Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Microsoft 365 Defender

The JSA Microsoft 365 Defender DSM collects events from a Microsoft 365 Defender service by using the Microsoft Azure Event Hubs protocol to collect Streaming API data, or the Defender for Endpoint SIEM REST API protocol for alert data.

Note:

The Microsoft Windows Defender ATP DSM name is now the Microsoft 365 Defender DSM. The DSM RPM name remains as Microsoft Windows Defender ATP in JSA.
Note:

Due to a change in the Microsoft Defender API suite as of November 25th 2021, Microsoft no longer allows the onboarding of new integrations with their SIEM API. Existing integrations continue to function.

The Streaming API can be used with the Microsoft Azure Event Hubs protocol to provide event and alert forwarding to JSA. For more information about the service and its configuration, see Configure Microsoft 365 Defender to stream Advanced Hunting events to your Azure Event Hub.

Integrate a Microsoft 365 Defender service when you use the Microsoft Azure Event Hubs protocol

If you want to integrate Microsoft 365 Defender with JSA, complete the following steps:

  1. If automatic updates are not enabled, download the most recent versions of the RPMs from the Juniper Downloads.

    • Protocol Common RPM

    • Microsoft Azure Event Hubs Protocol RPM

    • DSMCommon RPM

    • Microsoft 365 Defender DSM RPM

  2. Configure Microsoft 365 Defender to send advanced hunting events to a Microsoft Azure Event Hub. For more information, see Configure Microsoft Defender to stream Advanced Hunting events to your Azure Event Hub.

  3. If JSA does not automatically detect the log source, add a Microsoft 365 Defender log source that uses the Microsoft Azure Event Hubs protocol on the JSA Console. For more information about the protocol, see Microsoft Azure Event Hubs log source parameters for Microsoft 365 Defender.

Integrate a Microsoft 365 Defender service when you use the Microsoft Defender for Endpoint SIEM REST API protocol

If you want to integrate a Microsoft Windows Defender ATP service with JSA, complete the following steps:

  1. If automatic updates are not enabled, download the most recent versions of the RPMs from the Juniper Downloads.

    • Protocol Common RPM

    • Microsoft Defender for Endpoint SIEM REST API Protocol RPM

    • DSMCommon RPM

    • Microsoft 365 Defender DSM RPM

  2. Add a Microsoft 365 Defender log source that uses the Microsoft Defender for Endpoint SIEM REST API protocol on the JSA Console. JSA does not automatically detect the Microsoft Defender for Endpoint SIEM REST API. For more information, see Microsoft Defender for Endpoint SIEM REST API Log Source Parameters for Microsoft 365 Defender.

Microsoft 365 Defender DSM Specifications

The following table identifies the specifications for the Microsoft 365 Defender DSM.

Note:

The Microsoft Windows Defender ATP DSM name is now the Microsoft 365 Defender DSM. The DSM RPM name remains as Microsoft Windows Defender ATP in JSA.
Note:

Due to a change in the Microsoft Defender API suite as of November 25th 2021, Microsoft no longer allows the onboarding of new integrations with their SIEM API. Existing integrations continue to function.

The Streaming API can be used with the Microsoft Azure Event Hubs protocol to provide event and alert forwarding to JSA. For more information about the service and its configuration , see Configure Microsoft 365 Defender to stream Advanced Hunting events to your Azure Event Hub.
Table 1: Microsoft 365 Defender DSM Specifications

Specification

Value

Manufacturer

Microsoft

DSM name

Microsoft 365 Defender

RPM file name

DSM-MicrosoftWindowsDefenderATP-JSA-version-Build_number.noarch.rpm

Supported versions

N/A

Protocols

Microsoft Defender for Endpoint SIEM REST API

Microsoft Azure Event Hubs

Event format

JSON

Recorded event types

The Microsoft 365 Defender DSM supports the following events when you use the Microsoft Azure Event Hubs protocol:

Alerts (Alerts are supported only for Microsoft Defender for Endpoint.):

  • AlertInfo

  • AlertEvidence

Device:

  • DeviceInfo

  • DeviceNetworkInfo

  • DeviceProcessEvents

  • DeviceNetworkEvents

  • DeviceFileEvents

  • DeviceRegistryEvents

  • DeviceLogonEvents

  • DeviceEvents

  • DeviceFileCertificateInfo

  • DeviceImageLoadEvents

Email:

  • EmailEvents

  • EmailAttachmentInfo

  • EmailPostDeliveryEvents

  • EmailUrlInfo

The Microsoft 365 Defender DSM supports the following events when you use the Microsoft Defender for Endpoint SIEM REST API protocol:

Windows Defender ATP

Windows Defender AV

Third party TI

Customer TI

Bitdefender

Automatically discovered?

