You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
34
-
35
30
> [!NOTE]
36
-
> **Try our new APIs using MS Graph security API**. Find out more at: [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview).
31
+
> The **Microsoft Graph security API** is a unified schema and interface that integrates with various Microsoft security solutions and Microsoft security partners. To get started, see [Use the Microsoft Graph security API](/graph/api/resources/security-api-overview).
37
32
38
33
The following resources provide more information about APIs available for other Microsoft security solutions, beyond the Microsoft Defender XDR API.
39
34
40
35
-[Microsoft Defender for Endpoint](/defender-endpoint/api/apis-intro)
41
36
-[Microsoft Defender for Office 365](/office/office-365-management-api/)
42
37
-[Microsoft Defender for Cloud Apps](/cloud-app-security/api-introduction)
> **Try our new APIs using MS Graph security API**. Find out more at: [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview).
31
+
> The **Microsoft Graph security API** is a unified schema and interface that integrates with various Microsoft security solutions and Microsoft security partners. To get started, see [Use the Microsoft Graph security API](/graph/api/resources/security-api-overview).
32
32
33
33
> [!IMPORTANT]
34
34
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
> **Try our new APIs using MS Graph security API**. Find out more at: [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview). For information about the new _update incident_ API using MS Graph security API, see [Update incident](/graph/api/security-incident-update).
Copy file name to clipboardExpand all lines: defender-xdr/autoad-results.md
+6-5Lines changed: 6 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ f1.keywords:
8
8
ms.author: diannegali
9
9
author: diannegali
10
10
ms.localizationpriority: medium
11
-
ms.date: 06/19/2024
11
+
ms.date: 04/25/2025
12
12
manager: deniseb
13
13
audience: ITPro
14
14
ms.collection:
@@ -31,9 +31,9 @@ When an automatic attack disruption triggers in Microsoft Defender XDR, the deta
31
31
32
32
## Review the incident graph
33
33
34
-
Microsoft Defender XDR automatic attack disruption is builtin in the incident view. Review the incident graph to get the entire attack story and assess the attack disruption impact and status.
34
+
Microsoft Defender XDR automatic attack disruption is built-in in the incident view. Review the incident graph to get the entire attack story and assess the attack disruption impact and status.
35
35
36
-
Here are some examples of what it looks like:
36
+
The incident page includes the following information:
37
37
38
38
- Disrupted incidents include a tag for 'Attack Disruption' and the specific threat type identified (i.e., ransomware). If you subscribe to incident email notifications, these tags also appear in the emails.
39
39
- A highlighted notification below the incident title indicating that the incident was disrupted.
@@ -96,6 +96,7 @@ IdentityDirectoryEvents
96
96
97
97
The above query was adapted from a [Microsoft Defender for Identity - Attack Disruption query](https://github.com/alexverboon/Hunting-Queries-Detection-Rules/blob/main/Defender%20For%20Identity/MDI-AttackDisruption.md#microsoft-365-defender).
98
98
99
-
## Next step
99
+
## Related content
100
100
101
-
-[Get email notifications for response actions](m365d-response-actions-notifications.md)
101
+
-[Exclude assets from automated response actions](automatic-attack-disruption-exclusions.md)
102
+
-[Get email notifications for response actions](m365d-response-actions-notifications.md)
Copy file name to clipboardExpand all lines: defender-xdr/configure-deception.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.topic: how-to
16
16
search.appverid:
17
17
- MOE150
18
18
- MET150
19
-
ms.date: 01/12/2024
19
+
ms.date: 04/25/2025
20
20
appliesto:
21
21
- Microsoft Defender XDR
22
22
#customer intent: As a security analyst, I want to learn how to configure the deception capability so that I can protect my organization from high-impact attacks that use human-operated lateral movement.
-[Microsoft Defender for Endpoint Plan 1](/defender-endpoint/microsoft-defender-endpoint)
25
-
-[Microsoft Defender for Endpoint Plan 2](/defender-endpoint/microsoft-defender-endpoint)
26
-
-[Microsoft Defender for Business](/defender-business/mdb-overview)
27
-
28
27
You can configure Microsoft Defender XDR to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
29
28
30
29
If you're using [Defender for Business](/defender-business/mdb-overview), you can set up email notifications for specific users (not roles or groups).
> **Try our new APIs using MS Graph security API**. Find out more at: [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview).
30
29
@@ -71,11 +70,11 @@ This client secret value is used by Microsoft Graph APIs to authenticate this ap
71
70
Go **to Event Hub \> Add** and select the pricing tier, throughput units and Auto-Inflate (requires standard pricing and under features) appropriate for the load you're expecting. For more information, see [Pricing - Event Hubs \| Microsoft Azure](https://azure.microsoft.com/pricing/details/event-hubs/).
72
71
73
72
> [!NOTE]
74
-
> You can use an existing event-hub, but the throughput and scaling are set at the namespace level so it is recommended to place an event-hub in its own namespace.
