You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/external-attack-surface-management/data-connections.md
+12-16Lines changed: 12 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,9 +13,7 @@ ms.topic: how-to
13
13
ms.date: 03/20/2023
14
14
---
15
15
16
-
# Defender EASM Data Connections
17
-
18
-
16
+
# Defender EASM data connections
19
17
20
18
## **Overview**
21
19
@@ -29,7 +27,7 @@ The data connector sends Defender EASM asset data to two different platforms: Mi
29
27
30
28
31
29
**Data content options**
32
-
Defender EASM Data Connections offers users the ability to integrate two different kinds of attack surface data into the tool of their choice. Users can elect to migrate asset data, attack surface insights or both data types. Asset data provides granular details about your entire inventory, whereas attack surface insights provide immediately actionable insights based on Defender EASM dashboards.
30
+
Defender EASM data connections offers users the ability to integrate two different kinds of attack surface data into the tool of their choice. Users can elect to migrate asset data, attack surface insights or both data types. Asset data provides granular details about your entire inventory, whereas attack surface insights provide immediately actionable insights based on Defender EASM dashboards.
33
31
34
32
To accurately present the infrastructure that matters most to your organization, please note that both content options will only include assets in the “Approved Inventory” state.
35
33
@@ -48,24 +46,24 @@ Attack Surface Insights provide an actionable set of results based on the key in
48
46
**Accessing data connections**
49
47
Users can access Data Connections from the **Manage** section of the left-hand navigation pane within their Defender EASM resource blade. This page displays the data connectors for both Log Analytics and Azure Data Explorer, listing any current connections and providing the option to add, edit or remove connections.
50
48
51
-
49
+
52
50
53
51
54
52
55
53
**Connection prerequisites**
56
54
To successfully create a data connection, users must first ensure that they have completed the required steps to grant Defender EASM permission to the tool of their choice. This process enables the application to ingest our exported data and provides the authentication credentials needed to configure the connection.
57
55
58
-
59
56
**Configuring Log Analytics permissions via UI**
60
57
61
58
1. Open the Log Analytics workspace that will ingest your Defender EASM data, or [create a new workspace](/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal).
62
59
1. Select **Access control (IAM)** from the left-hand navigation pane. For more information on access control, see [identity documentation](/azure/cloud-adoption-framework/decision-guides/identity/).
63
-
60
+
64
61
65
62
1. On this page, select **+Add** to create a new role assignment.
66
63
1.1. From the **Role** tab, select **Contributor**. Click **Next**.
67
64
1. Open the **Members** tab. Click **+ Select members** to open a configuration pane. Search for **“EASM API”** and click on the value in the members list. Once done, click **Select**, then **Review + assign.**
68
65
1. Once the role assignment has been created, select **Agents** from the **Settings** section of the left-hand navigation menu.
66
+
69
67
70
68
1. Expand the **Log Analytics agent instructions** section to view your Workspace ID and Primary key. These values will be used to set up your data connection. Save the values in the following format: *WorkspaceId=XXX;ApiKey=YYY*
71
69
@@ -74,14 +72,12 @@ To successfully create a data connection, users must first ensure that they have
74
72
1. Open the Data Explorer cluster that will ingest your Defender EASM data or [create a new cluster](/azure/data-explorer/create-cluster-database-portal).
75
73
1. Select **Databases** in the Data section of the left-hand navigation menu.
76
74
1. Select **+ Add Database** to create a database to house your Defender EASM data.
77
-
75
+
78
76
79
77
1. Name your database, configure retention and cache periods, then select **Create**.
80
-
78
+
81
79
82
80
1. Once your Defender EASM database has been created, click on the database name to open the details page. Select **Permissions** from the Overview section of the left-hand navigation menu.
83
-
84
-
85
81
To successfully export Defender EASM data to Data Explorer, users must create two new permissions for the EASM API: **user** and **ingestor**.
86
82
1. First, select **+ Add** and create a user. Search for “**EASM API**”, select the value then click **Select**.
87
83
1. Select **+ Add** to create an ingestor. Follow the same steps outlined above to add the **"EASM API"** as an ingestor.
@@ -97,11 +93,11 @@ A configuration pane will open on the right-hand side of the Data Connections sc
97
93
-**Name**: enter a name for this data connection.
98
94
-**Connection String**: enter the details required to connect your Defender EASM resource to another tool. For Log Analytics, users enter the workspaceID and coinciding API key associated to their account. For Azure Data Explorer, users enter the cluster name, region and database name associated to their account. Both values must be entered in the format shown when the field is blank.
99
95
-**Content**: users can select to integrate asset data, attack surface insights or both datasets.
100
-
-**Frequency**: select the frequency that the Defender EASM connection sends updated data to the tool of your choice. Available options are daily, weekly and monthly.
101
-
102
-
-
96
+
--**Frequency**: select the frequency that the Defender EASM connection sends updated data to the tool of your choice. Available options are daily, weekly and monthly.
103
97
98
+
104
99
100
+
105
101
Once all four fields are configured, select **Add** to create the data connection. At this point, the Data Connections page will display a banner that indicates the resource has been successfully created and data will begin populating within 30 minutes. Once connections are created, they will be listed under the applicable tool on the main Data Connections page.
106
102
107
103
@@ -112,13 +108,13 @@ Users can edit or delete a data connection. For example, you may notice that a c
112
108
To edit or delete a data connection:
113
109
114
110
1. Select the appropriate connection from the list on the main Data Connections page.
115
-
111
+
116
112
117
113
1. This action will open a page that provides additional data about the connection. This page displays the configurations you elected when creating the connection, as well as any error messages. Users will also see the following additional data:
118
114
• **Recurring on**: the day of the week or month that Defender EASM sends updated data to the connected tool.
119
115
• **Created**: the date and time that the data connection was created.
120
116
• **Updated**: the date and time that the data connection was last updated.
121
-
117
+
122
118
123
119
1. From this page, users can elect to reconnect, edit or delete their data connection.
124
120
• **Reconnect**: this option attempts to validate the data connection without any changes to the configuration. This option is best for those who have validated the authentication credentials used for the data connection.
0 commit comments