Microsoft Defender for Endpoint Content Pack

The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.

Microsoft Defender for Endpoint is an industry-leading, cloud-powered endpoint security solution that helps to secure against ransomware, file-less malware, and other sophisticated attacks on Windows, macOS, Linux, Android, and iOS.

Supported Versions

• Graylog Server 5.2 or later

Requirement(s)

• Microsoft Defender for Endpoint Plan 1 or Plan 2.

• Graylog Server with a valid Enterprise license.

Stream Configuration

This technology pack includes 1 stream:

• "Illuminate:Microsoft Defender for Endpoint Messages"

Hint: If this stream does not exist prior to the activation of this pack then it is created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index Set Configuration

This technology pack includes 1 index set definition:

• "Microsoft Defender for Endpoint Logs"

Hint: If this index set is already defined, then nothing is changed. If this index set does not exist, then it is created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.

Log Collection and Delivery

Microsoft Defender for Endpoint utilizes the Graylog Microsoft Defender for Endpoint input that ingests alert logs in JSON format. Documentation detailing the configuration of this input can be found in the Graylog documentation.

Due to how Illuminate processes nested arrays, for each evidence entityType (Process, User, IP, File, URL), only one result per entityType is processed by Illuminate. Additional results can still be seen in the evidence_array field and GIM-specific fields such as user_name, file_name, and file_path.

Log Format Example

{"id":"da20708b1e-8554-4ec8-b59c-925c4663aa3a_1","incidentId":2,"investigationId":null,"assignedTo":null,"severity":"Medium","status":"New","classification":null,"determination":null,"investigationState":"UnsupportedAlertType","detectionSource":"WindowsDefenderAtp","detectorId":"7f1c3609-a3ff-40e2-995b-c01770161d68","category":"Execution","threatFamilyName":null,"title":"Suspicious PowerShell command line","description":"A suspicious PowerShell activity was observed on the machine.","alertCreationTime":"2023-04-06T10:41:43.691043Z","firstEventTime":"2023-04-06T10:39:00.7407597Z","lastEventTime":"2023-04-06T10:42:49.3567967Z","lastUpdateTime":"2023-04-06T10:45:41.5166667Z","resolvedTime":null,"machineId":"31328158e55872c03a1b5ec4c96744cbb82c8f4b","computerDnsName":"win-tfb8l7bi77h","rbacGroupName":"UnassignedGroup","aadTenantId":"df620235-50d7-4400-bb7e-3b112e9b1ff4","threatName":null,"mitreTechniques":["T1059.001","T1105","T1140"],"relatedUser":{"userName":"Administrator","domainName":"WIN-TFB8L7BI77H"},"loggedOnUsers":[{"accountName":"testuser","domainName":"DESKTOP-IIQVPJ7"}],"comments":[{"comment":"test comment","createdBy":"secop123@contoso.com","createdTime":"2020-07-21T01:00:37.8404534Z"}],"evidence":[{"entityType":"Process","evidenceCreationTime":"2023-04-06T10:45:41.51Z","sha1":"6cbce4a295c163791b60fc23d285e6d84f28ee4c","sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","fileName":"powershell.exe","filePath":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0","processId":10520,"processCommandLine":"powershell.exe -NoExit -ExecutionPolicy Bypass","processCreationTime":"2023-04-06T10:42:49.2635644Z","parentProcessId":5212,"parentProcessCreationTime":"2023-04-06T10:40:44.9749107Z","parentProcessFileName":"cmd.exe","parentProcessFilePath":"C:\\Windows\\System32","ipAddress":null,"url":null,"accountName":"Administrator","domainName":"WIN-TFB8L7BI77H","userSid":"S-1-5-21-3669279935-616031708-4259075843-500","aadUserId":null,"userPrincipalName":null,"detectionStatus":"Detected"},{"entityType":"Ip","evidenceCreationTime":"2023-04-06T10:41:43.81Z","ipAddress":"10.10.10.173","url":null,"detectionStatus":null}],"domains":[]}

What is Provided

• Field extraction, normalization, and message enrichment for Microsoft Defender for Endpoint alert log messages.

• Graylog Information Model categorization and enforcement fields for alert events.

• Illuminate Spotlight: Microsoft Defender for Endpoint Overview dashboard and saved search.

GIM Categorization

GIM event type categorization is provided for the following message types:

Log Type	gim_event_type_code	gim_event_category	gim_event_subcategory	gim_event_type
Defender for Endpoint Alerts (all)	300000	detection	detection.network_detection	ids_detection

Fields Extracted by This Pack

Alert Fields

Fields extracted from the root-level alert JSON object.

Evidence Entity Fields

Fields extracted from alert evidence entities. Only one entry per entity type (Process, File, IP, User, URL) is processed.

Microsoft Defender for Endpoint Content Pack

This spotlight offers a dashboard with 2 tabs:

Overview

Saved Search