Skip to content

Commit 79e05a8

Browse files
committed
Merge branch 'main' of https://github.com/MicrosoftDocs/CloudAppSecurityDocs-pr into two-defender-for-cloud-apps-articles
2 parents 07f9fd7 + 68234fa commit 79e05a8

File tree

6 files changed

+95
-8
lines changed

6 files changed

+95
-8
lines changed

CloudAppSecurityDocs/enable-instant-visibility-protection-and-governance-actions-for-your-apps.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Connect apps to get visibility and control
33
description: This article describes the process for connecting apps with API connectors to apps in your organization's cloud.
4-
ms.date: 02/20/2023
4+
ms.date: 05/06/2024
55
ms.topic: how-to
66
---
77

@@ -69,6 +69,7 @@ The following tables list, per cloud app, which abilities are supported with App
6969
| [Google Workspace](protect-google-workspace.md) ||||| ✔ - requires Google Business or Enterprise ||
7070
| [Microsoft 365](protect-office-365.md) |||||||
7171
| [Miro](protect-miro.md) || | ||| |
72+
| [Mural](protect-mural.md) || | ||| |
7273
| [NetDocuments](protect-netdocuments.md) || || |||
7374
| [Okta](protect-okta.md) || | Not supported by provider ||||
7475
| [OneLogin](protect-onelogin.md) || |||||
@@ -100,6 +101,7 @@ The following tables list, per cloud app, which abilities are supported with App
100101
| [Google Workspace](protect-google-workspace.md) |||||
101102
| [Microsoft 365](protect-office-365.md) |||||
102103
| [Miro](protect-miro.md) | | | | |
104+
| [Mural](protect-mural.md) | | | | |
103105
| [NetDocuments](protect-netdocuments.md) | | | | Preview |
104106
| [Okta](protect-okta.md) | | Not applicable | Not applicable ||
105107
| [OneLogin](protect-onelogin.md) | | | | |
@@ -131,6 +133,7 @@ The following tables list, per cloud app, which abilities are supported with App
131133
| [Google Workspace](protect-google-workspace.md) || ✔ - requires Google Business Enterprise ||||
132134
| [Okta](protect-okta.md) | Not applicable | Not applicable | Not applicable | Not applicable | Not applicable |
133135
| [Miro](protect-miro.md) | | | | | |
136+
| [Mural](protect-mural.md) | | | | | |
134137
| [NetDocuments](protect-netdocuments.md) | | | | | |
135138
| [Okta](protect-okta.md) | Not applicable | Not applicable | Not applicable | Not applicable | Not applicable |
136139
| [OneLogin](protect-onelogin.md) | | | | | |

CloudAppSecurityDocs/policy-template-reference.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@ For the full list of templates, check the Microsoft Defender Portal.
1717

