Collect Microsoft Defender for Identity logs

This document explains how to ingest the Microsoft Defender for Identity logs to Google Security Operations using Azure Storage. The parser processes JSON logs, or CEF formatted logs if the JSON parsing fails. It extracts fields, performs data transformations such as string conversions, renaming, and merging, and maps them to the Unified Data Model (UDM), handling various log formats and enriching the data with additional context like labels and authentication details.

Before you begin

Make sure you have the following prerequisites:

• Google SecOps instance
• active Azure tenant
• Privileged access to Azure and Administrative Security role

Configure Azure Storage account

1. In the Azure console, search for Storage accounts.
2. Click Create.
3. Specify values for the following input parameters:
   • Subscription: select the subscription.
   • Resource Group: select the resource group.
   • Region: select the region.
   • Performance: select the type of performance (Standard recommended).
   • Redundancy: select the type of redundancy (GRS or LRS recommended).
   • Storage account name: enter a name for the new Storage account.
4. Click Review + create.
5. Review the overview of the account and click Create.
6. From the storage account Overview page, select submenu Access keys in Security + networking.
7. Click Show next to key1 or key2.
8. Click Copy to clipboard to copy the key.
9. Save the key in a secure location for future reference.
10. From the storage account Overview page, select submenu Endpoints in Settings.
11. Click Copy to clipboard to copy the Blob service endpoint URL. (for example, https://<storageaccountname>.blob.core.windows.net).
12. Save the endpoint URL in a secure location for future reference.
13. Go to Overview > JSON View.
14. Copy and save the Storage Resource ID.

Configure Log Export for Microsoft Defender for Identity

1. Sign in to the Defender Portal using a privileged account.
2. Go to Settings.
3. Select the Microsoft Defender XDR tab.
4. Select Streaming API from the general section and click Add.
5. Select Forward events to Azure Storage.
6. Provide the following configuration details:
   • Name: Enter a unique and meaningful name.
   • Select Forward events to Azure Storage.
   • Storage Account Resource ID: Enter the Azure Storage resource ID copied earlier.
   • Event Types: Select both Alerts & Behaviors and Devices.
7. Click Submit.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New Feed
• Content Hub > Content Packs > Get Started

How to set up the Microsoft Defender for Identity feed

1. Click the Microsoft Defender pack.

2. Specify the following values:

   • Source Type: Microsoft Azure Blob Storage V2.

   • Azure uri: the blob endpoint URL.

     ENDPOINT_URL/BLOB_NAME

     Replace the following:

     • ENDPOINT_URL: the blob endpoint URL. (https://<storageaccountname>.blob.core.windows.net)
     • BLOB_NAME: the name of the blob. (such as, insights-logs-<logname>)

   • Source deletion options: select deletion option according to your preference.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed.
   • Ingestion Labels: Labels applied to all events from this feed.

3. Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.