|
| 1 | +--- |
| 2 | +id: azure-security-microsoft-defender-for-identity |
| 3 | +title: Azure Security - Microsoft Defender for Identity |
| 4 | +description: Learn how to collect alerts from the Azure Security - Microsoft Defender for Identity platform and send them to Sumo Logic for analysis. |
| 5 | +--- |
| 6 | + |
| 7 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 8 | + |
| 9 | +<img src={useBaseUrl('img/send-data/ms-graph.svg')} alt="Thumbnail icon" width="50"/> |
| 10 | + |
| 11 | +The Sumo Logic app for Azure Security – Microsoft Defender for Identity enhances endpoint protection by centralizing alert data from various devices, enabling faster detection, investigation, and response to cyber threats. It uses advanced analytics and threat intelligence to identify malicious behavior and high-risk activity. With detailed dashboards and visualizations, it helps security teams track recurring incidents, assess vulnerabilities, and reduce response time, offering a comprehensive view of your organization’s endpoint security posture. |
| 12 | + |
| 13 | +:::info |
| 14 | +This app includes [built-in monitors](#azure-security---microsoft-defender-for-identity-alerts). For details on creating custom monitors, refer to [Create monitors for Azure Security - Microsoft Defender for Identity app](#create-monitors-for-azure-security---microsoft-defender-for-identity-app). |
| 15 | +::: |
| 16 | + |
| 17 | +## Log types |
| 18 | + |
| 19 | +The Azure Security – Microsoft Defender for Identity app uses Sumo Logic’s Microsoft Graph Security source to collect [alerts](https://learn.microsoft.com/en-us/graph/api/security-list-alerts_v2?view=graph-rest-1.0&tabs=http) from the Microsoft Graph Security source. |
| 20 | + |
| 21 | +### Sample log messages |
| 22 | + |
| 23 | +<details> |
| 24 | +<summary>Alert Log</summary> |
| 25 | + |
| 26 | +```json |
| 27 | +{ |
| 28 | + "@odata.type": "#microsoft.graph.security.alert", |
| 29 | + "id": "da637551227677560813_-961444813", |
| 30 | + "providerAlertId": "da637551227677560813_-961444813", |
| 31 | + "incidentId": "28282", |
| 32 | + "status": "new", |
| 33 | + "severity": "low", |
| 34 | + "classification": "unknown", |
| 35 | + "determination": "unknown", |
| 36 | + "serviceSource": "microsoftDefenderForIdenity", |
| 37 | + "detectionSource": "antivirus", |
| 38 | + "detectorId": "e0da400f-affd-43ef-b1d5-afc2eb6f2756", |
| 39 | + "tenantId": "b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c", |
| 40 | + "title": "Suspicious execution of hidden file", |
| 41 | + "description": "A hidden file has been launched. This activity could indicate a compromised host. Attackers often hide files associated with malicious tools to evade file system inspection and defenses.", |
| 42 | + "recommendedActions": "Collect artifacts and determine scope Review the machine timeline for suspicious activities that may have occurred before and after the time of the alert, and record additional related artifacts (files, IPs/URLs) Look for the presence of relevant artifacts on other systems.", |
| 43 | + "category": "DefenseEvasion", |
| 44 | + "assignedTo": null, |
| 45 | + "alertWebUrl": "https://security.microsoft.com/alerts/da637551227677560813_-961444813?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c", |
| 46 | + "incidentWebUrl": "https://security.microsoft.com/incidents/28282?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c", |
| 47 | + "actorDisplayName": null, |
| 48 | + "threatDisplayName": null, |
| 49 | + "threatFamilyName": null, |
| 50 | + "mitreTechniques": [ |
| 51 | + "T1564.001" |
| 52 | + ], |
| 53 | + "createdDateTime": "2021-04-27T12:19:27.7211305Z", |
| 54 | + "lastUpdateDateTime": "2021-05-02T14:19:01.3266667Z", |
| 55 | + "resolvedDateTime": null, |
| 56 | + "firstActivityDateTime": "2021-04-26T07:45:50.116Z", |
| 57 | + "lastActivityDateTime": "2021-05-02T07:56:58.222Z", |
