[Jan 28] MS Defender for Endpoint third-party response integration by natasha-moore-elastic · Pull Request #6478 · elastic/security-docs

natasha-moore-elastic · 2025-01-24T11:23:01Z

Resolves #6303.

Previews

ESS:

Third-party response actions: Added new section for Microsoft Defender for Endpoint response actions
Configure third-party response actions: Added new expandable section for setting up Microsoft Defender for Endpoint response actions

Serverless:

Third-party response actions: Added new tab for Microsoft Defender for Endpoint response actions
Configure third-party response actions: Added new tab for setting up Microsoft Defender for Endpoint response actions

github-actions · 2025-01-24T11:23:14Z

A documentation preview will be available soon.

🔨 Buildkite builds
📚 HTML diff
📙 Preview page

Request a new doc build by commenting

Rebuild this PR: run docs-build
Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

paul-tavares

I left a comment, but overall it looks good and the comment is optional so I'm 👍 it.

paul-tavares · 2025-01-24T14:06:26Z

+- Tenant ID
+--
+
+. **Install the Microsoft Defender for Endpoint integration and {agent}.** Elastic's {integrations-docs}/microsoft_defender_endpoint[Microsoft Defender for Endpoint integration] collects and ingests logs into {elastic-sec}.


I'm thinking we should also mention here that a user could also setup the "Microsoft M365 Defender" integration as an alternative (or additional) source for data... We tested this and it seems to work with bi-directional response actions.

I don't think we should have an entire bullet section for it - perhaps just a callout or "note" to indicate we have support for it.

cc/ @raqueltabuyo , @caitlinbetz

jmikell821

Gave it a glance over. Just a few slight nits -- thanks for pulling this together so quickly!

jmikell821 · 2025-01-24T17:26:11Z

+
+. **Install the Microsoft Defender for Endpoint integration and {agent}.** Elastic's {integrations-docs}/microsoft_defender_endpoint[Microsoft Defender for Endpoint integration] collects and ingests logs into {elastic-sec}.
+
+NOTE: You can also set up the {integrations-docs}/m365_defender[Microsoft M365 Defender integration] as an alternative or additional source of data.


Suggested change

NOTE: You can also set up the {integrations-docs}/m365_defender[Microsoft M365 Defender integration] as an alternative or additional source of data.

NOTE: You can also set up the {integrations-docs}/m365_defender[Microsoft M365 Defender integration] as an alternative or additional data source.

jmikell821 · 2025-01-24T18:13:38Z

+
+Refer to the {integrations-docs}/microsoft_defender_endpoint[Microsoft Defender for Endpoint integration documentation] or https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp[Microsoft's documentation] for details.
+
+After the applications are created, you should have the following 3 pieces of information available for each one:


I think per our style guide rules, numerals 1-9 should be written out.

Suggested change

After the applications are created, you should have the following 3 pieces of information available for each one:

After the applications are created, you should have the following three pieces of information available for each one:

jmikell821 · 2025-01-24T18:14:46Z

+.. Ensure that **Microsoft Defender for Endpoint logs** is selected, and enter the required values for **Client ID**, **Client Secret**, and **Tenant ID**.
+.. Scroll down and enter a name for the agent policy in **New agent policy name**. If other agent policies already exist, you can click the **Existing hosts** tab and select an existing policy instead. For more details on {agent} configuration settings, refer to {fleet-guide}/agent-policy.html[{agent} policies].
+.. Click **Save and continue**.
+.. Select **Add {agent} to your hosts** and continue with the <<enroll-agent,{agent} installation steps>> to install {agent} on a resource in your network (such as a server or VM). {agent} will act as a bridge collecting data from Microsoft Defender for Endpoint and sending it back to {elastic-sec}.


Suggested change

.. Select **Add {agent} to your hosts** and continue with the <<enroll-agent,{agent} installation steps>> to install {agent} on a resource in your network (such as a server or VM). {agent} will act as a bridge collecting data from Microsoft Defender for Endpoint and sending it back to {elastic-sec}.

.. Select **Add {agent} to your hosts** and continue with the <<enroll-agent,{agent} installation steps>> to install {agent} on a resource in your network (such as a server or VM). {agent} will act as a bridge, collecting data from Microsoft Defender for Endpoint and sending it back to {elastic-sec}.

jmikell821 · 2025-01-24T18:15:37Z

+
+. **Create and enable detection rules to generate {elastic-sec} alerts.** Create <<rules-ui-create,detection rules>> to generate {elastic-sec} alerts based on Microsoft Defender for Endpoint events and data.
+
+This gives you visibility into Microsoft Defender hosts without needing to leave {elastic-sec}. You can perform supported endpoint response actions directly from alerts that a rule creates, by using the **Take action** menu in the alert details flyout.


