Interpres Application - Microsoft Defender for Endpoint

Type: SIEM/Data Lake
Vendor: Microsoft
This app integrates with Microsoft Defender for Endpoint to execute various containment, corrective and investigative actions
Vendor setup
Login to https://portal.azure.com﻿
Search for App registrations
﻿
Click + New registration
﻿
Enter "Interpres" for the app name. Leave the other defaults (Single-tenant, no Redirect URI). Click "Register".
﻿
Copy the application (client) ID and the Directory (tenant) ID over to the Interpres integration setup page
﻿
Click Manifest

7. Replace requiredResourceAccess with the following:
﻿
JSON
"requiredResourceAccess": [
		{
			"resourceAppId": "00000003-0000-0000-c000-000000000000",
			"resourceAccess": [
				{
					"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
					"type": "Scope"
				},
				{
					"id": "34d3bd24-f6a6-468c-b67c-0c365c1d6410",
					"type": "Scope"
				},
				{
					"id": "45cc0394-e837-488b-a098-1918f48d186c",
					"type": "Role"
				},
				{
					"id": "472e4a4d-bb4a-4026-98d1-0b0d74cb74a5",
					"type": "Role"
				},
				{
					"id": "dd98c7f5-2d42-42d3-a0e4-633161547251",
					"type": "Role"
				},
				{
					"id": "dc377aa6-52d8-4e23-b271-2a7ae04cedf3",
					"type": "Role"
				},
				{
					"id": "246dd0d5-5bd0-4def-940b-0421030a5b68",
					"type": "Role"
				},
				{
					"id": "bf394140-e372-4bf9-a898-299cfc7564e5",
					"type": "Role"
				},
				{
					"id": "b0afded3-3588-46d8-8b3d-9842eff778da",
					"type": "Role"
				},
				{
					"id": "40f97065-369a-49f4-947c-6a255697ae91",
					"type": "Role"
				},
				{
					"id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61",
					"type": "Role"
				},
				{
					"id": "f8f035bb-2cce-47fb-8bf5-7baf3ecbee48",
					"type": "Role"
				},
				{
					"id": "9e640839-a198-48fb-8b9a-013fd6f6cbcd",
					"type": "Role"
				},
				{
					"id": "c7fbd983-d9aa-4fa7-84b8-17382c103bc4",
					"type": "Role"
				},
				{
					"id": "ae73097b-cb2a-4447-b064-5d80f6093921",
					"type": "Role"
				}
			]
		},
		{
			"resourceAppId": "fc780465-2017-40d4-a0c5-307022471b92",
			"resourceAccess": [
				{
					"id": "1ab96238-1253-4059-a32f-4087f20ed65d",
					"type": "Scope"
				},
				{
					"id": "e870c0c1-c1a2-41ca-948e-a33912d2d3f0",
					"type": "Role"
				},
				{
					"id": "227f2ea0-c2c2-4428-b7af-9ff40f1a720e",
					"type": "Role"
				},
				{
					"id": "6a33eedf-ba73-4e5a-821b-f057ef63853a",
					"type": "Role"
				},
				{
					"id": "02b005dd-f804-43b4-8fc7-078460413f74",
					"type": "Role"
				},
				{
					"id": "41269fc5-d04d-4bfd-bce7-43a51cea049a",
					"type": "Role"
				},
				{
					"id": "37f71c98-d198-41ae-964d-2c49aab74926",
					"type": "Role"
				},
				{
					"id": "6443965c-7dd2-4cfd-b38f-bb7772bee163",
					"type": "Role"
				},
				{
					"id": "71fe6b80-7034-4028-9ed8-0f316df9c3ff",
					"type": "Role"
				},
				{
					"id": "a833834a-4cf1-4732-8acf-bbcfa13fb610",
					"type": "Role"
				},
				{
					"id": "47bf842d-354b-49ef-b741-3a6dd815bc13",
					"type": "Role"
				},
				{
					"id": "721af526-ffa8-42d7-9b84-1a56244dd99d",
					"type": "Role"
				},
				{
					"id": "8788f1a9-beca-4e26-ba58-10513f3b896f",
					"type": "Role"
				},
				{
					"id": "ea8291d3-4b9a-44b5-bc3a-6cea3026dc79",
					"type": "Role"
				},
				{
					"id": "93489bf5-0fbc-4f2d-b901-33f2fe08ff05",
					"type": "Role"
				},
				{
					"id": "7c6f6912-60e9-4fcd-bb2a-c25bc35e8c59",
					"type": "Role"
				},
				{
					"id": "528ca142-c849-4a5b-935e-10b8b9c38a84",
					"type": "Role"
				}
			]
		}
	]
"requiredResourceAccess": [
		{
			"resourceAppId": "00000003-0000-0000-c000-000000000000",
			"resourceAccess": [
				{
					"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
					"type": "Scope"
				},
				{
					"id": "34d3bd24-f6a6-468c-b67c-0c365c1d6410",
					"type": "Scope"
				},
				{
					"id": "45cc0394-e837-488b-a098-1918f48d186c",
					"type": "Role"
				},
				{
					"id": "472e4a4d-bb4a-4026-98d1-0b0d74cb74a5",
					"type": "Role"
				},
				{
					"id": "dd98c7f5-2d42-42d3-a0e4-633161547251",
					"type": "Role"
				},
				{
					"id": "dc377aa6-52d8-4e23-b271-2a7ae04cedf3",
					"type": "Role"
				},
				{
					"id": "246dd0d5-5bd0-4def-940b-0421030a5b68",
					"type": "Role"
				},
				{
					"id": "bf394140-e372-4bf9-a898-299cfc7564e5",
					"type": "Role"
				},