| 58 | + "comments": [], |
| 59 | + "evidence": [ |
| 60 | + { |
| 61 | + "@odata.type": "#microsoft.graph.security.deviceEvidence", |
| 62 | + "createdDateTime": "2021-04-27T12:19:27.7211305Z", |
| 63 | + "verdict": "unknown", |
| 64 | + "remediationStatus": "none", |
| 65 | + "remediationStatusDetails": null, |
| 66 | + "firstSeenDateTime": "2020-09-12T07:28:32.4321753Z", |
| 67 | + "mdeDeviceId": "73e7e2de709dff64ef64b1d0c30e67fab63279db", |
| 68 | + "azureAdDeviceId": null, |
| 69 | + "deviceDnsName": "yonif-lap3.middleeast.corp.microsoft.com", |
| 70 | + "hostName": "yonif-lap3", |
| 71 | + "ntDomain": null, |
| 72 | + "dnsDomain": "middleeast.corp.microsoft.com", |
| 73 | + "osPlatform": "Windows10", |
| 74 | + "osBuild": 22424, |
| 75 | + "version": "Other", |
| 76 | + "healthStatus": "active", |
| 77 | + "riskScore": "medium", |
| 78 | + "rbacGroupId": 75, |
| 79 | + "rbacGroupName": "UnassignedGroup", |
| 80 | + "onboardingStatus": "onboarded", |
| 81 | + "defenderAvStatus": "unknown", |
| 82 | + "ipInterfaces": [ |
| 83 | + "1.1.1.1" |
| 84 | + ], |
| 85 | + "loggedOnUsers": [], |
| 86 | + "roles": [ |
| 87 | + "compromised" |
| 88 | + ], |
| 89 | + "detailedRoles": [ |
| 90 | + "Main device" |
| 91 | + ], |
| 92 | + "tags": [ |
| 93 | + "Test Machine" |
| 94 | + ], |
| 95 | + "vmMetadata": { |
| 96 | + "vmId": "ca1b0d41-5a3b-4d95-b48b-f220aed11d78", |
| 97 | + "cloudProvider": "azure", |
| 98 | + "resourceId": "/subscriptions/8700d3a3-3bb7-4fbe-a090-488a1ad04161/resourceGroups/WdatpApi-EUS-STG/providers/Microsoft.Compute/virtualMachines/NirLaviTests", |
| 99 | + "subscriptionId": "8700d3a3-3bb7-4fbe-a090-488a1ad04161" |
| 100 | + } |
| 101 | + } |
| 102 | + ], |
| 103 | + "systemTags" : [ |
| 104 | + "Defender Experts" |
| 105 | + ] |
| 106 | +} |
| 107 | +``` |
| 108 | +</details> |
| 109 | + |
| 110 | +### Sample queries |
| 111 | + |
| 112 | +```sql title="Alerts by Status" |
| 113 | +_sourceCategory=MicrosoftGraphSecurityIdentity |
| 114 | +|json"id","status","severity","category","title","description","classification","determination","serviceSource","detectionSource","alertWebUrl" ,"comments[*]","evidence[*]"as alert_id,status,severity,category,title,description,classification,determination,service_source,detection_source,alert_url,comments,evidence_info nodrop |
| 115 | + |
| 116 | +| where toLowerCase(service_source) matches("microsoftdefenderforidentity") |
| 117 | + |
| 118 | +// global filters |
| 119 | +| where if ("{{severity}}" = "*", true, severity matches "{{severity}}") |
| 120 | +| where if ("{{status}}" = "*", true, status matches "{{status}}") |
| 121 | +| where if ("{{classification}}" = "*", true, classification matches "{{classification}}") |
| 122 | + |
| 123 | +// panel specific |
| 124 | +| count by status,alert_id |
| 125 | +| count as frequency by status |
| 126 | +| sort by frequency,status |
| 127 | +``` |
| 128 | + |
| 129 | +```sql title="Alerts by Classification" |
| 130 | +_sourceCategory=MicrosoftGraphSecurityIdentity |
| 131 | +|json"id","status","severity","category","title","description","classification","determination","serviceSource","detectionSource","alertWebUrl" ,"comments[*]","evidence[*]"as alert_id,status,severity,category,title,description,classification,determination,service_source,detection_source,alert_url,comments,evidence_info nodrop |
| 132 | + |
| 133 | +| where toLowerCase(service_source) matches("microsoftdefenderforidentity") |
| 134 | + |
| 135 | +// global filters |
| 136 | +| where if ("{{severity}}" = "*", true, severity matches "{{severity}}") |
| 137 | +| where if ("{{status}}" = "*", true, status matches "{{status}}") |
| 138 | +| where if ("{{classification}}" = "*", true, classification matches "{{classification}}") |
| 139 | + |
| 140 | +// panel specific |
| 141 | +| where !isBlank(classification) |
| 142 | +| count by classification,alert_id |
| 143 | +| count as frequency by classification |
