Microsoft Graph collector
- Former user (Deleted)
Configuration requirements
To run this collector, there are some configurations detailed below that you need to consider.
Configuration | Details |
|---|---|
Azure account | Azure account with admin level permissions and Azure AD tenant. |
Credentials | The credentials configuration block has been filled correctly. |
More information
Refer to the Vendor setup section to know more about these configurations.
Overview
The Microsoft Graph Collector provides the ability to collect data and intelligence from services such as Microsoft 365, Windows, and Enterprise Mobility and Security. This data collector is able to ingest security alerts, scores, provisioning, audit, and sign-ins retrieved from Microsoft products, allowing you to empower streamlined security operations and better defend against threats faced in Azure AD and Microsoft 365 environments.
Devo collector features
Feature | Details |
|---|---|
Allow parallel downloading ( |
|
Running environments |
|
Populated Devo events |
|
Flattening preprocessing |
|
Data sources
Data source | Description | API endpoint | Collector service name | Devo table | Available from release |
|---|---|---|---|---|---|
Alerts | Represents potential security issues within a customer’s tenant that Microsoft or partner security solutions have identified. Refer to Microsoft documentation about Alert Resource Type for more information. |
|
| Starting from v1.2.0, the destination table depends on the tag_version configuration parameter:
The detailed table destination will depend on the tag_version’s value |
|
Secure scores | Represents a tenant's secure score per day of scoring data, at the tenant and control level. By default, 90 days of data is held. Refer to the Microsoft documentation for more information about Secure scores resources types. |
|
| Starting from v1.2.0, the destination table depends on the
The detailed table destination depending on the tag_version's value is available in the Devo categorization and destination section. |
|
Secure score control profiles | Represents a tenant's secure score per control data. Refer to the Microsoft documentation for more information about Secure score control profiles. |
|
| Starting from v1.2.0, the destination table depends on the
The detailed table destination depending on the tag_version's value is available in the Devo categorization and destination section. |
|
Directory audit | Represents the directory audit items and its collection. Refer to the Microsoft documentation for more information about Directory audit. |
|
|
|
|
Provisioning | Represents an action performed by the Azure AD Provisioning service and its associated properties. Refer to the Microsoft documentation for more information about Provisioning.
|
|
|
|
|
Sign-in | Details user and application sign-in activity for a tenant (directory). Refer to the Microsoft documentation for more information about Sign-in.
|
|
|
|
|
Vendor setup
Microsoft Graph data collector works over Microsoft products. To activate the resources from the Microsoft Graph API, you need:
An Azure account that has an active subscription.
The Azure account must have permission to manage applications in Azure Active Directory (Azure AD).
A working Azure AD tenant.
You will need to register a new application and apply the required permissions to the corresponding resources to authenticate the collector in order to retrieve the data.
You need the Admin level permissions on the Azure portal as the subscription setup will require admin consent API permissions, authentications, and audits.
| Action | Steps |
|---|---|---|
1 | Register and configure the application |
|
2 | Grant the required permissions |
You do not need to activate permissions if you are not going to use its corresponding resource. Check the Permissions reference per service section for a detailed breakdown on resource and their needed permissions. |
3 | Obtain the requires credentials for the collector |
The token will display only once. You will need to create another one if you didn’t copy it the first time. |
Permission reference per service
Collector service | Resource | Required permissions | Microsoft documentation |
|---|---|---|---|
| alerts | SecurityEvents.Read.All | |
| secureScores | SecurityEvents.Read.All | |
| secureScoreControlProfiles | SecurityEvents.Read.All | |
| directoryAudits | AuditLog.Read.All and Directory.Read.All | |
| provisioningObjectSummary |
AuditLog.Read.All and Directory.Read.All | |
| signIns | AuditLog.Read.All and Directory.Read.All | |
Required for all services | authentication | User.Read |
Troubleshooting
Sometimes you’ll see this error: Unable to save changes. One or more of the following permission(s) are currently not supported: SecurityEvents.Read.All or SecurityActions.Read.All. Please remove these permission(s) and retry your request. [O6b9].
It might that you did not set up the permission correctly. Please, make sure that the permissions are exactly are showing above.
Minimum configuration required for basic pulling
Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.
This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.
Setting | Details |
|---|---|
| This is the Tenant’s ID you created in Azure AD. You can obtain it from the Overview page in your registered application. |
| This is the Client’s ID you created in Azure AD. You can obtain it from the Overview page in your registered application. Sometimes you will find the client_id as Application (client) ID. |
| This is the Client’s secret you created in Azure AD. You can obtain it from the Certificates & secrets page in your registered application. |
See the Accepted authentication methods section to verify what settings are required based on the desired authentication method.
Accepted authentication methods
This collector only accepts one single authentication method. You will have to fill the following properties on the credentials configuration block:
Authentication method | Tenant ID | Client ID | Client secret |
|---|---|---|---|
REQUIRED | REQUIRED | REQUIRED |
Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).
Collector services detail
This section is intended to explain how to proceed with specific actions for services.
Alerts
Alerts are potential security issues within a customer's tenant that Microsoft or partner security solutions have identified and flagged for action or notification. With the Microsoft Graph alerts entity, you can unify and streamline the management of security issues across all integrated solutions.
Alerts Security Providers:
Microsoft Defender for Cloud
Azure Active Directory Identity Protection
Microsoft Defender for Cloud Apps
Microsoft Defender for Endpoint
Microsoft Defender for Identity
Microsoft 365
Azure Information Protection
Azure Sentinel
Secure Scores
Microsoft Secure Score is a security analytics solution that gives you visibility into your security portfolio and how to improve it. With a single score, you can better understand what you have done to reduce your risk in Microsoft solutions. You can also compare your score with other organizations and see how your score has been trending over time. The Microsoft Graph secureScore and secureScoreControlProfile entities help you balance your organization's security and productivity needs while enabling the appropriate mix of security features. You can also project what your score would be after you adopt security features.
Azure Active Directory reports (Sign-in, Audit, Provisioning)
Azure Active Directory (Azure AD) reports providing a comprehensive view of activity in your environment. The provided data enables you to:
Determine how your apps and services are utilized by your users.
Detect potential risks affecting the health of your environment.
Troubleshoot issues preventing your users from getting their work done.
These reports help you understand the behavior of users in your organization. There are three types of reports that this collector pulls from Azure AD:
Sign-ins: Information about sign-ins and how your resources are used by your users.
Audit: Information about changes applied to your tenants such as users and group management or updates applied to your tenant’s resources.
Provisioning: Activities performed by the provisioning service, such as the creation of a group in ServiceNow or a user imported from Workday.
Devo categorization and destination
Here you can see how each service that has configurable tagging will tag its events depending on the value of the tag_version parameter:
Service | Old tagging ( | New tagging ( |
|---|---|---|
|
|
|
|
|
|
|
| The tagging is based on the provider. See the next table. |
The alerts Service Now uses dynamic tagging based on the event’s provider field. This is the provider/tag correspondence:
Provider | New tagging ( |
|---|---|
IPC |
|
MCAS |
|
Microsoft Defender ATP |
|
Office 365 Security and Compliance |
|
Azure Sentinel |
|
Azure Advanced Threat Protection |
|
If the event comes with a provider that is not present in the table above, the tagging will fall back to the old one (v1).