Defender for Endpoint (Microsoft)

Defender for Endpoint (Microsoft)

1) Connector overview

Field
Value
Type
EDR
Vendor platform
 https://security.microsoft.com 
Vendor documentation
 https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint 
Pre-filtered link
Yes. Opens the Advanced hunting page of the Defender portal with a query prepared for the event. Click Run query to display the results.
API data retrieval
Yes. For each alert: alert name, severity, service source, detection source, date and command. The name of the alert links to its details in the Defender console.
Qualification modes
Automatic & Semi-automatic
Automatic behavior
Sets the Alerted detection status when at least one command reported by a Microsoft Defender alert matches an IOC command of the BlackNoise event.
See  Connectors  for how the pre-filtered link, data collection and qualification modes work, and  Event statuses & severity  for the meaning of the detection statuses.

2) Configuration

Before you start

You need:
  • a Microsoft Entra account with the Global Administrator or Security Administrator role, the only roles that can grant the administrator consent of step 3;
  • a Microsoft tenant licensed for at least one Defender workload that raises alerts, such as Defender for Endpoint. Without it, the Microsoft APIs answer but return no data;
  • HTTPS access from BlackNoise to the Microsoft Graph API ( graph.microsoft.com ).

Prepare Microsoft Defender

BlackNoise reads your Defender alerts through a Microsoft Entra application that you register in your tenant. This application only needs read access.
Step 1 - Register the application in Microsoft Entra. In the Microsoft Entra admin center, open App registrations and create a new registration. Give it a recognizable name, for example blacknoise-connector. No redirect URI is needed: the application connects from server to server. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.
Step 2 - Add the Microsoft Graph permissions. In API permissions, add Microsoft Graph, then choose Application permissions, not delegated permissions. The application needs these three read-only permissions, and no additional Defender role:
Permission
What it is used for
SecurityAlert.Read.All
List and read alerts
SecurityIncident.Read.All
List and read incidents
ThreatHunting.Read.All
Run advanced hunting queries
Step 3 - Grant administrator consent. Still in API permissions, click Grant admin consent for your tenant. Application permissions always require this consent. Without it, calls fail with a 403 error even though the configuration looks correct.
Step 4 - Create a client secret. In Certificates & secrets, create a client secret and copy its value immediately: Microsoft shows it only once. Choose an expiry date and plan the renewal before it, because an expired secret stops the collection without any warning. Store the secret in your password manager, and never paste it into a ticket or a chat.

Fill in the connector in BlackNoise

In BlackNoise, open Resources > Connectors and click Configure on the Microsoft Defender card.
Field
What it is
Where to find it
Directory / Tenant ID
Identifier of your Microsoft Entra tenant
Directory (tenant) ID, on the Overview page of the application
Application / Client ID
Identifier of the application registered in step 1
Application (client) ID, on the Overview page of the application
Client secret
Secret that authenticates the application
Value of the secret created in step 4
Microsoft Graph URL
Entry point to read alerts
 graph.microsoft.com 
Click Save and connect. BlackNoise runs connection tests, and the connector becomes operational if they pass.

3) Troubleshooting

Symptom
Likely cause
Fix
The connection test fails with an authentication error
Wrong tenant ID, application ID or secret, or the secret ID was entered instead of its value
Check the three values. If the secret value is lost, create a new secret (step 4)
Calls fail with a 403 error
Administrator consent was not granted
Grant admin consent in API permissions (step 3)
The connection works but no alert comes back
The tenant has no Defender workload raising alerts, or the target is not onboarded in Defender
Check the licensing and the onboarding of the System Target
The collection stopped on its own
The client secret expired
Create a new secret and update the connector
A host or a user stays contained after a Simulation
Defender's automated response contained it
Follow the steps below