73
+
> You can use an existing event-hub, but the throughput and scaling are set at the namespace level. Microsoft recommends to place an event-hub in its own namespace.
75
74
76
75
:::image type="content" source="/defender/media/ebc4ca37c342ad1da75c4aee4018e51a.png" alt-text="The event hubs section in the Microsoft Azure portal" lightbox="/defender/media/ebc4ca37c342ad1da75c4aee4018e51a.png":::
77
76
78
-
1. You'll also need the Resource ID of this Event Hubs Namespace. Go to your Azure Event Hubs namespace page \> Properties. Copy the text under Resource ID and record it for use during the Microsoft 365 Configuration section below.
77
+
1. Youneed the Resource ID of this Event Hubs Namespace. Go to your Azure Event Hubs namespace page \> Properties. Copy the text under Resource ID and record it for use during the Microsoft 365 Configuration.
79
78
80
79
:::image type="content" source="/defender/media/759498162a4e93cbf17c4130d704d164.png" alt-text="The event hubs properties section in the Microsoft Azure portal" lightbox="/defender/media/759498162a4e93cbf17c4130d704d164.png":::
81
80
@@ -86,7 +85,7 @@ You're required to add permissions to the following roles to entities that are i
86
85
-**Contributor**: The permissions related to this role are added to entity who logs in to the Microsoft Defender portal.
87
86
-**Reader** and **Azure Event Hub data Receiver**: The permissions related to these roles are assigned to the entity who is already assigned the role of a **Service Principal** and logs in to the Microsoft Entra application.
88
87
89
-
To ensure that these roles have been added, perform the following step:
88
+
To ensure that these roles are added, perform the following step:
90
89
91
90
Go to **Event Hub Namespace**\>**Access Control (IAM)**\>**Add** and verify under **Role assignments**.
92
91
@@ -96,16 +95,16 @@ Go to **Event Hub Namespace** \> **Access Control (IAM)** \> **Add** and verify
96
95
97
96
**Option 1:**
98
97
99
-
You can create an Event Hubs within your Namespace and **all** the Event Types (Tables) you select to export will be written into this **one** Event Hub.
98
+
You can create Event Hubs within your Namespace and **all** the Event Types (Tables) you select to export are written into this **one** Event Hub.
100
99
101
100
**Option 2:**
102
101
103
102
Instead of exporting all the Event Types (Tables) into one Event Hub, you can export each table into different Event Hubs inside your Event Hubs Namespace (one Event Hub per Event Type).
104
103
105
-
In this option, Microsoft Defender XDR will create Event Hubs for you.
104
+
In this option, Microsoft Defender XDR creates Event Hubs for you.
106
105
107
106
> [!NOTE]
108
-
> If you are using an Event Hub Namespace that is **not** part of an Event Hub Cluster, you will only be able to choose up to 10 Event Types (Tables) to export in each Export Settings you define, due to an Azure limitation of 10 Event Hub per Event Hub Namespace.
107
+
> If you are using an Event Hub Namespace that is **not** part of an Event Hub Cluster, you're only able to choose up to 10 Event Types (Tables) to export in each Export Settings you define, due to an Azure limitation of 10 Event Hub per Event Hub Namespace.
109
108
110
109
For example:
111
110
@@ -119,7 +118,7 @@ The Partition Count allows for more throughput via parallelism, so it's recommen
119
118
120
119
:::image type="content" source="/defender/media/1db04b8ec02a6298d7cc70419ac6e6a9.png" alt-text="An event hubs creation section in the Microsoft Azure portal" lightbox="/defender/media/1db04b8ec02a6298d7cc70419ac6e6a9.png":::
121
120
122
-
For these Event Hubs (not namespace), you'll need to configure a Shared Access Policy with Send, Listen Claims. Click on your **Event Hub**\>**Shared access policies**\>**+ Add** and then give it a Policy name (not used elsewhere) and check **Send** and **Listen**.
121
+
For these Event Hubs (not namespace), you need to configure a Shared Access Policy with Send, Listen Claims. Click on your **Event Hub**\>**Shared access policies**\>**+ Add** and then give it a Policy name (not used elsewhere) and check **Send** and **Listen**.
123
122
124
123
:::image type="content" source="/defender/media/1867d13f46dc6a0f4cdae6cf00df24db.png" alt-text="The Shared access policies page in the Microsoft Azure portal" lightbox="/defender/media/1867d13f46dc6a0f4cdae6cf00df24db.png":::
125
124
@@ -133,23 +132,23 @@ For these Event Hubs (not namespace), you'll need to configure a Shared Access P
133
132
134
133
1. Sign in to <ahref="https://go.microsoft.com/fwlink/p/?linkid=2077139"target="_blank">Microsoft Defender XDR</a> with an account that meets all the following role requirements:
135
134
136
-
- Contributor role at the Event Hubs *Namespace* Resource level or higher for the Event Hubs that you'll be exporting to. Without this permission, you'll get an export error when you try to save the settings.
