Microsoft Defender Documentation

The Defender for Cloud CLI is a developer-focused command-line tool designed to orchestrate security scans both locally on developer terminals and within CI/CD pipelines (such as GitHub Actions, Azure DevOps, Jenkins, and Bitbucket).

Key capabilities include:

• Universal Scanning: Run security scans from any environment with minimal configuration.
• Scanner Orchestration: Unify multiple security engines (e.g., container image analysis) under a single tool with consistent output and exit codes.
• Cloud Integration: Automatically upload findings to Microsoft Defender for Cloud to gain code-to-runtime visibility, attack-path context, and centralized prioritization.
• Developer Experience: Provides concise console output and actionable remediation guidance designed for pipelines and pull requests.

You can use the Microsoft Sentinel Logstash output plugin to stream logs from external data sources into custom or standard tables in Microsoft Sentinel or Log Analytics. This method uses Data Collection Rules (DCRs) to provide full control over the output schema, allowing you to:

• Define specific column names and data types.
• Perform ingestion-time transformations, such as filtering or enrichment.
• Ingest custom logs into custom tables or Syslog streams into the standard Log Analytics Syslog table.

Note: This feature is currently in public preview and is provided without an SLA. The plugin sends JSON-formatted data to your workspace using the Logs Ingestion API.

The Dragos connector allows Dragos Platform notification data to be viewed in Microsoft Sentinel for triaging OT cyber threat events.

Supported Log Analytics Tables

Prerequisites

• Dragos Sitestore API access: A user account with notification:read permission and an API key.

The Defender for Endpoint settings menu allows you to manage the following functional areas:

• General settings: Modify settings that were defined during the initial onboarding process.
• Permissions: Manage portal access using Role-Based Access Control (RBAC) and device groups.
• APIs: Enable threat intelligence and SIEM (Security Information and Event Management) integrations.
• Rules: Configure suppression rules and automation settings.
• Device management: Perform onboarding and offboarding of devices.
• Network assessments: Select specific devices to be scanned regularly and added to the device inventory.

The DNS log connector connects DNS analytic and audit logs with Microsoft Sentinel to identify malicious domain resolutions, stale resource records, and DNS server load.

Supported Log Analytics Tables

Data Collection Rule Support

Supports Workspace transform DCR.

You can connect ServiceNow to Microsoft Defender for Cloud Apps to monitor user activity, detect anomalous behavior, and identify sensitive data exposure. This connection helps mitigate threats such as compromised accounts, insider threats, data leakage, and unmanaged BYOD devices.

Key protection capabilities include:

• Threat Detection: Identifying compromised accounts and malicious insiders using machine-learning anomaly detection.
• Data Protection: Discovering, classifying, and labeling regulated or sensitive data (e.g., PII, PCI, PHI).
• Compliance Enforcement: Applying DLP (Data Loss Prevention) and collaboration policies.
• Forensics: Utilizing activity audit trails for investigations.

The Armis Device connector ingests device information from the Armis platform into Microsoft Sentinel via the Armis REST API. It uses Armis's agentless discovery capabilities to identify managed and unmanaged devices.

Data Ingestion Details:

• Log Analytics Table: Armis_Devices_CL
• DCR Support: Not currently supported.
• Lake-only ingestion: No.

Prerequisites:

• Permissions: Microsoft.Web/sites permissions (Read/Write) to create Azure Function Apps.
• Credentials: An Armis Secret Key (obtainable from Armis Settings > API Management).
• Parser: This connector requires a Kusto Function parser. You must create the Kusto functions alias ArmisDevice by following the instructions at https://aka.ms/sentinel-ArmisDevice-parser.

You can integrate Microsoft Defender for Cloud Apps with a generic SIEM server to centralize monitoring of alerts and activities from connected apps. This allows for automated security procedures and correlation between cloud and on-premises events.

How it works: A SIEM agent runs on your server, pulls alerts and activities from Microsoft Defender for Cloud Apps using RESTful APIs, and streams them to your SIEM via Syslog messages.

Data Forwarding Behavior:

• Upon initial integration, the agent forwards activities and alerts from the last two days.
• For all subsequent data, it forwards alerts and activities based on the filters configured during setup.
• If integration is disabled for an extended period and then re-enabled, the agent will again forward the past two days of data before continuing with real-time data.

A File policy is an API-based policy used to control organizational content in the cloud. It uses over 20 file metadata filters (such as owner and sharing level) and content inspection results to trigger governance actions.

Each policy consists of four main components:

• File filters: Granular conditions based on file metadata.
• Content inspection: Narrows policies based on DLP (Data Loss Prevention) engine results. You can use custom or preset expressions, set exclusions, define the number of matches required, and use anonymization to mask usernames.
• Actions: Automated governance actions applied when violations are found. These are categorized into collaboration actions, security actions, and investigation actions.
• Extensions: Allows content inspection via 3rd-party engines for enhanced DLP or anti-malware capabilities.