Skip to content

Commit db181f7

Browse files
amee-sumoamee-sumo
committed
Create azure-security-microsoft-defender-for-office-365.md
1 parent 271ac31 commit db181f7

File tree

1 file changed

+192
-0
lines changed

1 file changed

+192
-0
lines changed

‎docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-office-365.md‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
id: azure-security-microsoft-defender-for-office-365
3+
title: Azure Security - Microsoft Defender for Office 365
4+
description: Learn about the Sumo Logic collection process for the Azure Security - Defender for Cloud service.
5+
---
6+
7+
import useBaseUrl from '@docusaurus/useBaseUrl';
8+
9+
<img src={useBaseUrl('img/integrations/microsoft-azure/microsoft-defender-office-365.png')} alt="Thumbnail icon" width="50"/>
10+
11+
The Sumo Logic App for Azure Security – Microsoft Defender for Office 365 provides visibility into threats and alerts across Microsoft 365. It includes dashboards to monitor alert activity, geographic trends, detection sources, and user-level details, enabling quick identification of phishing, malware, and suspicious sign-ins. High-severity alerts, malicious IPs, compromised accounts, and targeted devices are highlighted to support rapid response. The app helps strengthen Office 365 security posture, prioritize incidents, and detect potential compromises across users and devices.
12+
13+
## Log types
14+
15+
The Azure Security – Microsoft Defender for Office 365 app uses SumoLogic’s Microsoft Graph Security source to collect [Alerts](https://learn.microsoft.com/en-us/graph/api/security-list-alerts_v2?view=graph-rest-1.0&tabs=http) from the Microsoft Graph Security source.
16+
17+
### Sample log messages
18+
19+
<details>
20+
<summary>Alerts</summary>
21+
22+
```json
23+
{
24+
"id": "adbe0c9e2dccf8f1756423691203fj4f03ebd9d327664bcda30a",
25+
"providerAlertId": "6e11a0063f2acc258e17152cac17564236912037c178d92c04c17564236918be",
26+
"incidentId": "20",
27+
"status": "resolved",
28+
"severity": "high",
29+
"classification": "falsePositive",
30+
"determination": "phishing",
31+
"serviceSource": "microsoftDefenderForOffice365",
32+
"detectionSource": "microsoftDefenderForCloud",
33+
"detectorId": "UnfamiliarLocation",
34+
"tenantId": "3adb963c-8e61-48e8-a06d-6dbb0dacea39",
35+
"title": "Unfamiliar sign-in properties",
36+
"description": "Sign-in with properties we have not seen recently for the given user",
37+
"recommendedActions": "",
38+
"category": "InitialAccess",
39+
"assignedTo": null,
40+
"alertWebUrl": "https://remote-trail.gl.at.ply.gg/alerts/adbe0c9e2dccf8f433ff4f03ebd9d327664bcda30a?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
41+
"incidentWebUrl": "https://remote-trail.gl.at.ply.gg/incidents/20?tid=3adb963c-8e61-48e8-a06d-6dbb0dacea39",
42+
"actorDisplayName": null,
43+
"threatDisplayName": null,
44+
"threatFamilyName": null,
45+
"mitreTechniques": [
46+
"T1078",
47+
"T1078.004"
48+
],
49+
"createdDateTime": "2025-08-28T16:28:11-0700725Z",
50+
"lastUpdateDateTime": "2025-08-28T16:28:11-0700333Z",
51+
"resolvedDateTime": "2025-08-28T16:28:11-0700725Z",
52+
"firstActivityDateTime": "2025-08-28T16:28:11-0700919Z",
53+
"lastActivityDateTime": "2025-08-28T16:28:11-0700919Z",
54+
"comments": [
55+
{
56+
"@qlvcckxbgq.type": "#microsoft.graph.security.alertComment",
57+
"comment": "Not valid",
58+
"createdByDisplayName": "David",
59+
"createdDateTime": "2025-08-28T16:28:11-070088Z"
60+
}
61+
],
62+
"evidence": [
63+
{
64+
"@qlvcckxbgq.type": "#microsoft.graph.security.userEvidence",
65+
"createdDateTime": "2025-08-28T16:28:11-0700667Z",
66+
"verdict": "unknown",
67+
"remediationStatus": "none",
68+
"remediationStatusDetails": null,
69+
"roles": [
70+
"compromised"
71+
],
72+
"detailedRoles": [
73+
74+
],
75+
"tags": [
76+
77+
],
78+
"userAccount": {
79+
"accountName": "tseapps",
80+
"domainName": null,
81+
"userSid": "S-1-12-1-1756423691-1756423691-589068932-1756423691",
82+
"azureAdUserId": "f5e829f5-4b1f-4fcf-847a-1c234c1b3b84",
