Skip to content

Commit c306d45

Browse files
P1llusP1llus
authored
[Filebeat Module] Defender ATP - Adding dashboard (#20058)
* adding dashboard to ATP, work in progress * adding dashboard to ATP, removing a unused file, and fixing styling issues in the doc * added description to dashboard and visualizations
1 parent 89bfb6c commit c306d45

5 files changed

Lines changed: 1300 additions & 33 deletions

File tree

‎filebeat/docs/images/filebeat-defender-atp-overview.png‎

166 KB
Loading

‎filebeat/docs/modules/microsoft.asciidoc‎

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ This file is generated! See scripts/docs_collector.py
66
[role="xpack"]
77

88
:modulename: microsoft
9+
:has-dashboards: true
910

1011
== Microsoft module
1112

@@ -14,19 +15,21 @@ This is a module for ingesting data from the different Microsoft Products. Curre
1415
- `defender_atp` fileset: Supports Microsoft Defender ATP
1516
- `dhcp` fileset: Supports Microsoft DHCP logs
1617

17-
include::../include/gs-link.asciidoc[]
18-
19-
[float]
20-
=== Compatibility
18+
include::../include/what-happens.asciidoc[]
2119

22-
Currently this module supports Microsoft Defender ATP.
20+
include::../include/gs-link.asciidoc[]
2321

2422
include::../include/configuring-intro.asciidoc[]
2523

2624
:fileset_ex: defender_atp
2725

2826
include::../include/config-option-intro.asciidoc[]
2927

28+
[float]
29+
==== `defender_atp` fileset settings
30+
31+
beta[]
32+
3033
To allow the filebeat module to ingest data from the Microsoft Defender API, you would need to create a new application on your Azure domain.
3134

3235
The procedure to create an application is found on the below link:
@@ -39,12 +42,11 @@ After the application has been created, it should contain 3 values that you need
3942

4043
These values are:
4144

42-
Client ID
43-
Client Secret
44-
Tenant ID
45+
- Client ID
46+
- Client Secret
47+
- Tenant ID
4548

46-
[float]
47-
==== `defender_atp` fileset settings
49+
Example config:
4850

4951
[source,yaml]
5052
----
@@ -56,8 +58,6 @@ Tenant ID
5658
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token"
5759
----
5860

59-
include::../include/var-paths.asciidoc[]
60-
6161
*`var.oauth2.client.id`*::
6262

6363
This is the client ID related to creating a new application on Azure.
@@ -76,7 +76,7 @@ A predefined URL towards the Oauth2 service for Microsoft. The URL should always
7676
This is a list of Defender ATP fields that are mapped to ECS.
7777

7878
[options="header"]
79-
|======================================================================|
79+
|======================================================================
8080
| Defender ATP Fields | ECS Fields |
8181
| alertCreationTime | @timestamp |
8282
| aadTenantId | cloud.account.id |
@@ -102,11 +102,31 @@ This is a list of Defender ATP fields that are mapped to ECS.
102102
| relatedUser.domainName | host.user.domain |
103103
| title | message |
104104
| severity | event.severity |
105-
|======================================================================|
105+
|======================================================================
106106

107-
== Microsoft module
107+
:has-dashboards!:
108108

109-
experimental[]
109+
[float]
110+
=== Dashboards
111+
112+
This module comes with a sample dashboard for Defender ATP.
113+
114+
[role="screenshot"]
115+
image::./images/filebeat-defender-atp-overview.png[]
116+
117+
The best way to view Defender ATP events and alert data is in the SIEM.
118+
119+
[role="screenshot"]
120+
image::./images/siem-alerts-cs.jpg[]
121+
122+
[float]
123+
For alerts, go to Detections -> External alerts.
124+
125+
[role="screenshot"]
126+
image::./images/siem-events-cs.jpg[]
127+
128+
[float]
129+
And for all other Defender ATP event types, go to Host -> Events.
110130