1818
|Risk category|Template name|Description|
1919
|-----|----|----|
20-
|Cloud discovery|Anomalous behavior in discovered users|Alert when anomalous behavior is detected in discovered users and apps, such as: large amounts of uploaded data compared to other users, large user transactions compared to the user's history.|
21-
|Cloud discovery|Anomalous behavior of discovered IP addresses|Alerts when anomalous behavior is detected in discovered IP addresses and apps, such as: large amounts of uploaded data compared to other IP addresses, large app transactions compared to the IP address's history.|
2220
|Cloud discovery|Collaboration app compliance check|Alert when new collaboration apps are discovered that aren't compliant with SOC2 and SSAE 16, and are used by more than 50 users with a total daily use of more than 50 MB.|
2321
|Cloud discovery|Cloud storage app compliance check|Alert when new cloud storage apps are discovered that aren't compliant with SOC2, SSAE 16, ISAE 3402 and PCI DSS, and are used by more than 50 users with total daily use of more than 50 MB.|
2422
|Cloud discovery|CRM app compliance check|Alert when new CRM apps are discovered that aren't compliant with SOC2, SSAE 16, ISAE 3402, ISO 27001 and HIPAA, and are used by more than 50 users with a total daily use of more than 50 MB.|
Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
title: Protect your Mural environment | Microsoft Defender for Cloud Apps
3+
description: This article provides information about the benefits of connecting your Mural app to Defender for Cloud Apps using the API connector for visibility and control over use.
4+
ms.date: 05/06/2024
5+
ms.topic: how-to
6+
---
7+
8+
# Protect your Mural environment (Preview)
9+
10+
Mural is an online workspace that enables distributed, cross-functional teams organize and collaborate on projects. Mural holds critical data of your organization, and this makes it a target for malicious actors.
11+
12+
Connecting Mural to Defender for Cloud Apps gives you improved insights into your users' activities and provides threat detection using machine learning based anomaly detections.
13+
14+
## Main threats
15+
16+
- Compromised accounts and insider threats
17+
- Data leakage
18+
- Insufficient security awareness
19+
- Unmanaged bring your own device (BYOD)
20+
21+
## How Defender for Cloud Apps helps to protect your environment
22+
23+
- [Detect cloud threats, compromised accounts, and malicious insiders](best-practices.md#detect-cloud-threats-compromised-accounts-malicious-insiders-and-ransomware)
24+
- [Use the audit trail of activities for forensic investigations](best-practices.md#use-the-audit-trail-of-activities-for-forensic-investigations)
25+
26+
## Control Mural with policies
27+
28+
| **Type** | **Name** |
29+
| ---------------------------------- | ------------------------------------------------------------ |
30+
| **Built-in anomaly detection policy** | [Activity from anonymous IP addresses](anomaly-detection-policy.md#activity-from-anonymous-ip-addresses) <br /> [Activity from infrequent country](anomaly-detection-policy.md#activity-from-infrequent-country) <br /> [Activity from suspicious IP addresses](anomaly-detection-policy.md#activity-from-suspicious-ip-addresses) <br /> [Impossible travel](anomaly-detection-policy.md#impossible-travel) <br /> [Activity performed by terminated user](anomaly-detection-policy.md#activity-performed-by-terminated-user) (requires Microsoft Entra ID as IdP) <br />[Multiple failed login attempts](anomaly-detection-policy.md#multiple-failed-login-attempts) <br /> |
31+
| **Activity policy** | Built a customized policy by using the [Mural Audit Log API](https://support.mural.co/s/article/audit-logs). |
32+
33+
<!--check xrefs -->
34+
For more information about creating policies, see [Create a policy](control-cloud-apps-with-policies.md#create-a-policy).
35+
36+
## Automate governance controls
37+
38+
In addition to monitoring for potential threats, you can apply and automate the following Mural governance actions to remediate detected threats:
39+
40+
| **Type** | **Action** |
41+
| --------------- | ------------------------------------------------------------ |
42+
| **User governance** | Notify user on alert (via Microsoft Entra ID)<br /> Require user to sign in again (via Microsoft Entra ID) <br /> Suspend user (via Microsoft Entra ID) |
43+
44+
For more information about remediating threats from apps, see [Governing connected apps](governance-actions.md).
45+
46+
## Connect Mural to Microsoft Defender for Cloud Apps
47+
48+
This section provides instructions for connecting Microsoft Defender for Cloud Apps to your existing Mural account using the App Connector APIs. This connection gives you visibility into and control over Mural usage.
49+
50+
**Prerequisites**:
51+
52+
- A Mural enterprise account is a pre-requisite for this connection. You must be signed-in as an admin to Mural.
53+
54+
**To connect Mural to Defender for Cloud Apps**:
55+
56+
1. Sign into your [Mural](https://app.mural.co/) account and select your account icon > **Manage Company > Development > API keys > Create API key**.
57+
1. Select all checkboxes and then select **Create API Key** and then **Copy Key**.
58+
1. In the Microsoft Defender portal, select **Settings > Cloud Apps > Connected Apps > App Connectors > Connect an app > Mural**.
59+
1. In the connection wizard, enter your instance name, and then select **Next**.
60+
1. Paste the API key you'd copied from the Mural portal and then select **Submit**.
61+
62+
Once the connection is successfully established, Defender for Cloud Apps starts fetching Mural audit logs. Since Mural's API logs are delayed by 48 hours, the audit log ingestion to Defender for Cloud Apps is similarly delayed.
63+
64+
If you have any problems connecting the app, see [Troubleshooting App Connectors](/defender-cloud-apps/troubleshooting-api-connectors-using-error-messages).
65+
66+
## Next steps
67+
68+
> [!div class="nextstepaction"]
69+
> [Control cloud apps with policies](control-cloud-apps-with-policies.md)
70+
71+
72+
[!INCLUDE [Open support ticket](includes/support.md)]