135
+
- Contributor role at the Event Hubs *Namespace* Resource level or higher for the Event Hubs that you're be exporting to. An export error occurs when you try to save the settings without this permission.
137
136
138
137
- Security Admin Role on the tenant tied to Microsoft Defender XDR and Azure.
139
138
140
139
:::image type="content" source="/defender/media/55d5b1c21dd58692fb12a6c1c35bd4fa.png" alt-text="The Settings page of the Microsoft Defender portal" lightbox="/defender/media/55d5b1c21dd58692fb12a6c1c35bd4fa.png":::
141
140
142
141
1. Click on **Raw Data Export \> +Add**.
143
142
144
-
You'll now use the data that you recorded above.
143
+
Use the data that you previously recorded.
145
144
146
145
**Name**: This value is local and should be whatever works in your environment.
147
146
148
147
**Forward events to event hub**: Select this checkbox.
149
148
150
149
**Event-Hub Resource ID**: This value is the Event Hubs Namespace Resource ID you recorded when you set up the Event Hubs.
151
150
152
-
**Event-Hub name**: If you created an Event Hubs inside your Event Hubs Namespace, paste the Event Hubs name you recorded above.
151
+
**Event-Hub name**: If you created an Event Hubs inside your Event Hubs Namespace, paste the Event Hubs name you previously recorded.
153
152
154
153
If you choose to let Microsoft Defender XDR to create Event Hubs per Event Types (Tables) for you, leave this field empty.
155
154
@@ -172,15 +171,14 @@ EmailEvents
172
171
|count
173
172
```
174
173
175
-
This query will show you how many emails were received in the last hour joined across all the other tables. It will also show you if you're seeing events that could be exported to the event hubs. If this count shows 0, then you won't see any data going out to the Event Hubs.
174
+
This query shows you how many emails were received in the last hour joined across all the other tables. It also shows you if you're seeing events that could be exported to the event hubs. If this count shows 0, then you won't see any data going out to the Event Hubs.
176
175
177
176
:::image type="content" source="/defender/media/c305e57dc6f72fa9eb035943f244738e.png" alt-text="The advanced hunting page in the Microsoft Azure portal" lightbox="/defender/media/c305e57dc6f72fa9eb035943f244738e.png":::
178
177
179
178
Once you've verified there's data to export, you can view the Event Hubs page to verify that messages are incoming. This process can take up to one hour.
180
179
181
180
1. In Azure, go to **Event Hub**\> Click on the **Namespace**\>**Event Hub**\> Click on the **Event Hub**.
182
-
1. Under **Overview**, scroll down and in the Messages graph you should see Incoming Messages. If you don't see any results, then there will be no messages
183
-
for your custom app to ingest.
181
+
1. Under **Overview**, scroll down and in the Messages graph you should see Incoming Messages. If you don't see any results, then there are no messages for your custom app to ingest.
184
182
185
183
:::image type="content" source="/defender/media/e88060e315d76e74269a3fc866df047f.png" alt-text=" The Overview page in the Microsoft 365 Azure portal" lightbox="/defender/media/e88060e315d76e74269a3fc866df047f.png":::
## Pull Microsoft Defender XDR incidents and streaming event data using security information and events management (SIEM) tools
@@ -84,14 +83,16 @@ For more information on:
84
83
The new SmartConnector for Microsoft Defender XDR ingests incidents into ArcSight and maps these onto its Common Event
85
84
Framework (CEF).
86
85
87
-
For more information on the new ArcSight SmartConnector for Microsoft Defender XDR, see [ArcSight Product Documentation](https://community.microfocus.com/cyberres/productdocs/w/connector-documentation/39246/smartconnector-for-microsoft-365-defender).
86
+
For more information on the new ArcSight SmartConnector for Microsoft Defender XDR, see [ArcSight Product Documentation](https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-8.4/microsoft-365-defender/index.html).
88
87
89
88
The SmartConnector replaces the previous FlexConnector for Microsoft Defender for Endpoint that's now retired.
90
89
91
90
### Elastic
92
91
93
92
Elastic Security combines SIEM threat detection features with endpoint prevention and response capabilities in one solution.
93
+
94
94
The Elastic integration for Microsoft Defender XDR and Defender for Endpoint enables organizations to leverage incidents and alerts from Defender within Elastic Security to perform investigations and incident response. Elastic correlates this data with other data sources, including cloud, network, and endpoint sources using robust detection rules to find threats quickly.
95
+
95
96
For more information on the Elastic connector, see: [Microsoft M365 Defender | Elastic docs](https://docs.elastic.co/integrations/m365_defender)
96
97
97
98
## Ingesting streaming event data via Event Hubs
@@ -114,7 +115,7 @@ Use the new IBM QRadar Microsoft Defender XDR Device Support Module (DSM) that c
114
115
115
116
For more information on the Elastic streaming API integration, see [Microsoft M365 Defender | Elastic docs](https://docs.elastic.co/integrations/m365_defender).
116
117
117
-
## Related articles
118
+
## Related content
118
119
119
120
[Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview)
0 commit comments