83+
"userPrincipalName": "[email protected]",
84+
"displayName": AndreGurn
85+
}
86+
},
87+
{
88+
"@qlvcckxbgq.type": "#microsoft.graph.security.ipEvidence",
89+
"createdDateTime": "2025-08-28T16:28:11-0700667Z",
90+
"verdict": "malicious",
91+
"remediationStatus": "none",
92+
"remediationStatusDetails": null,
93+
"roles": [
94+
95+
],
96+
"detailedRoles": [
97+
98+
],
99+
"tags": [
100+
101+
],
102+
"ipAddress": "185.231.233.146",
103+
"countryLetterCode": "IN"
104+
}
105+
]
106+
}
107+
```
108+
</details>
109+
110+
### Sample queries
111+
112+
```sql title="Recent Alerts"
113+
_sourceCategory=Labs/AzureSecurityMicrosoftDefenderFor365
114+
|json"id","status","severity","category","title","description","classification","determination","serviceSource","detectionSource","alertWebUrl" ,"comments[*]","evidence[*]"as alert_id,status,severity,category,title,description,classification,determination,service_source,detection_source,alert_url,comments,evidence_info nodrop
115+
116+
| where toLowerCase(service_source) = "microsoftdefenderforoffice365"
117+
118+
// panel specific
119+
| if(isNull(category),"-",category) as category
120+
| if(isNull(classification),"-",classification) as classification
121+
| if(isNull(determination),"-",determination) as determination
122+
| count by _messageTime,status,severity,category,title,description,classification,determination,alert_url,alert_id
123+
| formatDate(toLong(_messageTime), "dd-MM-yyyy HH:mm:ss") as time
124+
| tourl (alert_url,alert_id) as alert_id
125+
| fields time,alert_id,title,description,status,severity,category,classification,determination
126+
| fields -_messageTime
127+
| sort by time
128+
| limit 100
129+
```
130+
131+
## Collection configuration and app installation
132+
133+
:::note
134+
- Skip this step if you have already configured the Microsoft Graph Security API Source.
135+
- Select **Use the existing source and install the app** to install the app using the `sourceCategory` of the Microsoft Graph Security API Source configured above.
136+
:::
137+
138+
import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';
139+
140+
<CollectionConfiguration/>
141+
142+
:::important
143+
Use the [Cloud-to-Cloud Integration for Microsoft Graph Security API](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Azure Security - Microsoft Defender for Office 365 app is properly integrated and configured to collect and analyze your Azure Security - Microsoft Defender for Office 365 data.
144+
:::
145+
146+
### Create a new collector and install the app
147+
148+
import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';
149+
150+
<AppCollectionOPtion1/>
151+
152+
### Use an existing collector and install the app
153+
154+
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';
155+
156+
<AppCollectionOPtion2/>
157+
158+
### Use an existing source and install the app
159+
160+
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';
161+
162+
<AppCollectionOPtion3/>
163+
164+
## Viewing the Azure Security - Microsoft Defender for Office 365 dashboards
165+
166+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
167+
168+
<ViewDashboards/>
169+
170+
### Overview
171+
172+
The **Azure Security - Microsoft Defender for Office 365 - Overview** dashboard provides
173+
174+
<br/><img src='' alt="Azure Security - Microsoft Defender for Office 365 - Overview" />
175+
176+
### Security
177+
178+
The **Azure Security - Microsoft Defender for Office 365 - Security** dashboard provides
179+
180+
<br/><img src='' alt="Azure Security - Microsoft Defender for Office 365 - Security" />
181+
182+
## Upgrade/Downgrade the Azure Security - Microsoft Defender for Office 365 app (Optional)
183+
184+
import AppUpdate from '../../reuse/apps/app-update.md';
185+
186+
<AppUpdate/>
187+
188+
## Uninstalling the Azure Security - Microsoft Defender for Office 365 app (Optional)
189+
190+
import AppUninstall from '../../reuse/apps/app-uninstall.md';
191+
192+
<AppUninstall/>

0 commit comments

Comments
 (0)