Microsoft defender integration with other SOAR tool

Gaurav Saxena 0 Reputation points
2023-01-27T11:10:20.0866667+00:00

I want to integrate Microsoft defender with the SOAR tool. Appreciate if any guide can be shared for the integration. Using Qradar

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,199 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Catherine Kyalo 570 Reputation points Microsoft Employee
    2024-02-14T08:47:16.1533333+00:00

    HI @Gaurav Saxena ,

    To integrate Microsoft Defender for Endpoint with QRadar, you can use the Microsoft Defender for Endpoint APIs to fetch various security alerts and incidents.

    Here's a high-level overview of how to do this:

    1. Use QRadar's Log Source Management tool to create a new log source.
    2. Select Microsoft Defender ATP from the list of log source types.
    3. Enter the required credentials for your Microsoft Defender ATP instance.
    4. Configure the log source parameters, such as the polling interval.
    5. Save the configuration.

    You can also use the QRadar REST API to automate this process. Here's a link to the Microsoft Defender for Endpoint API documentation: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp And here's a link to the QRadar REST API documentation: https://www.ibm.com/docs/en/qradar/7.3.3?topic=api-restful-apis

    0 comments