Knowledge BaseRelease NotesRequest Demo

Microsoft Graph Logs

Panther supports pulling logs directly from Microsoft Graph API

Overview

Panther has the ability to fetch Microsoft Graph logs by querying the Microsoft Graph API to obtain security alerts from the following Microsoft security products:

  • Azure Active Directory Identity Protection

  • Azure Information Protection

  • Microsoft 365 (Default, Cloud App Security, Custom Alerts)

  • Microsoft Defender for Cloud Apps

  • Microsoft Defender for Endpoint

  • Microsoft Defender for Identity

  • Microsoft Sentinel (formerly Azure Sentinel)

How to onboard Microsoft Graph logs to Panther

Prerequisites

  • Microsoft Defender for Endpoint and Identity alerts require additional user configuration prior to streaming alerting events to Panther. See Microsoft's documentation for more information.

  • Microsoft Defender for Endpoint requires additional user roles to those required by the Microsoft Graph Security API. Only the users in both Microsoft Defender for Endpoint and Microsoft Graph Security API roles can have access to the Microsoft Defender for Endpoint data. Because application-only authentication is not limited by this, we recommend that you use an application-only authentication token.

  • Microsoft Defender for Identity alerts are available via the Microsoft Defender for Cloud Apps integration. This means you will get Microsoft Defender for Identity alerts only if you have joined Unified SecOps and connected Microsoft Defender for Identity into Microsoft Defender for Cloud Apps.

Step 1: Create a Microsoft Entra ID application

  1. Log in to your Azure portal and navigate to the Microsoft Entra ID service. A "Services" header is shown, and under it, Microsoft Entra ID is highlighted

  2. Click App Registrations in the left sidebar.

  3. Click New Registration.

  4. Fill in the fields:

    • Enter a descriptive name for your application.

    • For Supported account types, select Accounts in this organizational directory only.

  5. Click Register.

  6. On the left sidebar, click Certificates and Secrets.

  7. Click New Client Secret.

    • Add a description for the secret (e.g., Panther integration).

    • Set the Expires field to 24 Months.

  8. Click Add.

    • The Client Secret is hidden after you navigate away from this page; copy down the Value field and store it in a secure location - you will use this as your Client Secret value in Step 2.

  9. On the left sidebar, click API Permissions and then Add a permission.

  10. Find and click the Microsoft Graph APIs.

  11. Click Delegated permissions and select the SecurityEvents.Read.All permission.

  12. Click Application permissions and select the SecurityEvents.Read.All permission.

  13. Click Add permissions at the bottom of the page.

  14. Click Grant admin consent on the API permissions page. The "Configured Permissions" page from the Azure Portal is displayed. There is a link labeled "Grant admin consent for pantherlabsinc" with a green checkmark next to it. In the image there is a red circle around the link.

  15. After consent has been granted, click the Overview tab in the left sidebar to view your Application (client) ID and Directory (tenant) ID.

    • You will need to provide these to Panther in the next steps. In the Azure Portal, the permission page is displayed. The boxes are checked next to ActivityFeed.Read, ActivityFeed.ReadDlp, and ServiceHealth.Read.

Step 2: Create a new Microsoft Graph Source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Select Microsoft Graph from the list of available log sources.

  4. Click Start Setup.

  5. On the next screen, fill in the fields:

    • Name: Enter a descriptive name for the source e.g., My Microsoft Graph logs.

    • Tenant ID: Enter your Tenant ID.

    • Log Types: Select at least one log type.

  6. Click Setup.

  7. On the Credentials page, enter your Client ID and Client Secret.

    • The Client Secret is the Value field you saved in Step 1.

  8. Click Setup.

  9. You will be redirected to a success screen in Panther:\

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.\

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

Supported log types

MicrosoftGraph.SecurityAlert

Represents potential security issues within a customer's tenant that Microsoft or partner security solutions have identified.

Reference: Microsoft Documentation on Security Alerts.

PreviousMicrosoft Entra ID Audit LogsNextMicrosoft Intune Logs (Beta)

Last updated

Was this helpful?