9f
name: Microsoft 365 Defender
name: Microsoft Defender XDR / Microsoft 365 Defender
type: intake

## Overview
Expand All @@ -11,13 +11,13 @@ type: intake

**This Intake was previously called Microsoft Defender for Endpoints.**

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.
Microsoft Defender XDR (formely Microsoft 365 Defender) is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.

This setup guide describes how to forward events produced by `Microsoft 365 Defender` to Sekoia.io XDR.
This setup guide describes how to forward events produced by `Microsoft Defender XDR` to Sekoia.io XDR.


## Microsoft 365 Defender event types supported
Here is a list of all the Microsoft 365 Defender event types supported by this integration:
## Microsoft Defender XDR event types supported
Here is a list of all the Microsoft Defender XDR event types supported by this integration:

* Alert Evidence
* AlertInfo
Expand All @@ -44,22 +44,22 @@ Please follow [this link](https://learn.microsoft.com/en-us/microsoft-365/securi

## Configure

To forward **Microsoft 365 Defender** events from Microsoft to Sekoia.io you need to send your event to an **Azure Event Hub** where Sekoia.io will collect the events.
To forward **Microsoft Defender XDR** events from Microsoft to Sekoia.io you need to send your event to an **Azure Event Hub** where Sekoia.io will collect the events.
<div style="text-align: center;">
<img width="100%" alt="image" src="/assets/integration/cloud_and_saas/event_hub/consume_azure_logs.png">
</div>

### Prerequisite

You must have the following rights to perform the installation:
- Global Administrator or Security Administrator rights on **Microsoft 365 Defender**
- Global Administrator or Security Administrator rights on **Microsoft Defender XDR**
- Contributor write on **Azure**

{!_shared_content/operations_center/integrations/event_hub.md!}

### Send logs from 365 Defender to Azure Event Hub
### Send logs from Defender XDR to Azure Event Hub

When you have an **Event Hub** follow this guide to send your events from **Microsoft 365 Defender** to the **Event Hub**:
When you have an **Event Hub** follow this guide to send your events from **Microsoft Defender XDR** to the **Event Hub**:

1. Open the **Microsoft 365 Security** App portal as a *Global Administrator* or *Security Administrator*.
2. On the left panel, select **Settings**.
Expand All @@ -69,11 +69,11 @@ When you have an **Event Hub** follow this guide to send your events from **Micr
6. To export the event data to a single **Event Hub**, enter your **Event Hub** name and your **Event Hub Namespace** resource ID. **Be sure to take the event hub namespace ID and not the event hub ID.**
7. To get your **Event Hub Namespace** resource ID, go to your **Azure Event Hub Namespace** page on Azure > Properties tab > copy the text under Resource ID:
(e.g. `/subscriptions/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX/resourceGroups/resourcegroupname/providers/Microsoft.EventHub/namespaces/namespacename`).
8. Go to the supported **Microsoft 365 Defender** event types in event streaming API to review the support status of event types in the Microsoft 365 Streaming API.
8. Go to the supported **Microsoft Defender XDR** event types in event streaming API to review the support status of event types in the Microsoft 365 Streaming API.
9. Choose the events you want to stream and click Save.

!!! Disclamer
Be sure to size your eventhub ressources accordingly to the number of EPS you have (number of eventhubs, throughput, partitions...) See the Further readings section in order to estimate the number of event per second **Microsoft 365 Defender** can be on your instance.
Be sure to size your eventhub ressources accordingly to the number of EPS you have (number of eventhubs, throughput, partitions...) See the Further readings section in order to estimate the number of event per second **Microsoft Defender xDR** can be on your instance.


{!_shared_content/operations_center/integrations/generated/05e6f36d-cee0-4f06-b575-9e43af779f9f_sample.md!}
Expand All @@ -86,7 +86,7 @@ When you have an **Event Hub** follow this guide to send your events from **Micr

#### Further Readings
- [Estimating initial Event Hub capacity](https://learn.microsoft.com/en-us/microsoft-365/security/defender/streaming-api-event-hub?view=o365-worldwide#estimating-initial-event-hub-capacity)
- [Configure Microsoft 365 Defender to stream Advanced Hunting events to your Azure Event Hub](https://docs.microsoft.com/en-us/microsoft-365/security/defender/streaming-api-event-hub)
- [Configure Microsoft Defender XDR to stream Advanced Hunting events to your Azure Event Hub](https://docs.microsoft.com/en-us/microsoft-365/security/defender/streaming-api-event-hub)

### Create the intake

Expand Down
2 changes: 1 addition & 1 deletion mkdocs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -346,7 +346,7 @@ nav:
- Kaspersky Endpoint Security: integration/categories/endpoint/kaspersky_endpoint_security.md
- Linux AuditBeat: integration/categories/endpoint/auditbeat_linux.md
- Log Insight Windows: integration/categories/endpoint/log_insight_windows.md
- Microsoft 365 Defender: integration/categories/endpoint/microsoft_365_defender.md
- Microsoft Defender XDR (Microsoft 365 Defender): integration/categories/endpoint/microsoft_365_defender.md
- Microsoft Intune: integration/categories/endpoint/microsoft_intune.md
- Palo Alto Cortex XDR (EDR): integration/categories/endpoint/paloalto_cortex_edr.md
- Panda Security Aether: integration/categories/endpoint/panda_security_aether.md
Expand Down

0 comments on commit 72777f2

Please sign in to comment.