Integrate Microsoft Graph v2 with Red Canary

This article leads you through the process of integrating Microsoft Graph v2 with Red Canary. Follow the procedure from beginning to end.

• Azure Active Directory Identity Protection v2

• Microsoft 365 Defender v2

• Microsoft Defender for Cloud Apps v2

• Microsoft Defender for Endpoint v2

• Microsoft Defender for Identity v2

• Microsoft Defender for Office 365 v2

Prerequisites

Required Microsoft licenses

For more information, see Pre-deployment activities and prerequisites for deploying Microsoft Sentinel.

Integration Steps

Step 1: [Red Canary] Input your Microsoft Graph v2 information

Enter your Microsoft Azure information into Red Canary to start sending your alerts.

1. From your Red Canary homepage, go to the Integrations page then click Add Integration.

2. 

   On the Add integration dialog, search for the Microsoft Graph v2 integration then click Configure.
   

3. On the Add Integration page:

   • Enter a Name for the integration

   • Select Microsoft Graph V2 via API Poll in the Ingest Format / Method dropdown

   • Uncheck any sources from which you don’t want to ingest data

   • Enter your Microsoft Tenant ID

   

4. Click Save.

5. Locate your newly-added integration in the list at the bottom of the Integrations page, then click on the name to view the configuration.
   

6. Click Edit Configuration.
   

7. Under the Permissions section on the Edit Integration page, click the Microsoft consent link.
   

Step 2: [Microsoft] Grant Red Canary access to Microsoft Graph v2

Confirm that the Red Canary enterprise application has been configured in your Microsoft Graph v2 account.

1. Log in to Microsoft using a Global Admin account for the tenant that you want to integrate with Red Canary.

2. Click Accept on the Permissions requested screen.

   

Note: Be sure your Azure Global Administrator clicks the Consent Link. For more information about Microsoft permissions, click here.

Step 3: [Red Canary] Activate the Microsoft Graph v2 integration

Enable your new Microsoft Graph v2 alert source in Red Canary.

1. Return to the Edit Integration page in Red Canary.

2. Under the Permissions section, check the Confirm Microsoft Microsoft Graph v2 API Access Granted box.
   

3. Click Activate to activate the integration.

4. Click Save.

Note: When activating a Graph v2 alert source, any prior legacy versions of the these APIs will be automatically disabled. These will be kept in a disabled state as there is an active issue with External Alert Source deletion. When deleting an External Alert Source please note that all Alerts and data associated with that source will be removed as well. Red Canary recommends keeping legacy sources in a disabled state to retain any data of interest.

For more information on how to trigger a test for the integration after it's been configured, see Run a detection test on a newly onboarded Microsoft Defender for Endpoint device.

Step 4: [Red Canary] Configure Alert State Sync Actions

Once the integration is active, you can configure the state sync actions to determine whether Red Canary should add comments and/or automatically close the alerts in the source platform.

1. Open the Edit Integration page in Red Canary.

2. Under the Actions in the Source Platform section, set the commenting and close options as described in the table below.
   

   Add comments to alerts in Microsoft Graph v2…
   As Red Canary validates the alert	If checked, Red Canary adds comments to the alert in Microsoft Graph v2 as the alert is investigated and resolved. (Default=checked)
   Close alerts in Microsoft Graph v2…
   When Red Canary validates the alert as non-threatening	If checked, Red Canary resolves the alert in Microsoft Graph v2 as Informational if the state is Not a Threat. (Default=checked)
   When Red Canary validates the alert as suspicious	If checked, Red Canary resolves the alert in Microsoft Graph v2 as True Positive if the state is Suspicious, Highly Suspicious, or Threat but no threat has been published. (Default=unchecked)
   When Red Canary publishes a threat involving the alert	If checked, Red Canary resolves the alert in Microsoft Graph v2 as True Positive if the state is Threat and a threat has been published. (Default=checked)

3. Click Save when done.