Knowledge BaseRelease NotesRequest Demo

Microsoft Graph Logs

Panther supports pulling logs directly from Microsoft Graph API

Overview

Panther has the ability to fetch Microsoft Graph logs by querying the Microsoft Graph API to obtain security alerts from the following Microsoft security products:

  • Azure Active Directory Identity Protection

  • Azure Information Protection

  • Microsoft 365 (Default, Cloud App Security, Custom Alerts)

  • Microsoft Defender for Cloud Apps

  • Microsoft Defender for Endpoint

  • Microsoft Defender for Identity

  • Microsoft Sentinel (formerly Azure Sentinel)

How to onboard Microsoft Graph logs to Panther

Prerequisites

  • Microsoft Defender for Endpoint and Identity alerts require additional user configuration prior to streaming alerting events to Panther. See Microsoft's documentation for more information.

  • Microsoft Defender for Endpoint requires additional user roles to those required by the Microsoft Graph Security API. Only the users in both Microsoft Defender for Endpoint and Microsoft Graph Security API roles can have access to the Microsoft Defender for Endpoint data. Because application-only authentication is not limited by this, we recommend that you use an application-only authentication token.

  • Microsoft Defender for Identity alerts are available via the Microsoft Defender for Cloud Apps integration. This means you will get Microsoft Defender for Identity alerts only if you have joined Unified SecOps and connected Microsoft Defender for Identity into Microsoft Defender for Cloud Apps.

Step 1: Create an Azure AD application

  1. Log in to your Azure portal and navigate to the Azure Active Directory service. In the Azure portal, the phrase "azure ac" has been typed into the search bar. A dropdown menu below the search bar shows a list of services. "Azure Active Directory" is highlighted.

  2. Click App Registrations in the left sidebar.

  3. Click New Registration.

  4. Fill in the fields:

    • Enter a descriptive name for your application.

    • For Supported account types, select Accounts in this organizational directory only.

  5. Click Register.

  6. On the left sidebar, click Certificates and Secrets.

  7. Click New Client Secret.

    • Add a description for the secret (e.g., Panther integration).

    • Set the Expires field to 24 Months.

  8. Click Add.

    • The Client Secret is hidden after you navigate away from this page; copy down the Value field and store it in a secure location - you will use this as your Client Secret value in Step 4.

  9. On the left sidebar, click API Permissions and then Add a permission.

  10. Find and click the Microsoft Graph APIs.

  11. Click Delegated permissions and select the SecurityEvents.Read.All permission.

  12. Click Application permissions and select the SecurityEvents.Read.All permission.

  13. Click Add permissions at the bottom of the page.

  14. Click Grant admin consent on the API permissions page. The "Configured Permissions" page from the Azure Portal is displayed. There is a link labeled "Grant admin consent for pantherlabsinc" with a green checkmark next to it. In the image there is a red circle around the link. 

  15. After consent has been granted, click the Overview tab in the left sidebar to view your Application (client) ID and Directory (tenant) ID.

    • You will need to provide these to Panther in the next steps. In the Azure Portal, the permission page is displayed. The boxes are checked next to ActivityFeed.Read, ActivityFeed.ReadDlp, and ServiceHealth.Read.

  16. Keep this browser window open as you work through the next steps.

Step 2: Create a new Microsoft Graph Source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Select Microsoft Graph from the list of available log sources.

  4. Click Start Source Setup.

  5. On the next screen, fill in the fields:

    • Name: Enter a descriptive name for the source e.g., My Microsoft Graph logs.

    • Tenant ID: Enter your Tenant ID.

    • Log Types: Select at least one log type.

  6. Click Setup.

  7. On the "Set Credentials" page, copy the Redirect URL and store it in a secure place.

    • You will need it in the next step.

  8. Keep this browser window open as you work through the next steps.

Step 3: Configure the Redirect URL

  1. Navigate back to the Azure AD application.

  2. On the left sidebar, click Authentication.

  3. Click Add a platform.

  4. Click the Web.

  5. Enter your Redirect URL.

  6. Click Configure.

Step 4: Finalize the onboarding in Panther

  1. Navigate back to the Panther Console.

  2. On the "Set Credentials" page, enter your Client ID and Client Secret (the Client Secret is the Value field you saved in the earlier steps of this documentation).

  3. Click Setup.

  4. On the "Verify Setup" screen, click Grant Access.

    • You will be redirected to a Microsoft page to authorize your app.

  5. You will be redirected to a success screen in Panther:

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

Supported log types

Required fields in the schema are listed as "required: true" just below the "name" field.

MicrosoftGraph.SecurityAlert

Represents potential security issues within a customer's tenant that Microsoft or partner security solutions have identified.

Reference: Microsoft Documentation on Security Alerts.

PreviousMicrosoft 365 LogsNextMongoDB Atlas Logs

Last updated

Was this helpful?