This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Tech Community.
The legacy Microsoft Defender for Endpoint SIEM API is being deprecated next month:
- We published a Message Center notification in January 2022 to customers who are still calling the SIEM API announcing the API deprecation date of March 1st, 2022.
If you didn't receive that Message Center post, and you don't have any applications or systems calling the SIEM API - you won't be affected and can stop reading.
Other actions we've taken to address this upcoming change:
- Updated online documentation of SIEM Tool Integration to reflect this change in December 2021 and ceased enabling new customer onboarding to the SIEM API.
- Our SIEM partner, IBM QRadar placed a deprecation notification on their Microsoft connector pages that calls that API and published a new connector (aka DSM) that calls the Microsoft 365 Defender Event Streaming API and ingests alert metadata from the AlertInfo and the AlertsEvidence tables.
- Splunk's Microsoft 365 Defender Add-on for Splunk v1.3.0 and Microfocus ArcSight's SmartConnector for Microsoft 365 Defender already call Microsoft 365 Defender's Incidents API - and Splunk's Add-on also supports the Microsoft Defender for Endpoint Alerts API. The previous connectors that called the SIEM API are no longer supported, and customers are expected to upgrade to the latest version.
Among the customers who are still calling the SIEM API, 50% are also calling either the Microsoft 365 Defender Incidents API, the Defender for Endpoint Alerts API, or the Graph Security Alerts API - which means they have already integrated with the two recommended APIs to migrate to.
Read on below about migration paths from the Microsoft Defender for Endpoint SIEM API to Microsoft 365 Defender Incidents API, Microsoft Defender for Endpoint's Alerts API, or Microsoft 365 Defender's Event Streaming API.
Each migration path has a table mapping fields from the SIEM API onto either the Incidents API, the Alerts API, or the Events Streaming API.
1. Migrating from the SIEM API to the Microsoft 365 Defender Incidents API (figure 1)
Fields no longer supported in current Microsoft 365 Defender Incident alert metadata:
- Defender AV fields: RemediationAction (threatCategory maps to mitreTechniques[ ])
- Tags: DeviceCreatedMachineTags, CloudCreatedMachineTags map onto devices/tags[ ]
- TI fields: IocName, IocValue, IoaDefinitionId, IocUniqueId (were mostly unused)
- Device IPs: InternalIPv4List, InternalIPv6List
- Links to Alert in Portal and to Incident in Portal (can be created with URL template)
Figure 1. Mapping SIEM API fields on to Microsoft 365 Defender Incident API fields
2. Migrating from the SIEM API to Defender for Endpoint Alert API (figure 2)
Fields no longer supported in Microsoft Defender for Endpoint Alert:
- Defender AV fields: ThreatCategory, RemediationAction, RemediationIsSuccess
- Machine Tags: DeviceCreatedMachineTags, CloudCreatedMachineTags
- TI fields: Actor, IocName, IocValue, IoaDefinitionId, IocUniqueId
- Device IPs: InternalIPv4List, InternalIPv6List
- Links to Alert in Portal and to Incident in Portal (can be created with URL template)
Figure 2. Mapping SIEM API fields on to Defender for Endpoint Alerts API fields
- Let's try mapping fields in the other direction: from Microsoft Defender for Endpoint Alerts API to the SIEM API:
Figure 3. Mapping Defender for Endpoint Alerts API fields on to SIEM API fields
- As you can see, there's a lot more data in the Microsoft Defender for Endpoint Alerts API...
3. Migrating from the SIEM API to Microsoft 365 Defender Event Streaming API (see Appendix D).
Fields that do not appear in the Event Streaming API AlertInfo and AlertEvidence tables
- Defender AV fields: ThreatCategory, RemediationAction, RemediationIsSuccess
- Machine Tags: DeviceCreatedMachineTags, CloudCreatedMachineTags
- TI fields: Actor, IocName, IocValue, IoaDefinitionId, IocUniqueId
- Device IPs: InternalIPv4List, InternalIPv6List
- Links to Alert in Portal and to Incident in Portal (can be created with URL template)
Figure 4. Mapping SIEM API fields on to Microsoft 365 Defender Streaming API Alert fields
4. Migrating when using SIEMs – upgrade from obsolete connectors to the new connectors
- Splunk: Update the legacy Splunk SIEM API Add-on that calls the Microsoft Defender for Endpoint SIEM API to the Microsoft 365 Defender Add-on for Splunk v1.3.0 that calls the Microsoft 365 Defender Incidents API and also supports calling the Microsoft Defender for Endpoint Alerts API.
Note: Splunk also supports ingesting the Microsoft 365 Defender Streaming API (see figure 4) - MicroFocus ArcSight: Update the legacy MicroFocus ArcSight FlexConnector that calls the Microsoft Defender for Endpoint SIEM API (no longer available/supported by ArcSight) to the new ArcSight SmartConnector for Microsoft 365 Defender that calls the Microsoft 365 Defender Incidents API.
- IBM QRadar: Update the legacy QRadar DSM calling MDE SIEM API to the QRadar Microsoft 365 Defender Streaming API DSM (AlertsInfo + AlertsEvidence event types).
Note: This integration requires Azure Event Hubs or Azure Storage Account.
Thank you,
Microsoft 365 Defender Team