				{
					"id": "b0afded3-3588-46d8-8b3d-9842eff778da",
					"type": "Role"
				},
				{
					"id": "40f97065-369a-49f4-947c-6a255697ae91",
					"type": "Role"
				},
				{
					"id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61",
					"type": "Role"
				},
				{
					"id": "f8f035bb-2cce-47fb-8bf5-7baf3ecbee48",
					"type": "Role"
				},
				{
					"id": "9e640839-a198-48fb-8b9a-013fd6f6cbcd",
					"type": "Role"
				},
				{
					"id": "c7fbd983-d9aa-4fa7-84b8-17382c103bc4",
					"type": "Role"
				},
				{
					"id": "ae73097b-cb2a-4447-b064-5d80f6093921",
					"type": "Role"
				}
			]
		},
		{
			"resourceAppId": "fc780465-2017-40d4-a0c5-307022471b92",
			"resourceAccess": [
				{
					"id": "1ab96238-1253-4059-a32f-4087f20ed65d",
					"type": "Scope"
				},
				{
					"id": "e870c0c1-c1a2-41ca-948e-a33912d2d3f0",
					"type": "Role"
				},
				{
					"id": "227f2ea0-c2c2-4428-b7af-9ff40f1a720e",
					"type": "Role"
				},
				{
					"id": "6a33eedf-ba73-4e5a-821b-f057ef63853a",
					"type": "Role"
				},
				{
					"id": "02b005dd-f804-43b4-8fc7-078460413f74",
					"type": "Role"
				},
				{
					"id": "41269fc5-d04d-4bfd-bce7-43a51cea049a",
					"type": "Role"
				},
				{
					"id": "37f71c98-d198-41ae-964d-2c49aab74926",
					"type": "Role"
				},
				{
					"id": "6443965c-7dd2-4cfd-b38f-bb7772bee163",
					"type": "Role"
				},
				{
					"id": "71fe6b80-7034-4028-9ed8-0f316df9c3ff",
					"type": "Role"
				},
				{
					"id": "a833834a-4cf1-4732-8acf-bbcfa13fb610",
					"type": "Role"
				},
				{
					"id": "47bf842d-354b-49ef-b741-3a6dd815bc13",
					"type": "Role"
				},
				{
					"id": "721af526-ffa8-42d7-9b84-1a56244dd99d",
					"type": "Role"
				},
				{
					"id": "8788f1a9-beca-4e26-ba58-10513f3b896f",
					"type": "Role"
				},
				{
					"id": "ea8291d3-4b9a-44b5-bc3a-6cea3026dc79",
					"type": "Role"
				},
				{
					"id": "93489bf5-0fbc-4f2d-b901-33f2fe08ff05",
					"type": "Role"
				},
				{
					"id": "7c6f6912-60e9-4fcd-bb2a-c25bc35e8c59",
					"type": "Role"
				},
				{
					"id": "528ca142-c849-4a5b-935e-10b8b9c38a84",
					"type": "Role"
				}
			]
		}
	]
﻿
As an alternative to Step 7, you can manually add the following permissions (as Application):
Text
Windows Defender ATP (For Microsoft Defender for Endpoint Integration Only)
--------------------
AdvancedQuery.Read.All
Alert.Read.All
File.Read.All
IntegrationConfiguration.ReadWrite
Ip.Read.All
Machine.Read.All
RemediationTasks.Read.All
Score.Read.All
SecurityBaselinesAssessment.Read.All
SecurityConfiguration.Read.All
SecurityRecommendation.Read
SecurityRecommendation.Read.All
Software.Read.All
Ti.Read.All
Url.Read.All
User.Read.All
Vulnerability.Read.All
Windows Defender ATP (For Microsoft Defender for Endpoint Integration Only)
--------------------
AdvancedQuery.Read.All
Alert.Read.All
File.Read.All
IntegrationConfiguration.ReadWrite
Ip.Read.All
Machine.Read.All
RemediationTasks.Read.All
Score.Read.All
SecurityBaselinesAssessment.Read.All
SecurityConfiguration.Read.All
SecurityRecommendation.Read
SecurityRecommendation.Read.All
Software.Read.All
Ti.Read.All
Url.Read.All
User.Read.All
Vulnerability.Read.All
﻿
Click Save
﻿
Click API permissions then Grant admin consent for YOUR_TENANT
﻿
Click Certificates & Secrets then New client secret
﻿
Enter "Interpres" for the description and choose "12 months".
﻿
Copy the client secret "Value" over to the Interpres integration setup.
App Configuration
App Parameters:
Tenant ID: Tenant ID
Client ID: Client ID
Client Secret: Client Secret
Limit Data: Optimizes performance by limiting non-essential API requests
App Validation
Check there is connectivity (green light) in the integration created.
Implemented Actions
Get Assets: Gets the machines on the network.
Get Vulnerabilites: Gets a list of active CVEs for each asset.
Get Alerts: Gets the latest triggered alerts.
Get Detections: This action processes triggered alerts (not to be confused with the detection logic). These are turned into the Interpres Detection. The detection list should contain any detection that was seen over the course of this plugin being installed.
Get Available Telemetry: Returns a list of telemetry identifiers with their current status. This is a static list.
﻿
Did this page help you?
Interpres Application - MicroFocus ArcSight ESM
Interpres Application - Microsoft Graph