Collect Microsoft Defender for Endpoint logs

This document describes how you can collect Microsoft Defender for Endpoint logs by setting up a Google Security Operations feed and how log fields map to Google SecOps unified data model (UDM) fields.

For more information, see Data ingestion to Google SecOps.

A typical deployment consists of Microsoft Defender for Endpoint and the Google SecOps feed configured to send logs to Google SecOps. Your deployment might be different from the typical deployment that is described in this document. The deployment contains the following components:

• Microsoft Defender for Endpoint: The platform that collects logs.

• Azure Storage: The platform that stores logs.

• Google SecOps feed: The Google SecOps feed that fetches logs from Microsoft Defender for Endpoint and writes logs to Google SecOps.

• Google SecOps: The platform that retains and analyzes the logs from Microsoft Defender for Endpoint.

An ingestion label identifies the parser that normalizes raw log data to structured UDM format. The information in this document applies to the parser with the MICROSOFT_DEFENDER_ENDPOINT ingestion label.

Before you begin

Ensure you have the following prerequisites:

• All systems in the deployment architecture are configured with the UTC time zone.
• You meet the prerequisites for using Microsoft Defender for Endpoint. For more information, see Microsoft Defender XDR prerequisites.
• Configured Microsoft Defender for Endpoint
• A configured storage account in your tenant. To configure the storage account, see Configure Azure Storage account. For a general overview of storage accounts, see Microsoft Azure storage account overview.

Configure Azure Storage account

This section describes how to configure and deploy an Azure Storage account in Microsoft Azure.

Create storage account

Before you begin, ensure that your resource group has been successfully deployed in your Azure environment.

1. In the Azure portal, search for Storage accounts.
2. Click Create.

3. Provide the following configuration details under the Basics tab:

   Setting	Value
   Subscription	Select your Azure subscription.
   Resource group	Select the deployed resource group.
   Storage account name	Enter a globally unique name between 3 and 24 characters, using lowercase letters and numbers only.
   Region	Select the region closest to your users or workloads.
   Primary service	Select the primary service, such as Azure Blob Storage or Azure Data Lake Storage Gen2.
   Performance	Select Standard (recommended for most scenarios) or Premium (for low-latency workloads).
   Redundancy	Select the replication option based on your availability requirements (for example, Locally-redundant storage (LRS)).

4. Click Review + create.

5. After validation passes, click Create to deploy the Storage Account.

Set up Microsoft Defender for Endpoint

1. Sign in to security.microsoft.com as a global administrator or security administrator.
2. In the left pane, click Settings.
3. Select the Microsoft Defender XDR tab.
4. Select Streaming API from the general section and click Add.
5. Select Forward events to Azure Storage.
6. Navigate to the storage account of your choice.
7. Select Overview > JSON View and enter the Resource ID.
8. After you enter the resource ID, select all the required data types.
9. Click Save.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New Feed
• Content Hub > Content Packs > Get Started

How to set up the Microsoft Defender for Endpoint feed

1. Click the Microsoft Defender pack.
2. Locate the Microsoft Defender for Endpoint log type.

3. Specify values in the following fields:

   • Source Type: Microsoft Azure Blob Storage V2.
   • Azure URI: The URI pointing to an Azure Blob Storage blob or container.
   • Source deletion option: whether to delete files or directories after transferring.
   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.
   • Select Shared key or SAS token.
   • Key: The shared key or SAS token to access Azure resources.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed.
   • Ingestion Labels: Labels applied to all events from this feed.

4. Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

Supported Microsoft Defender for Endpoint log types

The Microsoft Defender for Endpoint parser supports the following tables:

Supported Microsoft Defender for Endpoint log formats

The Microsoft Defender for Endpoint parser supports logs in JSON format.

Supported Microsoft Defender for Endpoint sample logs

• JSON:

  {
    "time": "2021-07-16T09:57:38.1599837Z",
    "tenantId": "ed236696-8612-40d7-8b49-xxxxxxxxxxx",
    "operationName": "Publish",
    "category": "AdvancedHunting-DeviceInfo",
    "properties": {
      "OSBuild": null,
      "RegistryDeviceTag": null,
      "IsAzureADJoined": null,
      "PublicIP": "198.51.100.0",
      "OSArchitecture": null,
      "OSVersion": null,
      "OSPlatform": null,
      "LoggedOnUsers": "[{\\"UserName\\":\\"bob\\",\\"DomainName\\":\\"DESKTOP-BOB\\",\\"Sid\\":\\"S-1-5-21-1695909852-106810125-1651530144-1001\\"}]",
      "AdditionalFields": "{\\"IsLocalLogon\\":true}",
      "DeviceObjectId": null,
      "DeviceId": "e93c25ad74cc1dd30afeb642696a2559824589e5",
      "MachineGroup": null,
      "Timestamp": "2021-07-16T09:54:41.0662159Z",
      "DeviceName": "desktop-dummy",
      "ReportId": 193010,
      "ClientVersion": "10.7431.19041.746"
    }
  }
  

Field mapping reference

This section explains how the Google Security Operations parser maps Microsoft Defender for Endpoint fields to Google Security Operations UDM fields.

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - Common Fields for UDM Event Model

The following table lists the common log fields for the MICROSOFT_DEFENDER_ENDPOINT log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - Common Fields for UDM Entity Model

The following table lists the common log fields for the MICROSOFT_DEFENDER_ENDPOINT log type and their corresponding UDM fields:

Field mapping reference: DeviceEvents Event Identifier to Event Type

The following table lists the DeviceEvents log action types and their corresponding UDM event types.

