You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/external-attack-surface-management/data-connections-overview.md
+56-42Lines changed: 56 additions & 42 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,15 +13,14 @@ ms.topic: how-to
13
13
14
14
Microsoft Defender External Attack Surface Management (Defender EASM) now offers data connections to help users seamlessly integrate their attack surface data into other Microsoft solutions to supplement existing workflows with new insights. Users must get data from Defender EASM into the other security tools they use for remediation purposes to best operationalize their attack surface data.
15
15
16
-
17
-
18
16
The data connector sends Defender EASM asset data to two different platforms: Microsoft Log Analytics and Azure Data Explorer. Users need to be active customers to export Defender EASM data to either tool, and data connections are subject to the pricing model for each respective platform.
19
17
20
18
[Microsoft Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview) provides SIEM (security information and event management) and SOAR (security orchestration, automation and response) capabilities. Defender EASM asset or insights information can be used in Log Analytics to enrich existing workflows in conjunction with other security data. This information can supplement firewall and configuration information, threat intelligence, compliance data and more to provide visibility into your external-facing infrastructure on the open internet. Users can create or enrich security incidents, build investigation playbooks, train machine learning algorithms, or trigger remediation actions.
21
19
22
20
[Azure Data Explorer](https://learn.microsoft.com/azure/data-explorer/data-explorer-overview) is a big data analytics platform that helps users analyze high volumes of data from various sources with flexible customization capabilities. Defender EASM asset and insights data can be integrated to leverage visualization, query, ingestion and management capabilities within the platform. Whether building custom reports with Power BI or hunting for assets that match precise KQL queries, exporting Defender EASM data to Azure Data Explorer enables users to leverage their attack surface data with endless customization potential.
23
21
24
-
22
+
23
+
25
24
26
25
27
26
## Data content options
@@ -41,65 +40,76 @@ The Asset Data option will send data about all your inventory assets to the tool
41
40
Attack Surface Insights provide an actionable set of results based on the key insights delivered through dashboards in Defender EASM. This option provides less granular metadata on each asset; instead, it categorizes assets based on the corresponding insight(s) and provides the high-level context required to investigate further. This option is ideal for those who want to integrate these pre-determined insights into custom reporting workflows in conjunction with data from other tools.
42
41
43
42
43
+
44
+
44
45
## Configuring data connections
45
46
46
47
### Accessing data connections
47
48
48
49
Users can access Data Connections from the **Manage** section of the left-hand navigation pane within their Defender EASM resource blade. This page displays the data connectors for both Log Analytics and Azure Data Explorer, listing any current connections and providing the option to add, edit or remove connections.
49
50
50
-
51
+
52
+
53
+
51
54
52
55
53
56
### Connection prerequisites
54
57
55
58
To successfully create a data connection, users must first ensure that they have completed the required steps to grant Defender EASM permission to the tool of their choice. This process enables the application to ingest our exported data and provides the authentication credentials needed to configure the connection.
56
59
60
+
61
+
62
+
57
63
#### Configuring Log Analytics permissions
58
64
59
-
1. Open the Log Analytics workspace that will ingest your Defender EASM data, or [create a new workspace](https://learn.microsoft.com/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal).
65
+
1. Open the Log Analytics workspace that will ingest your Defender EASM data, or [create a new workspace](https://learn.microsoft.com/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal).
66
+
67
+
2. Select **Access control (IAM)** from the left-hand navigation pane. For more information on access control, see [identity documentation](https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/identity/).
68
+
69
+
60
70
61
-
2. Select **Access control (IAM)** from the left-hand navigation pane. For more information on access control, see [identity documentation](https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/identity/).
71
+
3. On this page, select **+Add** to create a new role assignment.
62
72
63
-
73
+
4. From the **Role** tab, select **Contributor**. Click **Next**.
64
74
65
-
3. On this page, select **+Add** to create a new role assignment.
75
+
5. Open the **Members** tab. Click **+Select members** to open a configuration pane. Search for **EASM-API** and click on the value in the members list. Once done, click **Select**, then **Review + assign**.
66
76
67
-
4. From the **Role** tab, select **Contributor**. Click **Next**.
77
+
6. Once the role assignment has been created, select **Agents** from the **Settings** section of the left-hand navigation menu.
68
78
69
-
5. Open the **Members** tab. Click **+Select members** to open a configuration pane. Search for **EASM-API** and click on the value in the members list. Once done, click **Select**, then **Review + assign**.
79
+
70
80
71
-
6. Once the role assignment has been created, select **Agents** from the **Settings** section of the left-hand navigation menu.
81
+
7. Expand the **Log Analytics agent instructions** section to view your Workspace ID and Primary key. These values will be used to set up your data connection. Save the values in the following format: WorksapceId=XXX;ApiKey=YYY
72
82
73
-
74
83
75
-
7. Expand the **Log Analytics agent instructions** section to view your Workspace ID and Primary key. These values will be used to set up your data connection. Save the values in the following format: WorksapceId=XXX;ApiKey=YYY
76
84
77
85
78
86
#### Configuring Data Explorer permissions
79
87
80
-
1. Open the Data Explorer cluster that will ingest your Defender EASM data or [create a new cluster](https://learn.microsoft.com/azure/data-explorer/create-cluster-database-portal).
88
+
1.Open the Data Explorer cluster that will ingest your Defender EASM data or [create a new cluster](https://learn.microsoft.com/azure/data-explorer/create-cluster-database-portal).
81
89
82
-
2. Select **Databases** in the Data section of the left-hand navigation menu.
90
+
2.Select **Databases** in the Data section of the left-hand navigation menu.
83
91
84
-
3. Select **+Add Database** to create a database to house your Defender EASM data.
92
+
3.Select **+Add Database** to create a database to house your Defender EASM data.
