Microsoft Defender XDR Integration Cyberstorage Threat Detection and XDR Automated Investigation

• Overview
• Support Statement
• Limitations
• Solution Overview
• Advanced Zero Trust Capabilities
• What is Microsoft Defender XDR?
• Integration Architecture
• Solution Configuration in Microsoft Defender XDR and Defender Zero Trust
• Prerequisites
• Configuration in Microsoft Defender XDR
• Configuration Steps on Eyeglass Virtual Machine
• High Level steps
• Configuration Step by Step
• Configure the Service start and python integration files
• Configure the python packages and customize the msxdr integration python code
• Configure Defender Zero Trust Webhooks
• How to test the Integration with Microsoft Defender XDR
• Microsoft Defender XDR SecOps administrators Integration Experience

Overview

Customers using Microsoft Defender XDR endpoint protection solution can now leverage a native integration that initiate an automated alert and investigation against a host detected as infected by Security Editions zero trust alert API.   Customers can augment the capabilities of Microsoft Defender XDR with threat intelligence and Cyber Storage capabilities of Superna Security Edition.

Support Statement

1. NOTE:  This documentation is provided "as is" without support for 3rd party software.  The level of support for this integration guide is best effort without any SLA on response time.  No 3rd party product support can be provided by Superna directly.  3rd party components require support contracts

Limitations

1. Superna Security Edition and Zero Trust integration only supports client machines registered with the XDR on boarding process that contain the same ip address information used when connecting to support storage platforms.   The matching of the threat source ip address must match an on boarded and licensed Defender XDR endpoint protection host in the XDR portal.

Solution Overview

Superna Defender Zero Trust API receive webhook alerts, parses the key information from the alert and initiates API calls to Defender XDR to match the infected host to a host registered with Defender Endpoint protection portal.   Once the host mapping has been validated an automated investigation alert is created with all the Zero trusts threat information included in the alert in the XDR portal.   The type and threat level is set to high.

Advanced Zero Trust Capabilities

1. Host Isolation - This optional feature allows an inbound Zero trust alert that contains user lockout status will also trigger a machine isolation to ensure this host can not continue to attack other systems within the IT infrastructure
   1. In order to enable this function locate the settings section in the python code provided below and change the global variable to true from false
      1. host_isolation = 'true'

What is Microsoft Defender XDR?

A SaaS offering that offers an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats and includes 3rd party integrations to provide additional threat intelligence to augment the detection vectors available to protect hosts and customer data.

Integration Architecture

Solution Configuration in Microsoft Defender XDR and Defender Zero Trust

Prerequisites

1. Installed Ransomware Defender and or Easy Auditor or Defender for AWS
2. Eyeglass OS appliance version 15.5
   1. cat /etc/os-release
3. License key for the Zero Trust API 
4. Microsoft Defender XDR
   1. client token
   2. client secret
   3. tenant token
5. Microsoft Azure application definition with correct scope and permissions to Graph Security and Defender API's

Configuration in Microsoft Defender XDR

1. You will need to register an application in Azure with API permissions to access Defender Endpoint and XDR API's.
2. Follow this guide to create the application and add API permissions.   This process will create the Authentication values need for the integration script to authenticate using oAuth 2.0.
   1. Azure Defender XDR integration application guide.
   2. See Example screenshots below.  The minimum permission needed for the integration are shown below in the 2nd screenshot.     You can find the WindowsDefenderATP application permissions in the my API's or the all application list. 
       
   3. Record the tenant, client id and secret values once the steps are completed.
   4. Done

Configuration Steps on Eyeglass Virtual Machine

High Level steps

1. Create python location to run the application on the Eyeglass vm
2. Create python main application script
3. Create linux systemd service and set to auto start
4. Create Zero Trust configuration in Defender
5. Update the main script to customize with Microsoft Defender XDR  python code
6. Test the script is running as a service
7. Create a test event in Defender to validate the alerts appear as indexed parsed events in Microsoft Defender XDR

Configuration Step by Step

Configure the Service start and python integration files

Configure the python packages and customize the msxdr integration python code

1. Customize the application code by downloading the python code from this link to download
   3. Open the python template file in a text editor. NOTE: make sure to only replace the values and do not delete any of the commas
   4. Locate this section in the file and replace the yellow sections with the values created above in the XDR authentication configuration section.
      3. # Tenant ID, Client ID, and Client Secret
      4. tenant_id = "xxxxxxxxx"
      5. client_id = "yyyyyyy"
      6. client_secret = "zzzzzzzzzz"
   5. nano /opt/superna/cgi-bin/msxdr.py
   6. Open the file locally in Windows OS notepad and use control-A or select all the text.
   7. Paste the clipboard into the ssh terminal session with the open nano editor file
   8. save the file
      3. press control+x
      4. Answer yes to save and exit the nano editor 
2. Start the service and verify it is running
   1. systemctl start msxdr
   2. systemctl status -l msxdr 
   3. Verify the service is started successfully and returns "active and running".
   4. 
      
3. If the service does not start do not proceed and double check the steps above are completed. 

Configure Defender Zero Trust Webhooks

1. The next step creates an Zero Trust Webhook URL.    
   
   1. Configure Zero Trust endpoint in Ransomware Defender Zero Trust tab.
      1. Recommended Configuration: Only Critical and Major events and only the webhooks that set lockout or delayed lockout.   Customers can customize based on specific requirements. The goal is to send findings versus a list of alarms that do not pinpoint a security incident.
      2.   
      3. The endpoint url above will use localhost and will send Webhooks to the application service listening on port 5000. URL to use in the configuration
         1. http://localhost:5000/defenderxdr 
         2. Add the Content-Type header with value of application/json as shown above to complete the webhook configuration.
         3. Click save to commit the configuration.
         4. Click save on the main Webhook configuration page
2. Test the configuration is working following the next section

How to test the Integration with Microsoft Defender XDR

1. To test the integration follow these steps
   1. download this curl command template and open with a text editor
   2. Copy all the text
   3. ssh to the eyeglass vm as the admin user
   4. paste the entire cli command to the ssh prompt to send sample data to the running Zero Trust application.  This will send test data directly to the application to be processed and sent to Microsoft Defender XDR.
   5. The output of a successfully processed webhook test will return this text in the ssh terminal
      1. done sending event to msxdr and check for http 200 and success count in response
   6. How to review the process logs from the web application
      1. sudo -s 
      2. journalctl -f -u msxdr 
      3. This allows you to view the logs generated by the application.
      4. To log to a file and review with nano showing only the most recent 250 lines.
      5. journalctl -f -n 250 -u msxdr  > /tmp/ztwebhook.log
      6. nano /tmp/msxdr.log
      7. In the log below the response code from the Microsoft Defender XDR api call should show http 200 status code and successCount 1 to indicate the Finding was successfully created.
      8.   You can also view msxdrd.log for specific error messages.
   7. Login to the Microsoft Defender XDR Main Dashboard and view the Alerts tab to view the investigation against the infected host computer detected by Superna Security Edition Zero Trust API integration.
   8.  
2. Done

Microsoft Defender XDR SecOps administrators Integration Experience

1. Once the integration has been tested, machine automated investigation alerts can be viewed from the alerts Dashboard.
2. The investigation steps and assigning to a Secops analyst and login to Security Edition to view details of the incident.
3.  
4.  
5.  
6. Advanced Host Isolation if enabled will update the incident to indicate Host Isolation has been initiated.
   1.  
7. When the host has been remediated and is authorized to re-join the network Microsoft Defender endpoint XDR can release the host isolation command.
   1.