Microsoft Windows Defender ATP

The JSA DSM for Microsoft Windows Defender ATP collects events from a Microsoft Windows Defender ATP system.

To integrate Microsoft Windows Defender ATP with JSA, complete the following steps:

1. If automatic updates are not enabled, download and install the most recent version of the following RPMs on your JSA console:

   • Protocol Common RPM

   • Windows Defender ATP REST API Protocol RPM

   • DSMCommon RPM

   • Microsoft Windows Defender ATP DSM RPM

2. Configure your Microsoft Windows Defender ATP appliance to send events to JSA.
3. Add a Microsoft Windows Defender ATP log source that uses the Microsoft Windows Defender ATP REST API on the JSA Console. JSA does not automatically detect the Microsoft Windows Defender ATP REST API.

Microsoft Windows Defender ATP DSM Specifications

The following table identifies the specifications for the Microsoft Windows Defender ATP DSM.

Configuring JSA to Collect Events from Microsoft Windows Defender ATP by using the Windows Defender ATP REST API

The Microsoft Windows Defender ATP REST API collects alerts from the Windows Defender Advanced Threat Protection security service.

Before you can add a log source in JSA, you must obtain` the Microsoft Windows Defender ATP connection information by completing the following steps:

1. Log in to the Windows Defender Security Center.

2. From the menu on the left, click Settings.

3. From the Settings window, in the API section, click SIEM.

4. From the SIEM application details list, copy and record the values for the Client ID and the Authorization server URL and Resource fields. You need these values when you configure a log source in JSA.

1. Click the Admin tab.
2. Click the Log Sources, and then click Add.
3. From the Log Source Type list, select Microsoft Windows Defender ATP.
4. From the Protocol Configuration list, select Windows Defender ATP REST API, and configure the parameters.

   The following table describes the parameters that require specific values to collect alerts from Microsoft Windows Defender ATP by using the Windows Defender ATP REST API.

   Table 2: Windows Defender ATP REST API Log Source Parameters

   Specification	Value
   Authorization Server URL	The URL for the server that provides the authorization to obtain an access token. The access token is used as the authorization to obtain events from Windows Defender ATP. The Authorization Server URL uses the format, “https://login.windows.net/”[Tenant_ID] “/oauth2/token” Where <Tenant ID> is a UUID.
   Resource	The resource that is used to access Windows Defender ATP events.
   Client ID	Ensures that the user is authorized to obtain an access token.
   Client Secret	Ensures that the user is authorized to obtain an access token. The Client Secret value is displayed only one time, and then is no longer visible. If you don't have access to the Client Secret value, contact your Microsoft Azure administrator to request a new client secret.
   Regions	Select the regions that are associated with Windows Defender ATP that you want to collect logs from.
   Other Region	Type the names of any additional regions that are associated with Windows Defender ATP that you want to collect logs from. Use a comma-separated list; for example, region1,region2.
   Use Proxy	If a proxy for JSA is configured, all traffic for the log source travels through the proxy for JSA to access Windows Defender ATP. Configure the Proxy Server, Proxy Port, Proxy Username, and Proxy Password fields. If the proxy does not require authentication, configure the Proxy Server and Proxy Port fields.
   Recurrence	You can specify how often the log collects data. The format is M/H/D for Minutes/Hours/Days. The default is 5 M.
   EPS Throttle	The upper limit for the maximum number of events per second (EPS). The default is 5000.

5. Click Save.
6. On the Admin tab, click Deploy Changes.

Sample Event Messages

Use these sample event messages as a way of verifying a successful integration with JSA.

The following table provides a sample event message when using the Microsoft Windows Defender ATP REST API protocol for the Microsoft Windows Defender ATP DSM: