Integrate Microsoft Defender for Endpoint with Red Canary

Before beginning the onboarding process, you must provide Red Canary with the name and email address for an account with global administrator privileges within your Entra organization. You’ll use this account throughout the onboarding process.

If you already have a global administrator account, follow these steps:

1. Provide the name and email address of the account to your Red Canary contact.

2. Check your email for an invitation to accept access permissions. If your account doesn’t have an associated email inbox, notify your Red Canary contact, who will provide you with an invitation link.

   Note: When logging in to this site, you should be prompted to accept certain permissions. If you do not see this permissions page on your first login, try accessing this link via an incognito or private window. MFA is required by Microsoft to login as to a Global Admin account.

If you don’t have a global administrator account, follow these steps:

1. Log in to your Entra tenant at Azure.

2. Create a new user by following the steps in Add or delete users using Entra Active Directory.

3. Assign “Global Administrator” or “Security Administrator” to the new user by following the steps in Assign administrator and non-administrator roles to users with Entra Active Directory.

4. Confirm that permissions are correct by logging into Entra, searching for the new user, and validating that the user belongs to the “Global Administrator” or “Security Administrator” role.

5. Provide the name and email address of the account to your Red Canary contact.

6. Check your email for an invitation to accept access permissions. If your account doesn’t have an associated email inbox, you can accept the invitation by logging in to Azure.

After you configure your onboarding account, you can set up data export from your Defender for Endpoint instance to Red Canary’s Event Hub. This configuration instructs the Defender for Endpoint platform to begin sending your telemetry to Red Canary for processing.

1. Log in to Microsoft Defender Security Center using your global administrator account.

2. Navigate to Settings, select Microsoft Defender XDR, and then select Streaming API.

3. Click + Add.

4. Please name the export “MXDRPartner-{ Your Company Name}”

5. Click Forward events to Event Hub.

6. Fill in the values of Event-Hub Resource ID and Event-Hub name using the credentials Red Canary has provided to you via email.

7. Select all Event Types.

8. Click Submit. It will take 30 minutes to four hours after the final step is completed before the data stream is established within Red Canary.

Note: If you get “Failed to created Streaming API Settings Request Body is invalid or missing” dialogue box try the steps below:

• The Event Hub Resource ID and Event Hub name are really sensitive. If you have a space in it, it will not allow you to submit it. You can try loading the resource ID and event-hub name into notepad to ensure that no spaces are copied, and attempt to resubmit. 

• Clear all the event fields, refresh the window, and try again. 

• Try to do this step from an incognito browser if the above steps do not resolve. 

For a walkthrough of these steps, review this video:

After you configure your onboarding account, you can grant Red Canary permissions to your Defender for Endpoint API. This enables the Red Canary platform to retrieve alerts, process endpoint metadata, and orchestrate actions on endpoints.

To grant permissions to your Microsoft Defender for Endpoint API:

WAIT 15 MINUTES AFTER CONFIGURING STREAMING API TO PERFORM THESE STEPS. 

1. Log in to your global administrator Microsoft account (MFA is required).

2. Approve permissions for Red Canary API integration.

After you grant permissions to your Microsoft Defender for Endpoint API, you can give Red Canary read-only access to your Defender for Endpoint console using role-based access control; see Manage portal access using role-based access control in Microsoft Docs for more information. This enables your Red Canary teams, such as your threat hunting and detection engineering teams, to perform ad-hoc hunting and investigation of potential threats in your environment.

Note: This process requires an Entra ID Premium P2 license. If you have an Entra ID Premium P1 license, see Entra ID P1 License - Grant Red Canary Read-Only Access to Microsoft Defender in the Red Canary Help Center.

Step 1: Prepare your Microsoft Entra group for Role-Based Access Control, and link the Red Canary active directory tenant

1. Navigate to Azure, and log in with your global administrator account.

2. Expand the navigation pane, and then select Entra ID | Groups | New Group.

3. Fill in the group parameters with the following values:

   1. Group Type: Security

   2. Group Name: Red Canary

   3. Group Description: Red Canary Access Group

   4. Entra ID roles can be assigned to the group (Preview): Yes

   5. Roles: Security Reader

   6. Membership Type: Assigned

   7. Owners: No owners selected

   8. Members: No members selected

4. Click Create, and then click Identity Governance. (You may need to enter this in the search bar) 

5. Under Entitlement Management, select Connected organizations, and then Add connected organization.

6. Fill out the form with the following values:

   1. Basics

      1. Name: Red Canary

      2. Description: Red Canary Access Group

      3. State: Configured

   2. Directory + domain

      1. Click Add directory + domain.

      2. Type redcanary.com into the tenant ID search bar.

      3. Highlight the entry, and click Select.

   3. Sponsors

      1. Under Add Internal Sponsor, click Add/Remove.

      2. Search for the name of your active directory administrator, highlight the account, and click Select.

7. Review the parameters, and then click Create.

Step 2: Enable Microsoft Defender XDR Unified Role-based Access (RBAC) in Microsoft Defender for Endpoint

Create a RBAC role within Defender for your endpoint, and then assign the Red Canary Entra ID security group to the role.

