You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/external-attack-surface-management/data-connections.md
+13-16Lines changed: 13 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,8 @@ To accurately present the infrastructure that matters most to your organization,
37
37
The Asset Data option will send data about all your inventory assets to the tool of your choice. This option is best for use cases where the granular underlying metadata is key to the operationalization of your Defender EASM integration (e.g. Sentinel, customized reporting in Data Explorer). Users can export high-level context on every asset in inventory as well as granular details specific to the particular asset type. This option does not provide any pre-determined insights about the assets; instead, it offers an expansive amount of data so users can surface the customized insights they care about most.
38
38
39
39
40
-
**Attack surface insights**
40
+
**Attack surface insights**
41
+
41
42
Attack Surface Insights provide an actionable set of results based on the key insights delivered through dashboards in Defender EASM. This option provides less granular metadata on each asset; instead, it categorizes assets based on the corresponding insight(s) and provides the high-level context required to investigate further. This option is ideal for those who want to integrate these pre-determined insights into custom reporting workflows in conjunction with data from other tools.
42
43
43
44
## **Configuring data connections**
@@ -46,8 +47,7 @@ Attack Surface Insights provide an actionable set of results based on the key in
46
47
**Accessing data connections**
47
48
Users can access Data Connections from the **Manage** section of the left-hand navigation pane within their Defender EASM resource blade. This page displays the data connectors for both Log Analytics and Azure Data Explorer, listing any current connections and providing the option to add, edit or remove connections.
48
49
49
-
50
-
50
+
51
51
52
52
53
53
**Connection prerequisites**
@@ -57,13 +57,13 @@ To successfully create a data connection, users must first ensure that they have
57
57
58
58
1. Open the Log Analytics workspace that will ingest your Defender EASM data, or [create a new workspace](/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal).
59
59
1. Select **Access control (IAM)** from the left-hand navigation pane. For more information on access control, see [identity documentation](/azure/cloud-adoption-framework/decision-guides/identity/).
60
-
60
+
61
61
62
62
1. On this page, select **+Add** to create a new role assignment.
63
63
1.1. From the **Role** tab, select **Contributor**. Click **Next**.
64
64
1. Open the **Members** tab. Click **+ Select members** to open a configuration pane. Search for **“EASM API”** and click on the value in the members list. Once done, click **Select**, then **Review + assign.**
65
65
1. Once the role assignment has been created, select **Agents** from the **Settings** section of the left-hand navigation menu.
66
-
66
+
67
67
68
68
1. Expand the **Log Analytics agent instructions** section to view your Workspace ID and Primary key. These values will be used to set up your data connection. Save the values in the following format: *WorkspaceId=XXX;ApiKey=YYY*
69
69
@@ -72,14 +72,14 @@ To successfully create a data connection, users must first ensure that they have
72
72
1. Open the Data Explorer cluster that will ingest your Defender EASM data or [create a new cluster](/azure/data-explorer/create-cluster-database-portal).
73
73
1. Select **Databases** in the Data section of the left-hand navigation menu.
74
74
1. Select **+ Add Database** to create a database to house your Defender EASM data.
75
-
75
+
76
76
77
77
1. Name your database, configure retention and cache periods, then select **Create**.
78
-
78
+
79
79
80
80
1. Once your Defender EASM database has been created, click on the database name to open the details page. Select **Permissions** from the Overview section of the left-hand navigation menu.
81
-
To successfully export Defender EASM data to Data Explorer, users must create two new permissions for the EASM API: **user** and **ingestor**.
82
-
81
+
To successfully export Defender EASM data to Data Explorer, users must create two new permissions for the EASM API: **user** and **ingestor**.
82
+
83
83
84
84
1. First, select **+ Add** and create a user. Search for “**EASM API**”, select the value then click **Select**.
85
85
1. Select **+ Add** to create an ingestor. Follow the same steps outlined above to add the **"EASM API"** as an ingestor.
@@ -95,11 +95,7 @@ A configuration pane will open on the right-hand side of the Data Connections sc
95
95
-**Name**: enter a name for this data connection.
96
96
-**Connection String**: enter the details required to connect your Defender EASM resource to another tool. For Log Analytics, users enter the workspaceID and coinciding API key associated to their account. For Azure Data Explorer, users enter the cluster name, region and database name associated to their account. Both values must be entered in the format shown when the field is blank.
97
97
-**Content**: users can select to integrate asset data, attack surface insights or both datasets.
98
-
--**Frequency**: select the frequency that the Defender EASM connection sends updated data to the tool of your choice. Available options are daily, weekly and monthly.
99
-
100
-
101
-
102
-
98
+
-**Frequency**: select the frequency that the Defender EASM connection sends updated data to the tool of your choice. Available options are daily, weekly and monthly.
103
99
Once all four fields are configured, select **Add** to create the data connection. At this point, the Data Connections page will display a banner that indicates the resource has been successfully created and data will begin populating within 30 minutes. Once connections are created, they will be listed under the applicable tool on the main Data Connections page.
104
100
105
101
@@ -110,13 +106,13 @@ Users can edit or delete a data connection. For example, you may notice that a c
110
106
To edit or delete a data connection:
111
107
112
108
1. Select the appropriate connection from the list on the main Data Connections page.
113
-
109
+
114
110
115
111
1. This action will open a page that provides additional data about the connection. This page displays the configurations you elected when creating the connection, as well as any error messages. Users will also see the following additional data:
116
112
• **Recurring on**: the day of the week or month that Defender EASM sends updated data to the connected tool.
117
113
• **Created**: the date and time that the data connection was created.
118
114
• **Updated**: the date and time that the data connection was last updated.
119
-
115
+
120
116
121
117
1. From this page, users can elect to reconnect, edit or delete their data connection.
122
118
• **Reconnect**: this option attempts to validate the data connection without any changes to the configuration. This option is best for those who have validated the authentication credentials used for the data connection.
@@ -127,3 +123,4 @@ To edit or delete a data connection:
0 commit comments