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceEvents

The following table lists the log fields for the DeviceEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - AlertEvidence

The following table lists the log fields for the AlertEvidence log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - AlertInfo

The following table lists the log fields for the AlertInfo log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceAlertEvents

The following table lists the log fields for the DeviceAlertEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceFileCertificateInfo

The following table lists the log fields for the DeviceFileCertificateInfo log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceImageLoadEvents

The following table lists the log fields for the DeviceImageLoadEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

The following table lists the log fields for the DeviceFileEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceInfo

The following table lists the log fields for the DeviceInfo log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - IdentityLogonEvents

The following table lists the log fields for the IdentityLogonEvents log type and their corresponding UDM fields:

Field mapping reference: IdentityDirectoryEvents Event Identifier to Event Type

The following table lists the IdentityDirectoryEvents log action types and their corresponding UDM event types.

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - IdentityDirectoryEvents

The following table lists the log fields for the IdentityDirectoryEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - EntraIdSignInEvents

The following table lists the log fields for the EntraIdSignInEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

The following table lists the log fields for the DeviceLogonEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceNetworkEvents

The following table lists the log fields for the DeviceNetworkEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceNetworkInfo

The following table lists the log fields for the DeviceNetworkInfo log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceProcessEvents

The following table lists the log fields for the DeviceProcessEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

The following table lists the log fields for the DeviceTvmInfoGathering log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceRegistryEvents

The following table lists the log fields for the DeviceRegistryEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGatheringKB

The following table lists the log fields for the DeviceTvmInfoGatheringKB log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessment

The following table lists the log fields for the DeviceTvmSecureConfigurationAssessment log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSecureConfigurationAssessmentKB

The following table lists the log fields for the DeviceTvmSecureConfigurationAssessmentKB log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareEvidenceBeta

The following table lists the log fields for the DeviceTvmSoftwareEvidenceBeta log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareInventory

The following table lists the log fields for the DeviceTvmSoftwareInventory log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilities

The following table lists the log fields for the DeviceTvmSoftwareVulnerabilities log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilitiesKB

The following table lists the log fields for the DeviceTvmSoftwareVulnerabilitiesKB log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - EmailAttachmentInfo

The following table lists the log fields for the EmailAttachmentInfo log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - EmailEvents

The following table lists the log fields for the EmailEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - EmailPostDeliveryEvents

The following table lists the log fields for the EmailPostDeliveryEvents log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - EmailUrlInfo

The following table lists the log fields for the EmailUrlInfo log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - IdentityInfo

The following table lists the log fields for the IdentityInfo log type and their corresponding UDM fields:

Field mapping reference: MICROSOFT DEFENDER ENDPOINT - CloudAppEvents

The following table lists the log fields for the CloudAppEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference

This section explains how the Google Security Operations parser maps nested fields from the AdditionalFields raw log field for Microsoft Defender for Endpoint to Google Security Operations UDM fields.

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - AlertEvidence

The following table lists the AdditionalFields log fields for the AlertEvidence log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceEvents

The following table lists the AdditionalFields log fields for the DeviceEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

The following table lists the AdditionalFields log fields for the DeviceTvmInfoGathering log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - CloudAppEvents

The following table lists the AdditionalFields log fields for the CloudAppEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - IdentityLogonEvents

The following table lists the AdditionalFields log fields for the IdentityLogonEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - EmailEvents

The following table lists the AdditionalFields log fields for the EmailEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceInfo

The following table lists the AdditionalFields log fields for the DeviceInfo log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

The following table lists the AdditionalFields log fields for the DeviceLogonEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

The following table lists the AdditionalFields log fields for the DeviceFileEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceProcessEvents

The following table lists the AdditionalFields log fields for the DeviceProcessEvents log type and their corresponding UDM fields:

AdditionalFields mapping reference: MICROSOFT DEFENDER ENDPOINT - DeviceNetworkEvents

The following table lists the AdditionalFields log fields for the DeviceNetworkEvents log type and their corresponding UDM fields:

UDM Mapping Delta

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT

The following tables list the delta between the Old UDM Mapping of Microsoft Defender Endpoint and the New UDM Mapping of Microsoft Defender Endpoint.

UDM Mapping Delta reference: DeviceEvents Event Identifier to Event Type

The following table lists the delta of DeviceEvents log action types and their corresponding UDM event types.

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - DeviceEvents

The following table lists the delta of log fields for the DeviceEvents log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - AlertEvidence

The following table lists the delta of log fields for the AlertEvidence log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - AlertInfo

The following table lists the delta of log fields for the AlertInfo log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - DeviceFileCertificateInfo

The following table lists the delta of log fields for the DeviceFileCertificateInfo log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - DeviceFileEvents

The following table lists the delta of log fields for the DeviceFileEvents log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - DeviceLogonEvents

The following table lists the delta of log fields for the DeviceLogonEvents log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmInfoGathering

The following table lists the delta of log fields for the DeviceTvmInfoGathering log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - DeviceRegistryEvents

The following table lists the delta of log fields for the DeviceRegistryEvents log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - DeviceTvmSoftwareVulnerabilitiesKB

The following table lists the delta of log fields for the DeviceTvmSoftwareVulnerabilitiesKB log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - EmailEvents

The following table lists the delta of log fields for the EmailEvents log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - EmailPostDeliveryEvents

The following table lists the delta of log fields for the EmailPostDeliveryEvents log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - IdentityInfo

The following table lists the delta of log fields for the IdentityInfo log type and their corresponding UDM fields:

UDM Mapping Delta reference: MICROSOFT DEFENDER ENDPOINT - IdentityLogonEvents

The following table lists the delta of log fields for the IdentityLogonEvents log type and their corresponding UDM fields:

What's next

• Data ingestion to Google SecOps

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.