You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We're excited to introduce the new Microsoft Defender for Endpoint app for Sumo Logic. This app enables you to gain real-time visibility into security alert data across your software projects and dependencies. This app also helps security and DevOps teams track risk exposure, prioritize remediation, and maintain a strong security posture. [Learn more](/docs/integrations/microsoft-azure/microsoft-defender-for-endpoint).
Microsoft Defender for Endpoint is an enterprise-grade endpoint security platform designed to help you prevent, detect, investigate, and respond to advanced cyber threats on devices (endpoints) like laptops, desktops, mobile phones, and servers.
12
+
The **Azure Security – Microsoft Defender for Endpoint** app empowers organizations to strengthen endpoint protection and proactively defend against advanced cyber threats. By centralizing alert data from devices like desktops, laptops, mobile devices, and servers, the app offers actionable insights that help security teams detect, investigate, and respond to suspicious activity faster and more effectively.
13
13
14
-
This document outlines the steps required to collect and analyse the [Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint) alerts in the Sumo Logic platform.
14
+
Leveraging advanced analytics and contextual threat intelligence, the app highlights patterns of malicious behavior, suspicious processes, and high-severity alerts. This visibility equips security teams to pinpoint vulnerabilities, monitor risk exposure, and understand the evolving threat landscape impacting endpoints. With its comprehensive pre-configured dashboards and visualizations, the app helps identify users, devices, or locations associated with recurring security incidents. This capability supports faster investigation and more targeted mitigation, reducing dwell time and potential damage.
15
15
16
-
## Set up collection
16
+
By providing a holistic view of your organization’s endpoint security posture, the **Azure Security – Microsoft Defender for Endpoint** app ensures security teams remain agile, informed, and ready to respond to emerging threats — strengthening defenses and safeguarding critical assets.
17
17
18
-
:::note
19
-
Skip this step if you have already configured the Microsoft Graph Security API Source.
20
-
:::
18
+
## Log types
19
+
20
+
This app uses SumoLogic’s Microsoft Graph Security source to collect [Alerts](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/) from the Microsoft Defender for Endpoint to the Sumo Logic platform.
21
21
22
-
Use the [Cloud-to-Cloud Integration for Microsoft Graph Security API](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/) to ingest security alerts data from the Microsoft Defender for Endpoint to the Sumo Logic platform.
22
+
### Sample log message
23
23
24
-
## Search alerts
24
+
<details>
25
25
26
-
Use the following query to retrieve alerts generated by the Microsoft Defender for Endpoint.
| where toLowerCase(service_source) ="microsoftdefenderforendpoint"
149
+
150
+
// global filters
151
+
| where if ("{{severity}}"="*", true, severity matches "{{severity}}")
152
+
| where if ("{{status}}"="*", true, status matches "{{status}}")
153
+
| where if ("{{classification}}"="*", true, classification matches "{{classification}}")
154
+
155
+
// panel specific
156
+
| count by alert_id
157
+
| count
158
+
```
159
+
160
+
## Collection configuration and app installation
161
+
162
+
:::note
163
+
Skip this step if you have already configured the [Microsoft Graph Security API](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/) Source. **[Use an existing source and install the app](#use-an-existing-source-and-install-the-app)** option to install the app using the `_sourceCategory` of Microsoft Graph Security API Source.
164
+
:::
165
+
166
+
import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';
167
+
168
+
<CollectionConfiguration/>
169
+
170
+
### Create a new collector and install the app
171
+
172
+
import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';
173
+
174
+
<AppCollectionOPtion1/>
175
+
176
+
### Use an existing collector and install the app
177
+
178
+
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';
179
+
180
+
<AppCollectionOPtion2/>
181
+
182
+
### Use an existing source and install the app
183
+
184
+
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';
185
+
186
+
<AppCollectionOPtion3/>
187
+
188
+
:::important
189
+
Use the [Cloud-to-Cloud Integration for Microsoft Graph Security API](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Microsoft Graph Security API app is properly integrated and configured to collect and analyze your security alerts data.
190
+
:::
191
+
192
+
## Viewing Microsoft Defender for Endpoint dashboards
193
+
194
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
195
+
196
+
<ViewDashboards/>
197
+
198
+
### Overview
199
+
200
+
The **Azure Security - Microsoft Defender for Endpoint - Overview** dashboard offers a detailed view into security threats detected across endpoints, enabling analysts to assess and act swiftly on potential incidents. With a broad set of visualizations, it displays total alerts, high-severity alerts, and their distribution by status, classification, determination, service source, and detection source.
201
+
202
+
Security teams can quickly identify which alert categories are most prevalent, view recent alerts for immediate awareness, and also track which analysts are actively assigned to incidents. By highlighting the top users linked to alerts, the dashboard helps uncover potential insider threats or compromised accounts that require further investigation.
203
+
204
+
Geo-location mapping visualizes the alert origin, supporting risk assessment tied to specific regions. Together, these insights provide a balanced blend of historical context and real-time visibility, empowering teams to prioritize high-impact threats and respond effectively.
205
+
206
+
Overall, this dashboard serves as an essential tool for maintaining situational awareness, tracking alert trends, and strengthening your organization’s response strategy against evolving endpoint threats.<br/><imgsrc='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Defender-for-Endpoint/Azure-Security-Microsoft-Defender-for-Endpoint-Overview.png'alt="Azure-Security-Microsoft-Defender-for-Endpoint-Overview" />
207
+
208
+
### Security
209
+
210
+
The **Azure Security - Microsoft Defender for Endpoint - Security** dashboard delivers a high-level view of your organization’s endpoint threat landscape, helping teams identify where risks concentrate and how they evolve over time. Visual trend panels illustrate changes in alert severity, revealing whether high-risk incidents are increasing and guiding prioritization of response efforts.
211
+
212
+
Geo-location data highlights alerts emerging from risky countries, allowing teams to assess exposure to region-specific threats. The dashboard also surfaces critical context, such as the top user accounts with compromised roles, which can signal targeted attacks on privileged accounts.
213
+
214
+
In addition, the dashboard ranks the most frequently attacked devices and countries linked to suspicious or malicious IP activity, offering clarity on which assets and locations are most at risk. This intelligence supports more targeted defenses and timely intervention.
215
+
216
+
By combining trend analysis, threat origins, and user risk insights, the Security dashboard equips analysts to recognize patterns, respond to emerging threats proactively, and bolster the organization’s overall security posture against complex endpoint attacks.<br/><imgsrc='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Defender-for-Endpoint/Azure-Security-Microsoft-Defender-fo-Endpoint-Security.png'alt="Azure-Security-Microsoft-Defender-fo-Endpoint-Security" />
0 commit comments