Microsoft Windows Defender Advanced Threat Protection (ATP)
- Integration points
- Configuring Windows Defender for FortiSIEM REST API Access
- Configuring FortiSIEM for Windows Defender ATP REST API Access
Integration points
| Protocol | Information Discovered | Used For |
|---|---|---|
| Windows Defender API REST API | Security and Compliance |
Configuring Windows Defender for FortiSIEM REST API Access
Microsoft provides ample documentation here.
Follow the steps specified in 'Enabling SIEM integration', repeated here.
- Login to Windows Defender Center.
- Go to Settings > SIEM.
- Select Enable SIEM integration.
- Choose Generic API.
- Click Save Details to File.
- Click Generate Tokens.
Configuring FortiSIEM for Windows Defender ATP REST API Access
Use the account in previous step to enable FortiSIEM access.
- Login to FortiSIEM.
- Go to ADMIN > Setup > Credential.
- Click New to create Windows Defender REST API credential:
- Choose Device Type = Microsoft Windows Defender ATP (Vendor = Microsoft, Model = Windows Defender ATP).
- Choose Access Protocol = Windows Defender ATP Alert REST API.
- Enter the Tenant ID for the credential created in Section 10.2.
- Password Config: for Manual, enter the Client ID and Client Secret for the credential created here. For CyberArk, see CyberArk Password Configuration.
- Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers.
- Click Save.
- Enter an IP Range to Credential Association:
- Set Hostname to
wdatp-alertexporter-us.windows.com. - Select the Credential created in step 3 above.
- Click Save.
- Set Hostname to
- Select the entry in step 4 and click Test Connectivity. If it succeeds, then the credential is correct.
- An entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from Windows Defender Center using the REST API.
To test for events received via Windows Defender ATP REST API:
- Go to ADMIN > Setup > Pull Events.
- Select the Windows Defender ATP entry and click Report.
The system will take you to the Analytics tab and run a query to display the events received from Windows Defender Center in the last 15 minutes. You can modify the time interval to get more events.