Suggested change

This gives you visibility into Microsoft Defender hosts without needing to leave {elastic-sec}. You can perform supported endpoint response actions directly from alerts that a rule creates, by using the **Take action** menu in the alert details flyout.

This gives you visibility into Microsoft Defender hosts without needing to leave {elastic-sec}. You can perform supported endpoint response actions directly from alerts that a rule creates by using the **Take action** menu in the alert details flyout.

nastasha-solomon

Left some suggestions for the ESS updates that apply to the Serverless updates as well. Overall, everything looks great!

nastasha-solomon · 2025-01-24T20:17:08Z

+// NOTE TO CONTRIBUTORS: These sections have very similar content. If you change anything 
+// in this section, apply the change to the other sections, too.
+
+. **Create API access information in Microsoft Azure.** You should create two new applications in your Azure domain and grant them the following minimum API permissions:


Suggested change

. **Create API access information in Microsoft Azure.** You should create two new applications in your Azure domain and grant them the following minimum API permissions:

. **Create API access information in Microsoft Azure.** Create two new applications in your Azure domain and grant them the following minimum API permissions:

nastasha-solomon · 2025-01-24T20:19:46Z

+. **Create API access information in Microsoft Azure.** You should create two new applications in your Azure domain and grant them the following minimum API permissions:
+
+--
+- For use with the Microsoft Defender for Endpoint Fleet integration policy: Permission to read alert data (`Windows Defender ATP: Alert.Read.All`).


This edit and the following one reflect the list structure used in step 1 of the "Set up SentinelOne response actions" section.

Suggested change

- For use with the Microsoft Defender for Endpoint Fleet integration policy: Permission to read alert data (`Windows Defender ATP: Alert.Read.All`).

- Microsoft Defender for Endpoint Fleet integration policy: Permission to read alert data (`Windows Defender ATP: Alert.Read.All`).

nastasha-solomon · 2025-01-24T20:19:55Z

+
+--
+- For use with the Microsoft Defender for Endpoint Fleet integration policy: Permission to read alert data (`Windows Defender ATP: Alert.Read.All`).
+- For use with the Microsoft Defender for Endpoint connector: Permission to read machine information as well as isolate and release a machine (`Windows Defender ATP: Machine.Isolate and Machine.Read.All`).


Suggested change

- For use with the Microsoft Defender for Endpoint connector: Permission to read machine information as well as isolate and release a machine (`Windows Defender ATP: Machine.Isolate and Machine.Read.All`).

- Microsoft Defender for Endpoint connector: Permission to read machine information as well as isolate and release a machine (`Windows Defender ATP: Machine.Isolate and Machine.Read.All`).

nastasha-solomon · 2025-01-24T20:25:43Z

+- For use with the Microsoft Defender for Endpoint connector: Permission to read machine information as well as isolate and release a machine (`Windows Defender ATP: Machine.Isolate and Machine.Read.All`).
+--
+
+Refer to the {integrations-docs}/microsoft_defender_endpoint[Microsoft Defender for Endpoint integration documentation] or https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp[Microsoft's documentation] for details.


It might be helpful to explain what users will find if they visit these pages. For example, at the end of step 1 in the "Set up SentinelOne response actions" section, there's this line, which tells users what they can expect to find if they visit the referenced page:

Refer to the SentinelOne integration docs or SentinelOne’s docs for details on generating API tokens.

nastasha-solomon · 2025-01-24T20:27:48Z

+
+After the applications are created, you should have the following 3 pieces of information available for each one:
+
+--


Do the three items in this list need descriptions?

nastasha-solomon · 2025-01-24T20:30:20Z

+NOTE: You can also set up the {integrations-docs}/m365_defender[Microsoft M365 Defender integration] as an alternative or additional source of data.
+
+.. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field], search for and select **Microsoft Defender for Endpoint**, then select **Add Microsoft Defender for Endpoint**.
+.. Configure the integration with an **Integration name** and optional **Description**.


This is a bit more direct.

Suggested change

.. Configure the integration with an **Integration name** and optional **Description**.

.. Enter an **Integration name*. Entering a **Description** is optional.

nastasha-solomon

lgtm!

