![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 45%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAA%3C/text%3E%3C/svg%3E)
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
2,511 questions
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 10%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAP%3C/text%3E%3C/svg%3E)
Hello Abbas Ali,
Thank you for posting your query here!
Your steps for setting up the integration between Azure Storage, Microsoft Defender for Endpoint, and GCP Chronicle SIEM are well thought out. Here's a structured breakdown:
- Create a Storage Account and Set Up Blob Service Endpoints:
- Make sure to create an Azure Storage account and configure the necessary blob service endpoints. These endpoints allow communication between your applications and the storage account.
- Ensure that you choose the appropriate redundancy level (e.g., locally redundant storage, geo-redundant storage) based on your requirements for data durability and availability.
- Enable Cloud Apps in Microsoft Defender XDR Portal:
- Enabling cloud apps in the Defender XDR portal allows you to monitor and protect your cloud resources. It’s essential for integrating with Azure Blob Storage.
- Verify that you’ve correctly configured the Defender XDR portal to recognize your Azure resources.
- Configure Severity of Alerts in Defender for Endpoint Settings:
- Severity settings determine how alerts are prioritized and presented to security teams. Consider the following:
- Set appropriate severity levels for different types of alerts (e.g., critical, high, medium).
- Customize severity thresholds based on your organization’s risk tolerance and incident response capabilities.
- Set Up Streaming API in Defender for Endpoint Settings:
- Streaming API allows real-time ingestion of alerts and logs from Defender for Endpoint into external systems (like Chronicle SIEM).
- Ensure that you’ve configured the correct streaming endpoint (e.g., Azure Blob Storage) and that the necessary permissions are in place.
- Configure Chronicle SIEM to Receive Alerts from Blob Storage:
- On the Chronicle side, create a feed configuration that uses Azure Blob Storage as the source and Microsoft Defender for Endpoint as the log type.
- Ensure to check the following details:
- Blob Container: Specify the container within your storage account where the alerts will be stored.
- Log Type Mapping: Map the relevant fields from Defender for Endpoint alerts to Chronicle’s log schema.
- Scheduled Ingestion: Set up a schedule for ingesting data from Blob Storage into Chronicle.
Feedback:
· Consider using a dedicated storage account for the integration, rather than sharing it with other applications or data sources. This can improve the performance, security, and manageability of the integration.
· Consider using a managed identity to authenticate the blob storage with the Defender XDR portal, rather than using a shared access signature (SAS) token or a storage account key. This can enhance security and reduce the risk of credential compromise or expiration.
· Consider using a custom log type for the feed on the Chronicle side, rather than using the Microsoft Defender for Endpoint log type. This can allow for more flexibility and customization of data ingestion and analysis.
Do let us know if you have any further queries. I’m happy to assist you further.
Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.