85
93
86
-
94
+
87
95
88
-
4. Name your database, configure retention and cache periods, then select **Create**.
96
+
4.Name your database, configure retention and cache periods, then select **Create**.
89
97
90
-
98
+
91
99
92
-
5. Once your Defender EASM database has been created, click on the database name to open the details page. Select **Permissions** from the Overview section of the left-hand navigation menu.
100
+
5.Once your Defender EASM database has been created, click on the database name to open the details page. Select **Permissions** from the Overview section of the left-hand navigation menu.
93
101
94
-
102
+
95
103
96
-
To successfully export Defender EASM data to Data Explorer, users must create two new permissions for the EASM API: **user** and **ingestor**.
104
+
To successfully export Defender EASM data to Data Explorer, users must create two new permissions for the EASM API: **user** and **ingestor**.
97
105
98
-
6. First, select **+Add** and create a user. Search for **EASM API**, select the value then click **Select**.
106
+
6. First, select **+Add** and create a user. Search for **EASM API**, select the value then click **Select**.
107
+
108
+
7. Select **+Add** to create an ingestor. Follow the same steps outlined above to add the EASM API as an ingestor.
109
+
110
+
8. Your database is now ready to connect to Defender EASM. You will need the cluster name, database name and region in the following format when configuring your Data Connection: ClusterName=XXX;Region=YYY;DatabaseName=ZZZ”
99
111
100
-
7. Select **+Add** to create an ingestor. Follow the same steps outlined above to add the EASM API as an ingestor.
101
112
102
-
8. Your database is now ready to connect to Defender EASM. You will need the cluster name, database name and region in the following format when configuring your Data Connection: ClusterName=XXX;Region=YYY;DatabaseName=ZZZ”
103
113
104
114
105
115
### Add a connection
@@ -108,14 +118,16 @@ Users can connect their Defender EASM data to either Log Analytics or Azure Data
108
118
109
119
A configuration pane will open on the right-hand side of the Data Connections screen. The following four fields are required:
110
120
111
-
-**Name**: enter a name for this data connection.
112
-
-**Connection String**: enter the details required to connect your Defender EASM resource to another tool. For Log Analytics, users enter the workspaceID and coinciding API key associated to their account. For Azure Data Explorer, users enter the cluster name, region and database name associated to their account. Both values must be entered in the format shown when the field is blank.
113
-
-**Content**: users can select to integrate asset data, attack surface insights or both datasets.
114
-
-**Frequency**: select the frequency that the Defender EASM connection sends updated data to the tool of your choice. Available options are daily, weekly and monthly.
121
+
- **Name**: enter a name for this data connection.
122
+
- **Connection String**: enter the details required to connect your Defender EASM resource to another tool. For Log Analytics, users enter the workspaceID and coinciding API key associated to their account. For Azure Data Explorer, users enter the cluster name, region and database name associated to their account. Both values must be entered in the format shown when the field is blank.
123
+
- **Content**: users can select to integrate asset data, attack surface insights or both datasets.
124
+
- **Frequency**: select the frequency that the Defender EASM connection sends updated data to the tool of your choice. Available options are daily, weekly and monthly.
125
+
126
+
127
+
128
+
Once all four fields are configured, select **Add** to create the data connection. At this point, the Data Connections page will display a banner that indicates the resource has been successfully created and data will begin populating within 30 minutes. Once connections are created, they will be listed under the applicable tool on the main Data Connections page.
115
129
116
-
117
130
118
-
Once all four fields are configured, select **Add** to create the data connection. At this point, the Data Connections page will display a banner that indicates the resource has been successfully created and data will begin populating within 30 minutes. Once connections are created, they will be listed under the applicable tool on the main Data Connections page.
119
131
120
132
121
133
### Edit or delete a connection
@@ -124,23 +136,25 @@ Users can edit or delete a data connection. For example, you may notice that a c
124
136
125
137
To edit or delete a data connection:
126
138
127
-
1. Select the appropriate connection from the list on the main Data Connections page.
139
+
1. Select the appropriate connection from the list on the main Data Connections page.
140
+
141
+
142
+
143
+
2. This action will open a page that provides additional data about the connection. This page displays the configurations you elected when creating the connection, as well as any error messages. Users will also see the following additional data:
144
+
-**Recurring**: the day of the week or month that Defender EASM sends updated data to the connected tool.
145
+
-**Created**: the date and time that the data connection was created.
146
+
-**Updated**: the date and time that the data connection was last updated.
128
147
129
-
148
+
130
149
131
-
2. This action will open a page that provides additional data about the connection. This page displays the configurations you elected when creating the connection, as well as any error messages. Users will also see the following additional data:
132
-
-**Recurring**: the day of the week or month that Defender EASM sends updated data to the connected tool.
133
-
-**Created**: the date and time that the data connection was created.
134
-
-**Updated**: the date and time that the data connection was last updated.
135
150
136
-
151
+
3. From this page, users can elect to reconnect, edit or delete their data connection.
137
152
153
+
-**Reconnect**: this option attempts to validate the data connection without any changes to the configuration. This option is best for those who have validated the authentication credentials used for the data connection.
154
+
-**Edit**: this option allows users to change the configuration for the data connection.
155
+
-**Delete**: this option deletes the data connection.
138
156
139
-
3. From this page, users can elect to reconnect, edit or delete their data connection.
140
157
141
-
-**Reconnect**: this option attempts to validate the data connection without any changes to the configuration. This option is best for those who have validated the authentication credentials used for the data connection.
142
-
-**Edit**: this option allows users to change the configuration for the data connection.
143
-
-**Delete**: this option deletes the data connection.
0 commit comments