111131
:fileset_ex: dhcp
112132

@@ -117,6 +137,8 @@ experimental[]
117137

118138
NOTE: This was converted from RSA NetWitness log parser XML "msdhcp" device revision 99.
119139

140+
include::../include/var-paths.asciidoc[]
141+
120142
*`var.input`*::
121143

122144
The input from which messages are read. One of `file`, `tcp` or `udp`.

‎x-pack/filebeat/module/microsoft/_meta/docs.asciidoc‎

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
[role="xpack"]
22

33
:modulename: microsoft
4+
:has-dashboards: true
45

56
== Microsoft module
67

@@ -9,19 +10,21 @@ This is a module for ingesting data from the different Microsoft Products. Curre
910
- `defender_atp` fileset: Supports Microsoft Defender ATP
1011
- `dhcp` fileset: Supports Microsoft DHCP logs
1112

12-
include::../include/gs-link.asciidoc[]
13-
14-
[float]
15-
=== Compatibility
13+
include::../include/what-happens.asciidoc[]
1614

17-
Currently this module supports Microsoft Defender ATP.
15+
include::../include/gs-link.asciidoc[]
1816

1917
include::../include/configuring-intro.asciidoc[]
2018

2119
:fileset_ex: defender_atp
2220

2321
include::../include/config-option-intro.asciidoc[]
2422

23+
[float]
24+
==== `defender_atp` fileset settings
25+
26+
beta[]
27+
2528
To allow the filebeat module to ingest data from the Microsoft Defender API, you would need to create a new application on your Azure domain.
2629

2730
The procedure to create an application is found on the below link:
@@ -34,12 +37,11 @@ After the application has been created, it should contain 3 values that you need
3437

3538
These values are:
3639

37-
Client ID
38-
Client Secret
39-
Tenant ID
40+
- Client ID
41+
- Client Secret
42+
- Tenant ID
4043

41-
[float]
42-
==== `defender_atp` fileset settings
44+
Example config:
4345

4446
[source,yaml]
4547
----
@@ -51,8 +53,6 @@ Tenant ID
5153
var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token"
5254
----
5355

54-
include::../include/var-paths.asciidoc[]
55-
5656
*`var.oauth2.client.id`*::
5757

5858
This is the client ID related to creating a new application on Azure.
@@ -71,7 +71,7 @@ A predefined URL towards the Oauth2 service for Microsoft. The URL should always
7171
This is a list of Defender ATP fields that are mapped to ECS.
7272

7373
[options="header"]
74-
|======================================================================|
74+
|======================================================================
7575
| Defender ATP Fields | ECS Fields |
7676
| alertCreationTime | @timestamp |
7777
| aadTenantId | cloud.account.id |
@@ -97,11 +97,31 @@ This is a list of Defender ATP fields that are mapped to ECS.
9797
| relatedUser.domainName | host.user.domain |
9898
| title | message |
9999
| severity | event.severity |
100-
|======================================================================|
100+
|======================================================================
101101

102-
== Microsoft module
102+
:has-dashboards!:
103103

104-
experimental[]
104+
[float]
105+
=== Dashboards
106+
107+
This module comes with a sample dashboard for Defender ATP.
108+
109+
[role="screenshot"]
110+
image::./images/filebeat-defender-atp-overview.png[]
111+
112+
The best way to view Defender ATP events and alert data is in the SIEM.
113+
114+
[role="screenshot"]
115+
image::./images/siem-alerts-cs.jpg[]
116+
117+
[float]
118+
For alerts, go to Detections -> External alerts.
119+
120+
[role="screenshot"]
121+
image::./images/siem-events-cs.jpg[]
122+
123+
[float]
124+
And for all other Defender ATP event types, go to Host -> Events.
105125

106126
:fileset_ex: dhcp
107127

@@ -112,6 +132,8 @@ experimental[]
112132

113133
NOTE: This was converted from RSA NetWitness log parser XML "msdhcp" device revision 99.
114134

135+
include::../include/var-paths.asciidoc[]
136+
115137
*`var.input`*::
116138

117139
The input from which messages are read. One of `file`, `tcp` or `udp`.

0 commit comments

Comments
 (0)