> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/listeners/listener-integrations/collect-data-from-microsoft-office-365/collect-microsoft-defender-logs.md).

# Collect Microsoft Defender logs

## Overview

The following article outlines a basic data flow from [Microsoft Defender for Office 365 (MDO)](https://www.microsoft.com/en-in/security/business/siem-and-xdr/microsoft-defender-office-365) to the **Office 365** Listener.

## Prerequisites

* Administrative access to the Microsoft Defender portal

[Contact Onum](broken://spaces/cSjT21I4EUhzghjc1rER/pages/nW8oZycpfVthtI5KYdQs) to get the required JWT token, which will be needed on the Listener setup. 

You can also contact us if you cannot generate the required TLS certificates. Note that these certificates must be signed by a recognized Certificate Authority (CA). Self-signed certificates are not accepted.

## Defender for Cloud Apps Setup

Microsoft Defender for Office 356 (MDO) can be configured to send logs to Onum. Here's how to set it up:

1. Access the [Microsoft Defender for Office 365](https://www.microsoft.com/en-in/security/business/siem-and-xdr/microsoft-defender-office-365) portal.
2. Go to **Azure Active Directory > App registrations**
   * Click **New registration** and give it a name.
   * Supported account type - Accounts in this organizational directory only
   * Redirect URI - Leave blank for now
   * Click "Register"
3. **Retrieve the Application (Client) ID**
   * Go to the **All Applications tab** and click on the application name.
   * On the overview page, you'll see "Application (client) ID" displayed prominently. This is the GUID you need for Onum. 
4. In your new app registration, **go to API permissions**
   * Click **Add a permission** and select **Microsoft Graph > Application permissions**
   * Add these permissions
     * `SecurityEvents.Read.All`
     * `SecurityEvents.ReadWrite.All`
     * `SecurityIncident.Read.All`
     * `ThreatIntelligence.Read.All`
   * For Office 365 Management API, add
     * `ActivityFeed.Read`
     * `ActivityFeed.ReadDlp`
     * `ServiceHealth.Read`
   * Click **Grant admin consent**
5. **Create a client secret**
   * Go to **Certificates & secrets**
   * Click **New client secret**
   * Add a description and select expiration
   * Copy the secret value immediately (it won't be shown again)
6. **Locate and save your Tenant ID**
   * Go to **Azure Active Directory > App registrations**
   * On the Azure AD overview page, look for **Tenant ID** in the basic information section. It will be displayed as a GUID (e.g., 12a34567-89b0-12c3-d456-789012ef3456). 
   * Keep it somewhere safe to paste it into the Listener.

## Start/stop a subscription

The **Office 365** Listener supports the start/stop subscription feature. You can start/stop a subscription using some other Office 365 API or using this `curl` command:

```
curl -d "client_secret={client_secret}&resource={resource}&client_id={app_id}&grant_type=client_credentials" -X POST https://login.windows.net/{tenantID}/oauth2/token
```

You should get a response like this:

```json
{
    "token_type": "Bearer",
    "expires_in": "string",
    "ext_expires_in": "string",
    "expires_on": "string",
    "not_before": "string",
    "resource": "string",
    "access_token": "string"
}
```

Use the `access_token` value to start or stop a subscription. These are the available content values:

* `Audit.AzureActiveDirectory`
* `Audit.Exchange`
* `Audit.SharePoint`
* `Audit.General`
* `DLP.All`

These are some of the requests you can perform:

* Start a subscription to begin receiving notifications and retrieving activity data for a tenant.

```
curl -d "" -H "Authorization: Bearer {access_token}" -X POST "https://manage.office.com/api/v1.0/{tenant_id}/activity/feed/subscriptions/start?contentType={list_of_content_type_you_wanna_subscribe_to}"
```

* Stop a subscription to discontinue retrieving data for a tenant:

```
curl -d "" -H "Authorization: Bearer {access_token}" -X POST "https://manage.office.com/api/v1.0/{tenant_id}/activity/feed/subscriptions/stop?contentType={list_of_content_type_you_wanna_unsubscribe_from}"
```

* Content type example (this will subscribe you to active directory and exchange):

```
contentType=Audit.AzureActiveDirectory,Audit.Exchange
```

[Here](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference) is the list of all the API requests you can use. Once you start subscription, you can use the Listener to fetch your data.

For easier testing, here is the `curl` command to fetch the list of updates:

```
curl -d "" -H "Authorization: Bearer {access_token}" -X GET "https://manage.office.com/api/v1.0/{tenant_id}/activity/feed/subscriptions/content?contentType={list_of_content_types}"
```

## Onum Setup

Log in to your Onum tenant and click **Listeners > New listener**. Double-click the **Azure Event Hubs** Listener. See the configuration steps in [this article](https://docs.onum.com/the-workspace/listeners/listener-integrations/collect-data-from-azure-event-hubs).

<br>