…6478) * MS Defender for Endpoint third-party response integration * Address feedback * Address feedback * Address feedback (cherry picked from commit 9148adb) # Conflicts: # docs/serverless/endpoint-response-actions/response-actions-config.asciidoc # docs/serverless/endpoint-response-actions/third-party-actions.asciidoc

…ion (backport #6478) (#6488) * [Jan 28] MS Defender for Endpoint third-party response integration (#6478) * MS Defender for Endpoint third-party response integration * Address feedback * Address feedback * Address feedback (cherry picked from commit 9148adb) # Conflicts: # docs/serverless/endpoint-response-actions/response-actions-config.asciidoc # docs/serverless/endpoint-response-actions/third-party-actions.asciidoc * Delete docs/serverless directory and its contents --------- Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

MS Defender for Endpoint third-party response integration

f30bfb2

natasha-moore-elastic self-assigned this Jan 24, 2025

natasha-moore-elastic marked this pull request as ready for review January 24, 2025 12:01

natasha-moore-elastic requested a review from a team as a code owner January 24, 2025 12:01

natasha-moore-elastic requested a review from paul-tavares January 24, 2025 12:01

paul-tavares previously approved these changes Jan 24, 2025

View reviewed changes

Address feedback

5494580

natasha-moore-elastic dismissed paul-tavares’s stale review via 5494580 January 24, 2025 14:23

jmikell821 reviewed Jan 24, 2025

View reviewed changes

nastasha-solomon reviewed Jan 24, 2025

View reviewed changes

natasha-moore-elastic added 2 commits January 27, 2025 10:38

Address feedback

96b0843

Address feedback

75676c7

nastasha-solomon approved these changes Jan 27, 2025

View reviewed changes

natasha-moore-elastic added the v9.0.0 label Jan 28, 2025

natasha-moore-elastic merged commit 9148adb into main Jan 28, 2025

mergify Bot mentioned this pull request Jan 28, 2025

[8.x] [Jan 28] MS Defender for Endpoint third-party response integration (backport #6478) #6488

Merged

natasha-moore-elastic mentioned this pull request Mar 26, 2025

What's new in 8.18 #6496

Closed

25 tasks

	NOTE: You can also set up the {integrations-docs}/m365_defender[Microsoft M365 Defender integration] as an alternative or additional source of data.
	NOTE: You can also set up the {integrations-docs}/m365_defender[Microsoft M365 Defender integration] as an alternative or additional data source.

	After the applications are created, you should have the following 3 pieces of information available for each one:
	After the applications are created, you should have the following three pieces of information available for each one:

	.. Select Add {agent} to your hosts and continue with the <<enroll-agent,{agent} installation steps>> to install {agent} on a resource in your network (such as a server or VM). {agent} will act as a bridge collecting data from Microsoft Defender for Endpoint and sending it back to {elastic-sec}.
	.. Select Add {agent} to your hosts and continue with the <<enroll-agent,{agent} installation steps>> to install {agent} on a resource in your network (such as a server or VM). {agent} will act as a bridge, collecting data from Microsoft Defender for Endpoint and sending it back to {elastic-sec}.

	This gives you visibility into Microsoft Defender hosts without needing to leave {elastic-sec}. You can perform supported endpoint response actions directly from alerts that a rule creates, by using the Take action menu in the alert details flyout.
	This gives you visibility into Microsoft Defender hosts without needing to leave {elastic-sec}. You can perform supported endpoint response actions directly from alerts that a rule creates by using the Take action menu in the alert details flyout.

	. Create API access information in Microsoft Azure. You should create two new applications in your Azure domain and grant them the following minimum API permissions:
	. Create API access information in Microsoft Azure. Create two new applications in your Azure domain and grant them the following minimum API permissions:

	- For use with the Microsoft Defender for Endpoint Fleet integration policy: Permission to read alert data (`Windows Defender ATP: Alert.Read.All`).
	- Microsoft Defender for Endpoint Fleet integration policy: Permission to read alert data (`Windows Defender ATP: Alert.Read.All`).

	- For use with the Microsoft Defender for Endpoint connector: Permission to read machine information as well as isolate and release a machine (`Windows Defender ATP: Machine.Isolate and Machine.Read.All`).
	- Microsoft Defender for Endpoint connector: Permission to read machine information as well as isolate and release a machine (`Windows Defender ATP: Machine.Isolate and Machine.Read.All`).

	.. Configure the integration with an Integration name and optional Description.
	.. Enter an *Integration name. Entering a Description is optional.

Uh oh!

Conversation

natasha-moore-elastic commented Jan 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Previews

Uh oh!

github-actions Bot commented Jan 24, 2025

Uh oh!

paul-tavares left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jmikell821 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nastasha-solomon left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nastasha-solomon left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

natasha-moore-elastic commented Jan 24, 2025 •

edited

Loading