Yes

Includes identity?

Yes

Includes custom properties?

No

More information

Microsoft 365 Defender documentation

Microsoft Defender for Endpoint SIEM REST API Log Source Parameters for Microsoft 365 Defender

If JSA does not automatically detect the log source, add a Microsoft 365 Defender log source on the JSA Console by using Microsoft Defender for Endpoint SIEM REST API protocol.

When you use the Microsoft Defender for Endpoint SIEM REST API protocol, there are specific parameters that you must use.

Note:

The Microsoft Windows Defender ATP DSM name is now the Microsoft 365 Defender DSM. The DSM RPM name remains as Microsoft Windows Defender ATP in JSA.
Note:

Due to a change in the Microsoft Defender API suite as of November 25th 2021, Microsoft no longer allows the onboarding of new integrations with their SIEM API. Existing integrations continue to function.

The Streaming API can be used with the Microsoft Azure Event Hubs protocol to provide event and alert forwarding to JSA. For more information about the service and its configuration, see Configure Microsoft 365 Defender to stream Advanced Hunting events to your Azure Event Hub.

The following table describes the parameters that require specific values to collect Microsoft Defender for Endpoint SIEM REST API events from Microsoft 365 Defender:

Table 2: Microsoft Defender for Endpoint SIEM REST API Log Source Parameters for the Microsoft 365 Defender DSM

Specification

Value

Log Source type

Microsoft 365 Defender

Protocol Configuration

Microsoft Defender for Endpoint SIEM REST API

For a complete list of Microsoft Defender for Endpoint SIEM REST API log source protocol parameters and their values, see Microsoft Defender for Endpoint SIEM REST API Protocol Configuration Options.

Microsoft Azure Event Hubs Log Source Parameters for Microsoft 365 Defender

If JSA does not automatically detect the log source, add a Microsoft 365 Defender log source on the JSA Console by using the Microsoft Azure Event Hubs protocol.

When you use the Microsoft Azure Event Hubs protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Microsoft Azure Event Hubs events from Microsoft 365 Defender:

Table 3: Microsoft Azure Event Hubs log source parameters for the Microsoft 365 Defender DSM

Parameter

Value

Log Source type

Microsoft 365 Defender

Protocol Configuration

Microsoft Azure Event Hubs

Log Source Identifier

Use an identifiable name or IP address for the log source.

When the Use as a Gateway Log Source parameter is enabled, the Log Source Identifier value is not used.

For a complete list of Microsoft Azure Event Hubs protocol parameters and their values, see Microsoft Azure Event Hubs Protocol Configuration Options.

Microsoft 365 Defender Sample Event Messages

Use these sample event messages to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.
Note:

Due to a change in the Microsoft Defender API suite as of November 25th 2021, Microsoft no longer allows the onboarding of new integrations with their SIEM API. Existing integrations continue to function.

The Streaming API can be used with the Microsoft Azure Event Hubs protocol to provide event and alert forwarding to JSA. For more information about the service and its configuration , see Configure Microsoft 365 Defender to stream Advanced Hunting events to your Azure Event Hub.

Microsoft 365 Defender Sample Messages when you use the Microsoft Azure Event Hubs Protocol

Sample 1: The following sample event message shows a successful scheduled task update.

Table 4: Highlighted fields in the Microsoft 365 Defender event

JSA field name

Highlighted payload field name

Event Category

category

Event ID

ActionType

Device Time

Timestamp

Sample 2: The following sample event message shows an alert to possible keylogging activity.

Table 5: Highlighted fields in the Microsoft 365 Defender event

JSA field name

Highlighted payload field name

Event Category

category

Event ID

Title

Device Time

Timestamp

Microsoft 365 Defender sample messages when you use the Microsoft Defender for Endpoint SIEM REST API protocol

Sample 1: The following sample event message shows suspicious activity.

Table 6: Highlighted fields in the Microsoft 365 Defender sample event

JSA field name

Highlighted payload field name

Device Time

AlertTime

Event ID

Category

Source IP

IpAddress

Source IP v6

InternalIPv6List

Username

UserName

Sample 2: The following sample event message shows that a backdoor access is detected.

Table 7: Highlighted fields in the Microsoft 365 Defender sample event

JSA field name

Highlighted payload field name

Device Time

AlertTime

Event ID

Category

Source IP

IpAddress

Source IP v6

InternalIPv6List

Username

UserName