Microsoft Defender for Endpoint

Arctic Wolf® monitors Microsoft Defender for Endpoint® logs to alert you about suspicious or malicious activity.

To implement this functionality, you must provide this information about your Microsoft Defender for Endpoint application from the Microsoft Azure Portal to Arctic Wolf®:

• Application (client) ID
• Directory (tenant) ID
• Client Secret

Microsoft Defender for Endpoint monitoring limitations

• The Client Secret is only available to view during the application registration. If this information is lost before it is submitted to Arctic Wolf on the Arctic Wolf Portal, you must create a new Client Secret for the application.
• Throttling may occur if too many requests are made to the Microsoft Graph API. This throttling threshold is reached due to a high volume of requests from multiple applications within a single Azure tenant or from a single application across all Azure tenants. Contention between the Arctic Wolf® service and other applications running in the Azure tenant can affect timely log retrieval. See the Microsoft Graph throttling guidance documentation on the Microsoft website for more information.

Configure Microsoft Defender for Endpoint

Once Microsoft Defender for Endpoint monitoring is successfully configured, Arctic Wolf can use the Microsoft Graph API to monitor logs from your Microsoft Defender for Endpoint environment and alert you about suspicious or malicious activity.

Requirements

• A Microsoft account with administrator access.
• A Microsoft licensing package containing one of these service plans:
  • Microsoft Defender for Endpoint Plan 1
  • Microsoft Defender for Endpoint Plan 2
  • Microsoft 365 Defender

Steps

1. Register the application.
2. Configure API permissions.
3. Provide credentials to Arctic Wolf.

Step 1: Register the application

Registering your Microsoft Defender for Endpoint application in the Microsoft Azure Portal creates the necessary credentials and sets the correct permissions to allow Arctic Wolf to properly retrieve logs from the endpoints.

1. Sign in to the Microsoft Azure Portal.

2. Open the navigation menu, and then select Azure Active Directory.

3. Select App registrations from the navigation pane.

4. Select + New registration.

5. Enter a memorable name for the application in the Name field.

6. In the Supported Account types section, confirm that Accounts in this organizational directory only (<Organization-Name> only - Single Tenant) is selected.

   Note: Leave all other fields as their defaults.

7. Click Register. This opens the page for the newly registered application.

8. Record the Application (client) ID and Directory (tenant) ID values to provide to Arctic Wolf in a later step.

9. In the navigation pane, under Manage, select Certificates & secrets.

10. In the Client secrets section, select + New client secret, and then create the secret:

    1. Enter a meaningful description for the Client Secret.

    2. Select your desired option for the Expires field.

       Tip: You must submit updated credentials to Arctic Wolf before the credentials expire.

    3. Click Add.

11. Verify that your new Client Secret appears in the Client secrets section, and then copy the Value field to a secure location. You must provide this value to Arctic Wolf later.

Step 2: Configure API permissions

To configure API permissions for the registered application:

1. In the navigation pane, under Manage, click API permissions.

2. Find the User.Read permission which is enabled by default, and then click Menu to open the menu.

3. Click Remove permission and then click Yes, remove.

4. In the Configured permissions section, click + Add a permission.

5. In the Select an API section, click Microsoft APIs, and then, in the Commonly used Microsoft APIs section, click Microsoft Graph.

6. Click Application permission to open the permission type list.

7. Search for the Microsoft Graph permission type and select the corresponding SecurityAlert.Read.All checkbox.

   Tip: For more information on Microsoft Graph permission types, see Microsoft Graph permissions reference.

8. Click Add permissions to apply. This returns you to the API permissions page where the new permissions appear in a list.

9. In the Configured permissions section, click Grant admin consent for <Organization Name>, and then click Yes to confirm the change.

Step 3: Provide credentials to Arctic Wolf

To provide your Microsoft Defender for Endpoint application registration details to Arctic Wolf on the Arctic Wolf Portal:

1. Sign in to the Arctic Wolf Unified Portal.

2. In the menu bar, click Telemetry Management > Connected Accounts.

3. Click Add Account +.

4. On the Add Account page, from the Account Type list, select Cloud Detection and Response.

5. From the list of cloud services, select Microsoft Defender for Endpoint.

6. On the Add Account page, complete these steps:

   1. Account Name — Enter a unique and descriptive name for the account.
   2. For each of these fields, paste the appropriate value from Register the application:
      • Application (client) ID
      • Directory (tenant) ID
      • Client Secret
   3. Credential Expiry — (Optional) Enter the expiration date if the credentials have an expiry date.

7. Click Test and Submit Credentials.

   After your Concierge Security® Team (CST) enables security monitoring for this account, the connected account status changes to Healthy.

MDR polling frequency

Arctic Wolf® Managed Detection and Response (MDR) polls third-party API integrations at regular intervals. Time-based events are polled with a delay to make sure data is available within the third-party API endpoint. For new deployments, after the API integration is successfully configured with the necessary credentials, Arctic Wolf begins polling and reviewing activity from approximately 1 hour prior to configuration success.

Next steps

After configuring Arctic Wolf monitoring of your Microsoft Defender for Endpoint environment, you can optionally configure Microsoft Defender for Endpoint to contain possibly compromised hosts. For instructions, see Microsoft Defender for Endpoint Containment.

See also

• Register an application with the Microsoft identity platform
• Microsoft Graph permissions reference