The Microsoft Defender EASM (Defender EASM) team is excited to share that new Data Connectors for Azure Log Analytics and Azure Data Explorer are now available in public preview.
Defender EASM continuously discovers an incredible amount of up-to-the-minute Attack Surface Data, so connecting and automating this data flow to all our customers’ mission-critical systems that keep their organizations secure is essential. The new Data Connectors for Log Analytics and Azure Data Explorer can easily augment existing workflows by automating recurring exports of all asset inventory data and the set of potential security issues flagged as insights to specified destinations to keep other tools continually updated with the latest findings from Defender EASM.
We invite all customers to participate and experience the value for themselves. Before beginning, ensure you have a few things enabled/configured/etc.
Defender EASM resource must be created and contain an Attack Surface footprint.
Required Roles & Permissions
Must have a tenant with Defender EASM created (or be willing to create one).
Contributor (Log Analytics)
The Defender EASM Data Connectors allow users to integrate two different kinds of attack surface data into the tool of their choice. Users can migrate asset data, attack surface insights, or both data types. Asset data provides complete details about all the assets in your inventory, whereas attack surface insights provide immediately actionable insights on potential security issues based on Defender EASM dashboards.
To accurately present the infrastructure that matters most to your organization, please note that both content options will only include assets in the “Approved Inventory” state.
Asset data: The Asset Data option will send data about all your assets to the tool of your choice. This option is best for use cases where the granular underlying metadata is vital to operationalizing your Defender EASM integration (e.g., customized reporting in Data Explorer might require this). This option does not provide any pre-determined insights about the assets; instead, it offers a full export of raw data so users can surface the customized insights they care about most.
Attack surface insights: Attack Surface Insights provide an actionable set of results based on key insights delivered through the dashboards in Defender EASM. This option offers less granular metadata on each asset. Instead, it categorizes assets based on the corresponding insight(s) and provides the high-level context required to investigate further. This option is ideal for those who want to integrate these pre-determined insights into custom reporting workflows in conjunction with data from other tools.
Accessing data connections
Users can access Data Connections from the Manage section of the left-hand navigation pane within their Defender EASM resource blade. This page displays the data connectors for both Log Analytics and Azure Data Explorer, listing any current connections and providing the option to add, edit or remove connections. ￼
Connection prerequisites: To successfully create a data connection, users must first ensure that they have completed the required steps to grant Defender EASM permission for the tool of their choice. This process enables the application to ingest our exported data and provides the authentication credentials needed to configure the connection.
To successfully export Defender EASM data to Data Explorer, users must create two new permissions for the EASM API: user and ingestor.
Add a data connection:
Users can connect their Defender EASM data to either Log Analytics or Azure Data Explorer. To do so, select “Add connection” from the Data Connections page for the appropriate tool.
A configuration pane will open on the right-hand side of the Data Connections screen. The following four fields are required:
Once all four fields are configured, select Add to create the data connection. At this point, the Data Connections page will display a banner that indicates the resource has been successfully created, and data will begin populating within 30 minutes. Once connections are created, they will be listed on the main Data Connections page under the applicable tool.
Edit or delete a data connection:
Select the appropriate connection from the list on the main Data Connections page to edit or delete a data connection. This action will open a page that provides additional data about the connection. It displays the configurations you elected when creating the connection, as well as the following:
Users can elect to edit or delete their data connection from this page. If the data connection gets disconnected, users can reconnect to either Log Analytics or Data Explorer from this page, validating the configurations used to set up the integration.
Opening the query editor of the Azure Data Explorer cluster database you created to ingest your Defender EASM data shows all the available ingested assets and attack surface insight data tables. These tables are updated at the frequency specified within the Data Connection configuration record.
To view the ingested Defender EASM asset and attack surface insight data, you can use the query editor available by selecting the ”Logs” option from the left menu of the Azure Log Analytics Workspace you created earlier. These tables are also updated at the Data Connection configuration record frequency.
Extending Defender EASM Asset and Insights data, via these two new data connectors, into Azure ecosystem tools like Log Analytics and Data Explorer enables customers to orchestrate the creation of contextualized data views that can be operationalized into existing workflows and provides the facility and toolsets for analysts to investigate and develop new methods of applicative Attack Surface Management. Head over to your Azure portal now to get started, and keep an eye here on our Tech Community Blog Page for more announcements on releases for Defender EASM.
For more information on all things EASM or to get started, head over to Overview | Microsoft Learn
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.