| 144 | +| sort by frequency |
| 145 | +``` |
| 146 | + |
| 147 | +```sql title="Top 10 Alert Categories" |
| 148 | +_sourceCategory=MicrosoftGraphSecurityIdentity |
| 149 | +|json"id","status","severity","category","title","description","classification","determination","serviceSource","detectionSource","alertWebUrl" ,"comments[*]","evidence[*]"as alert_id,status,severity,category,title,description,classification,determination,service_source,detection_source,alert_url,comments,evidence_info nodrop |
| 150 | + |
| 151 | +| where toLowerCase(service_source) matches("microsoftdefenderforidentity") |
| 152 | + |
| 153 | +// global filters |
| 154 | +| where if ("{{severity}}" = "*", true, severity matches "{{severity}}") |
| 155 | +| where if ("{{status}}" = "*", true, status matches "{{status}}") |
| 156 | +| where if ("{{classification}}" = "*", true, classification matches "{{classification}}") |
| 157 | + |
| 158 | +// panel specific |
| 159 | +| where !isBlank(category) |
| 160 | +| count by category,alert_id |
| 161 | +| count as frequency by category |
| 162 | +| sort by frequency |
| 163 | +| limit 10 |
| 164 | +``` |
| 165 | + |
| 166 | +## Collection configuration and app installation |
| 167 | + |
| 168 | +:::note |
| 169 | +- Skip this step if you have already configured the [Microsoft Graph Security API Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/). |
| 170 | +- Select **Use the existing source and install the app** to install the app using the `sourceCategory` of the Microsoft Graph Security API Source configured above. |
| 171 | +::: |
| 172 | + |
| 173 | +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; |
| 174 | + |
| 175 | +<CollectionConfiguration/> |
| 176 | + |
| 177 | +:::important |
| 178 | +Use the [Cloud-to-Cloud Integration for Microsoft Graph Security API](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Azure Security - Microsoft Defender for Identity app is properly integrated and configured to collect and analyze your Azure Security - Microsoft Defender for Identity data. |
| 179 | +::: |
| 180 | + |
| 181 | +### Create a new collector and install the app |
| 182 | + |
| 183 | +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; |
| 184 | + |
| 185 | +<AppCollectionOPtion1/> |
| 186 | + |
| 187 | +### Use an existing collector and install the app |
| 188 | + |
| 189 | +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; |
| 190 | + |
| 191 | +<AppCollectionOPtion2/> |
| 192 | + |
| 193 | +### Use an existing source and install the app |
| 194 | + |
| 195 | +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; |
| 196 | + |
| 197 | +<AppCollectionOPtion3/> |
| 198 | + |
| 199 | +## Viewing the Azure Security - Microsoft Defender for Identity dashboards |
| 200 | + |
| 201 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 202 | + |
| 203 | +<ViewDashboards/> |
| 204 | + |
| 205 | +### Overview |
| 206 | + |
| 207 | +The **Azure Security - Microsoft Defender for Identity - Overview** dashboard provides a comprehensive view of security threats detected across endpoints, enabling analysts to quickly assess, prioritise, and respond to potential incidents. Through an extensive set of visualisations, it presents key metrics such as total alerts, high-severity alerts, and their breakdown by status, classification, determination, service source, and detection source. |
| 208 | + |
| 209 | +Security teams can easily identify dominant alert categories, monitor the most recent alerts for immediate action, and track analyst assignments to ensure accountability. The dashboard also highlights top users associated with alerts, helping detect insider threats or compromised accounts that may require deeper investigation. |
| 210 | + |
| 211 | +Geo-location mapping adds another layer of insight by showing the origin of alerts, supporting region-specific risk assessments. By combining historical trends with real-time visibility, the dashboard enables security teams to focus on high-impact threats and improve response times. |