1. Navigate to Microsoft, and log in with your global administrator account. 

2. Follow the steps here to activate your Endpoints & Vulnerability Management workloads directly in Microsoft Defender XDR settings.

3. From the navigation pane, select Permissions. Under Microsoft Defender XDR > select Roles.

4. From the Permissions and roles page, click Create Custom Role.

   

5. Fill out the form with the following values:

   • Role Name: Red Canary

   • Description: Red Canary Access Role

6. Click Next.

7. Under Permissions, select Security Operations.

   

8. Check the following boxes:

   1. Select custom permissions

   2. Security data

      1. Select custom permissions

         1. Security data basics (read)

   3. Raw data (Email and collaboration)

      1. Select custom permissions

         1. Email & collaboration metadata (read)

            

9. Click Apply.

10. Click Authorization and settings, then click Next.

11. Check the following boxes.

    1. 1. Select custom permissions.

       2. Authorization

          1. Select Read-only.

       3. Security Settings

          1. Select custom permissions.

             1. Core security settings (read)

       4. System settings

          1. Read-only (Defender for Office, Defender for Identity)

12. Click Apply.

13. Click Next.

14. Click Create assignment (or +add assignment).

    

15. Click Next.

16. Add the Assignment name.

    Note: The name should reflect the assignment.

17. Assign the users and groups.

18. From Data Sources ensure all the boxes are checked.

    

19. Click Add.

20. Click Next.

21. Review the content and click Submit.

Step 3: Configure your Microsoft Entra Identity Governance Access Packages

1. Navigate to Azure and log in with your global administrator account. 

2. Expand the navigation pane, and then select Entra ID | Identity Governance. 

3. Under Entitlement Management, select Catalogs, and then New Catalog.

4. Fill out the form with the following values:

   • Name: Red Canary Access

   • Description: Red Canary MTP Service Access Catalog

   • Enabled: Yes

   • Enabled for external users: Yes

5. Under Entitlement Management, select Access Package, and then New Access Package.

6. Fill out the forms with the following values:

   • Basics

     • • Name: Red Canary Access Package

       • Description: Red Canary Access

       • Catalog: Red Canary Access

   • Resource Roles

     • • Select Groups and Teams | Red Canary | Member | Select.

         • Important: In order to select the Red Canary Group, make sure to select See all Group and Team(s) not in the Red Canary Access catalog. You must have the correct permissions to add them in this access package.

   • Requests

     • • Select For users not in your directory, Specific connected organizations, and then Red Canary.

       • Require Approval: No

       • Enable new requests and assignments: Yes

   • Lifecycle

     • • Access package assignments expire: Never 

       • Users can request specific timeline*: No

       • Require access reviews: Yes

       • Starting on: [today's date]

       • Review frequency: Bi-annually

       • Duration in days: 90

       • Reviewers: Specific reviewers

         1. 1. Click Add reviewers. 

            2. Select the members of your organization responsible for IAM review procedures.

7. Review the parameters, and then click Create.

8. Select the newly created access package under Entra Portal | Active Directory | Identity Governance | Access Packages | Red Canary.  

9. Under Properties, copy the “My access portal link.”

10. Provide the link to your Red Canary contact.

If your organization uses device groups, add permissions by completing the following steps:

1. Navigate to Microsoft and log in with your global administrator account.

2. Select Settings > Endpoints > Device Groups.

3. Navigate to Assigned User Groups.

4. Select the Red Canary group previously created in Entra ID. Add that group to Entra ID user groups with this role, and click​ Save.

5. Go to Settings > Permissions > Machine Groups.

6. Click on a machine group name.

7. From User Access, select the checkbox to grant access to the ​Red Canary ​group.

8. Repeat steps 6 and 7 for all machine groups.

IMPORTANT: Once you've added the Red Canary Group to the Device Groups, go back out to Settings | Endpoints | Device Groups and be sure to click Apply Changes otherwise the Device Group settings will not be saved.

As a last step to integrating this EDR source, please follow the directions in Integrate Microsoft Graph v2 with Red Canary.