Microsoft Defender for Endpoint Microsoft Defender for Endpoint

Integrate Microsoft Defender alerts, incidents and vulnerabilities

The Microsoft Defender for Endpoint connector allows you to integrate your security data into OverView for centralized visibility of detected incidents and vulnerabilities.

Overview

The Microsoft Defender for Endpoint connector enables you to collect the following information:

  • Machine inventory
  • Security alerts and incidents
  • Vulnerabilities (Threat & Vulnerability Management)
  • Device type and category (e.g. IP phones, IoT, network devices) — via Advanced Hunting

Prerequisites

  • Microsoft 365 tenant with Microsoft Defender for Endpoint enabled
  • Azure AD application configured with appropriate permissions
  • Access to Azure portal to create/manage applications

Information to provide in OverView

FieldDescription
API URLMicrosoft Defender API URL (e.g., https://api.security.microsoft.com)
Token URLAzure AD token endpoint URL (e.g., https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token)
Tenant IDAzure AD tenant ID
Application (Client) IDClient ID of the Azure AD application
Client SecretClient secret of the Azure AD application

Parameters

These parameters are optional. Leave them at their default value unless you have a specific reason to change them.

ParameterDescriptionDefault
Days to RetrieveNumber of days of data to retrieve90
Collect Device TypesCollect device type informationEnabled

Configuration

Register an application in Microsoft Entra ID

  1. Navigate to the Microsoft Entra admin center.
  2. Go to Microsoft Entra ID > App registrations > New registration.
  3. Fill in the application details:
    • Name: OverView Microsoft Defender Connector
    • Supported account types: Accounts in this organizational directory only
  4. Click Register.
  5. From the app overview page, note the Application (Client) ID and Directory (Tenant) ID.

Add Microsoft Defender API permissions

  1. In your app registration, go to API permissions > Add a permission.
  2. Select APIs my organization uses and search for WindowsDefenderATP.
  3. Click WindowsDefenderATP.
  4. Select Application permissions and add the following:
    • Machine.Read.All
    • Alert.Read.All
    • Vulnerability.Read.All
    • SecurityRecommendation.Read.All
    • Software.Read.All
    • AdvancedQuery.Read.All
  5. Click Add permissions.
  6. Click Grant admin consent for Organization and confirm.
Caution
Admin consent is required

Adding a permission is not enough: you must click Grant admin consent for Organization and confirm. Without admin consent, the permission is not applied and the corresponding data is not collected.

Note
Device type collection

AdvancedQuery.Read.All enables device type/category collection (e.g. distinguishing IP phones from servers) through the Advanced Hunting API. This data is only available for the last 30 days: devices that have not been seen by Defender within the last 30 days will not have a device type. This permission is optional — without it, all other data is still collected.

Generate a client secret

  1. In your app registration, go to Certificates & secrets > New client secret.
  2. Add a description (e.g., "OverView Connector").
  3. Select an expiration period.
  4. Click Add.
  5. Immediately copy the Value (it will only be displayed once).

Configure the connector in OverView

  1. In OverView, go to Data Sources Settings > Sources.
  2. Select Microsoft Defender for Endpoint and click Configure.
  3. Fill in the required fields:
  4. Click Save Configuration.

Reference: Microsoft Defender for Endpoint API - Create an app

Required Permissions

The Azure AD application must have the following minimum permissions:

  • Machine.Read.All: Read machine inventory
  • Alert.Read.All: Read alerts and incidents
  • Vulnerability.Read.All: Vulnerability data access
  • SecurityRecommendation.Read.All: Security recommendations access
  • Software.Read.All: Read software installed on machines
  • AdvancedQuery.Read.All: Device type/category collection via Advanced Hunting (last 30 days only, optional)
Alternative: file import through DropPoint

The API access described above is the recommended method for this connector. Where it is not available (a segregated network, a version or licence without API, an export you already produce), OverView accepts file exports, to be uploaded to the bucket dedicated to Microsoft Defender for Endpoint.

Where do the files go?

Bucket : s3://microsoftdefender/

Example : s3://microsoftdefender/export.csv

The procedure is described in the OverView DropPoint guide: generating credentials, configuring the client, then sending files from the OverView web interface, the AWS CLI or an SDK. Its examples come pre-filled with this bucket when you follow this link.

← PreviousKaspersky Security CenterNext →Palo Alto Cortex XDR