| 212 | +<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Defender-for-Identity/Azure-Security-Microsoft-Defender-for-Identity-Overview.png' alt="Azure Security - Microsoft Defender for Identity - Overview" /> |
| 213 | + |
| 214 | +### Security |
| 215 | + |
| 216 | +The **Azure Security - Microsoft Defender for Identity - Security** dashboard offers a strategic, high-level view of the organisation’s endpoint threat landscape, enabling security teams to pinpoint risk concentrations and monitor how threats evolve over time. Interactive trend panels display shifts in alert severity, helping teams quickly identify surges in high-risk incidents and prioritise their response accordingly. |
| 217 | + |
| 218 | +Geo-location insights spotlight alerts originating from high-risk regions, supporting threat assessments tied to specific geopolitical contexts. The dashboard also provides critical visibility into top user accounts with compromised or privileged roles—potential indicators of targeted attacks or insider threats. |
| 219 | + |
| 220 | +Additionally, it ranks the most frequently attacked devices and highlights countries linked to malicious or suspicious IP activity, offering clear insight into the most vulnerable assets and regions. This intelligence allows for more focused defences and faster, more effective threat mitigation. |
| 221 | + |
| 222 | +By integrating trend analysis, threat origin mapping, and user risk profiling, the Security dashboard empowers analysts to detect emerging patterns, respond proactively, and strengthen the organisation’s resilience against sophisticated endpoint threats. |
| 223 | +<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Defender-for-Identity/Azure-Security-Microsoft-Defender-for-Identity-Security.png' alt="Azure Security - Microsoft Defender for Identity - Security" /> |
| 224 | + |
| 225 | +## Create monitors for Azure Security - Microsoft Defender for Identity app |
| 226 | + |
| 227 | +import CreateMonitors from '../../reuse/apps/create-monitors.md'; |
| 228 | + |
| 229 | +<CreateMonitors/> |
| 230 | + |
| 231 | +### Azure Security - Microsoft Defender for Identity alerts |
| 232 | + |
| 233 | +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |
| 234 | +|:--|:--|:--|:--| |
| 235 | +| `Alerts Detected from Embargoed Locations` | This alert is triggered when activity is detected from a location flagged as high-risk, enabling you to monitor access attempts from unusual or restricted geographic regions. It enhances your ability to spot suspicious behaviour and potential threats originating from locations outside your organisation’s typical operating areas. | Critical | Count > 0 | |
| 236 | +| `High Severity Alerts` | This alert is triggered when a high-severity threat is detected, allowing you to promptly monitor and respond to potentially harmful events that may compromise endpoint security. It ensures critical incidents are prioritised for swift investigation and mitigation. | Critical | Count > 0| |
| 237 | +| `Embargoed Device` | This alert is triggered when a single device generates multiple alerts, indicating potentially malicious behaviour. It helps you identify high-risk devices, monitor suspicious activity more effectively, and take swift action to prevent further compromise. | Critical | Count > 5 | |
| 238 | + |
| 239 | +## Upgrade/Downgrade the Azure Security - Microsoft Defender for Identity app (Optional) |
| 240 | + |
| 241 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 242 | + |
| 243 | +<AppUpdate/> |
| 244 | + |
| 245 | +## Uninstalling the Azure Security - Microsoft Defender for Identity app (Optional) |
| 246 | + |
| 247 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 248 | + |
| 249 | +<AppUninstall/> |
0 commit comments