--- title: Microsoft 365 Defender description: Provides details on endpoints, vulnerabilities, alerts, and incidents breadcrumbs: Docs > Integrations > Microsoft 365 Defender --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Microsoft 365 Defender Supported OS marketplaceIntegration version2.2.0 {% callout %} # Important note for users on the following Datadog sites: us2.ddog-gov.com {% alert level="info" %} To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator. To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com). {% /alert %} {% /callout %} CDS Microsoft 365 Defender - OverviewCDS Microsoft 365 Defender - EndpointsCDS Microsoft 365 Defender - Endpoint Threats and VulnerabilitiesCDS Microsoft 365 Defender - Cloud App EventsCDS Microsoft 365 Defender - Email EventsCDS Microsoft 365 Defender - IdentityCDS Microsoft 365 Defender - Incidents and AlertsCDS Microsoft 365 Defender - Secure Score Control Profile ## Overview{% #overview %} Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. This integration collects alerts, incidents, endpoints, identities, email, security scores, secure score control profiles, software, vulnerabilities, and investigations from Microsoft 365 Defender as logs in Datadog. #### Dashboards{% #dashboards %} - CDS Microsoft 365 Defender - Overview - CDS Microsoft 365 Defender - Endpoints - CDS Microsoft 365 Defender - Endpoint Threats and Vulnerabilities - CDS Microsoft 365 Defender - Cloud App Events - CDS Microsoft 365 Defender - Email Events - CDS Microsoft 365 Defender - Identity - CDS Microsoft 365 Defender - Incidents and Alerts - CDS Microsoft 365 Defender - Secure Score Control Profile - CDS Microsoft 365 Defender - Investigations #### Monitors{% #monitors %} - Missing KBs of Endpoint - Endpoints with critical CVEs found in Microsoft Defender over the last 1 hour - More than 5 endpoints missing security patches in Microsoft Defender over the last 1 hour - More than 5 CVEs with CVSS score above 3.0 found in Microsoft Defender vulnerabilities over the last 4 hours - Critical CVEs with public exploits found in Microsoft Defender vulnerabilities over the last 1 hour - More than 3 high-risk endpoints found in Microsoft Defender over the last 5 minutes - 3 or more authentication failures on same account in Microsoft Defender over the last 1 hour - Same account authenticated from two different countries within 1 hour in Microsoft Defender - More than 3 password reset events by same account in Microsoft Defender Identity Directory Events over the last 1 hour - External user events in Microsoft Defender Cloud App Events over the last 1 hour - Impersonated session detected in Microsoft Defender Cloud App Events over the last 1 hour - Single user externally shared distinct files in Microsoft Defender Cloud App Events over 1 hour - More than 3 threat attempts detected from same IP in Microsoft Defender Email Events over the last 1 hour - High and critical incidents created in Microsoft Defender over the last 1 hour - High-severity unassigned alerts found in Microsoft Defender over the last hour - Microsoft Defender Secure Score dropped more than 10 points in the last 24 hours - Microsoft Defender Secure Score has not improved over the last 30 days - More than 5 deprecated controls present in Microsoft Defender Secure Score Control Profiles over the last 1 day - More than 15 unimplemented core low-cost security controls found in Microsoft Defender in the last 1 day ## Data Collected{% #data-collected %} ### Metrics{% #metrics %} | | | | | **cds.ms.365.defender.organization_exposure_level**(gauge) | Provides the organization exposure level score | | **cds.ms.365.defender.software_version_vulnerabilities**(gauge) | Number of vulnerabilities for each software version | | **cds.ms.365.defender.software_version_installations**(gauge) | Number of installations for each software version | | **cds.ms.365.defender.current_score.current_score**(gauge) | This shows Tenant current attained score on specified date | | **cds.ms.defender.endpoint.organization_exposure_level**(gauge) | Provides the organization exposure level score | ### Datadog Integration Installation{% #datadog-integration-installation %} To install the integration, run the following command: - Linux: ``` sudo -u dd-agent datadog-agent integration install --third-party datadog-crest_data_systems_microsoft_defender==2.2.0 ``` - Windows: ``` "%programfiles%\Datadog\Datadog Agent\bin\agent.exe" integration install --third-party datadog-crest_data_systems_microsoft_defender==2.2.0 ``` ### Set up `datadog.yaml`{% #set-up-datadogyaml %} 1. The `app_key` and `api_key` needs to be set in the `datadog.yaml` file if not already configured. For more information, see [Agent Configuration Files](https://docs.datadoghq.com/agent/guide/agent-configuration-files.md?tab=agentv6v7) and [API and Application Keys](https://docs.datadoghq.com/account_management/api-app-keys.md). ```yaml ## @param api_key - string - required ## Datadog API Key # api_key: ## @param app_key - string - required ## Datadog App Key # app_key: ## @param site - string - optional - default: datadoghq.com ## The site of the Datadog intake to send Agent data to. ## Set to 'datadoghq.eu' to send data to the EU site. ## Set to 'us3.datadoghq.com' to send data to the US3 site. ## Set to 'us5.datadoghq.com' to send data to the US5 site. # site: ``` ### Datadog Integration Configuration{% #datadog-integration-configuration %} 1. Copy the `conf.yaml.example` file: ```sh cp /etc/datadog-agent/conf.d/crest_data_systems_microsoft_defender.d/conf.yaml.example /etc/datadog-agent/conf.d/crest_data_systems_microsoft_defender.d/conf.yaml ``` 1. Edit the `crest_data_systems_microsoft_defender.d/conf.yaml` file to add the configuration of Client ID, Client Secret, Tenant ID, events, and proxy settings: ```yaml init_config: instances: ## @param tenant_id - string - required ## Tenant ID of the registered Application in Azure. # - tenant_id: ## @param client_id - string - required ## Client ID of the registered Application in Azure. # client_id: ## @param client_secret - string - required ## Client Secret of the registered Application in Azure. # client_secret: ## @param events - list of strings - optional - default: ['alerts', 'incidents', 'secure_score', 'secure_score_control_profiles', 'identity', 'email', 'cloud_app', 'endpoint', 'vulnerability', 'investigations', 'software'] ## Provide the event endpoints to monitor the events data. Only lower case characters are accepted. # # events: # - alerts # - incidents # - secure_score # - secure_score_control_profiles # - identity # - email # - cloud_app # - endpoint # - vulnerability # - investigations # - software ## @param proxy_type - string - optional ## Type of the proxy server. Allowed proxy types are http and https. ## Required if 'proxy_host' is provided and vice-versa. # # proxy_type: http ## @param proxy_host - string - optional ## Host of the proxy server. ## Required if 'proxy_type' is provided and vice-versa. # # proxy_host: 10.0.0.1 ## @param proxy_port - integer - optional - default: 3128 ## Port of the proxy server. # # proxy_port: 3128 ## @param proxy_username - string - optional ## The username of the proxy server. ## Required if 'proxy_password' is provided and vice-versa. # # proxy_username: ## @param proxy_password - string - optional ## The password of the proxy server. ## Required if 'proxy_username' is provided and vice-versa. # # proxy_password: ## @param verify_ssl - boolean - optional - default: false ## SSL verification while connecting to registered application in Azure. ## SSL verification flag 'verify_ssl' allows users to choose whether to verify ## the SSL certificate when connecting to the client server. ## Defaults to False if not specified. # # verify_ssl: false ## @param tags - list of strings - optional ## A list of tags to attach to every metric and service check emitted by this instance. ## ## Learn more about tagging at https://docs.datadoghq.com/tagging # # tags: # - : # - : ## @param service - string - optional ## Attach the tag `service:` to every metric, event, and service check emitted by this integration. ## ## Overrides any `service` defined in the `init_config` section. # # service: ## @param min_collection_interval - number - required ## This changes the collection interval of the check. For more information, see: ## https://docs.datadoghq.com/developers/write_agent_check/#collection-interval # min_collection_interval: 7200 ``` - Example for the `conf.yaml` when multiple instances of Microsoft 365 Defender Tenants are configured: ```yaml init_config: instances: - tenant_id: client_id: client_secret: min_collection_interval: 7200 - tenant_id: client_id: client_secret: min_collection_interval: 7200 ``` Install the third-party dependency `datadog-api-client` python package: - Linux: ``` sudo -Hu dd-agent /opt/datadog-agent/embedded/bin/pip install datadog-api-client>=2.16.0 ``` - Windows: ``` "%programfiles%\Datadog\Datadog Agent\embedded\python.exe" -m pip install datadog-api-client>=2.16.0 ``` [Restart the Agent](https://docs.datadoghq.com/agent/guide/agent-commands.md?tab=agentv6v7#start-stop-and-restart-the-agent). ### Validation{% #validation %} [Run the Agent's status subcommand](https://docs.datadoghq.com/agent/guide/agent-commands.md#agent-status-and-information) and look for `crest_data_systems_microsoft_defender` under the Checks section. Alternatively, you can get detailed information about the integration using the following command: - Linux: ``` sudo datadog-agent check crest_data_systems_microsoft_defender ``` - Windows: ``` "%programfiles%\Datadog\Datadog Agent\bin\agent.exe" check crest_data_systems_microsoft_defender ``` ### Monitor Configuration{% #monitor-configuration %} 1. Navigate to the **Monitors** tab within Datadog. 1. Click on **New Monitor** and then click on the **New from Template** tab. 1. Search for the **crest_data_systems_microsoft_defender** monitor. ### Upgrade Integration{% #upgrade-integration %} - Take the backup of your existing 'conf.yaml' file from your Datadog Agent's `crest_data_systems_microsoft_defender.d` directory under `conf.d` directory. - Ensure that the dedicated app on the Microsoft Azure platform has the necessary permissions specified in the **Microsoft Defender Configuration** section. - Uninstall the currently installed version of Microsoft 365 Defender from the Datadog agent. - Install v2.2.0 of Microsoft 365 Defender into the Datadog Agent. - Modify the configuration file as per the instructions provided in the Datadog Integration Configuration. Remove the app Key and API Key from the configuration file, and make sure to include them in the `datadog.yaml` file. ### Service Checks{% #service-checks %} **cds.ms.defender.endpoint.can_connect** Returns `CRITICAL` if authentication with Microsoft 365 Defender has failed. Returns `OK` otherwise. *Statuses: ok, critical* ## Support{% #support %} Contact Crest Data's support team: - Email: [datadog.integrations@crestdata.ai](mailto:datadog.integrations@crestdata.ai) - Website: [crestdata.ai](https://www.crestdata.ai/) This application is made available through the Marketplace and is supported by a Datadog Technology Partner. Click Here to purchase this application.