CloudAppSecurityDocs/release-notes.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,19 @@ For more information on what's new with other Microsoft Defender security produc
1919

2020
For news about earlier releases, see [Archive of past updates for Microsoft Defender for Cloud Apps](release-note-archive.md).
2121

22+
2223
## September 2024
2324

25+
### Connect Mural to Defender for Cloud Apps (Preview)
26+
27+
Defender for Cloud Apps now supports connections to [Mural](https://www.mural.co/) accounts using app connector APIs, giving your visibility into and control over your organization's Mural use.
28+
29+
For more information, see:
30+
31+
- [How Defender for Cloud Apps helps protect your Mural environment](protect-mural.md)
32+
- [Connect apps to get visibility and control with Microsoft Defender for Cloud Apps](enable-instant-visibility-protection-and-governance-actions-for-your-apps.md)
33+
- [Mural Help Center](https://support.mural.co/s/)
34+
2435
### Removing the ability to email end users about blocked actions
2536

2637
Effective October 1st, 2024, we will discontinue the feature that notifies end users via email when their action is blocked by session policies.

CloudAppSecurityDocs/session-policy-aad.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ Before you start, make sure that you have the following prerequisites:
3636
- [Onboard non-Microsoft IdP catalog apps for Conditional Access app control](proxy-deployment-featured-idp.md)
3737
- [Onboard non-Microsoft IdP custom apps for Conditional Access app control](proxy-deployment-any-app-idp.md)
3838

39-
In order for your access policy to work, you must also have a Microsoft Entra ID Conditional Access policy, which creates the permissions to control traffic.
39+
In order for your session policy to work, you must also have a Microsoft Entra ID Conditional Access policy, which creates the permissions to control traffic.
4040

4141
[!INCLUDE [entra-conditional-access-policy](includes/entra-conditional-access-policy.md)]
4242

@@ -49,7 +49,7 @@ This procedure describes how to create a new session policy in Defender for Clou
4949
1. Select **Create policy** > **Session policy**. For example:
5050

5151
![Screenshot of the Create a Conditional Access policy page.](media/create-policy-from-conditional-access-tab.png)
52-
52+
5353
1. On the **Create session policy** page, start by either selecting a template from the **Policy template** dropdown, or by entering all details manually.
5454

5555
1. <a name="type"></a>Enter the following basic information for your policy. If you're using a template, much of the content is already filled in for you.
@@ -177,16 +177,16 @@ To export Cloud discovery logs from the cloud discovery dashboard:
177177
1. Above the table, select the export button. For example:
178178

179179
![Screenshot of the export button.](media/export-button.png)
180-
181-
180+
181+
182182
1. Select the range of the report and select **Export**. This process may take some time.
183183

184184
1. To download the exported log after the report is ready, in the Microsoft Defender Portal go to **Reports** -> **Cloud Apps** and then **Exported reports**.
185185

186186
1. In the table, select the relevant report from the list of **Conditional Access App Control traffic logs** and select **Download**. For example:
187187

188188
![Screenshot of the download button.](media/download-button.png)
189-
189+
190190
## Supported activities for session policies
191191

192192
The following sections provide more details about each activity supported by Defender for Cloud Apps session policies.

CloudAppSecurityDocs/toc.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@ items:
125125
href: protect-office-365.md
126126
- name: Miro
127127
href: protect-miro.md
128+
- name: Mural
129+
href: protect-mural.md
128130
- name: NetDocuments
129131
href: protect-netdocuments.md
130132
- name: Okta
@@ -206,6 +208,7 @@ items:
206208
- name: Troubleshoot policies
207209
href: troubleshoot-policies.md
208210
- name: Configure threat protection
211+
209212
items:
210213
- name: Detect suspicious user activity with UEBA
211214
href: tutorial-suspicious-activity.md

0 commit comments

Comments
 (0)