Microsoft Defender for Cloud Apps Plugin for Threat Exchange

This document explains how to configure the Microsoft Defender for Cloud Apps v1.1.0 plugin with the Threat Exchange module of the Netskope Cloud Exchange platform. This plugin is used to pull IoCs of type Domains (Domains, FQDNs and Hostnames) from Show navigation > Cloud apps > Cloud app catalog under Microsoft Defender platform. The plugin supports pull retraction of IoCs from Microsoft Defender. This plugin does not support sharing of IoCs to Microsoft Defender platform.

Prerequisites

To complete this configuration, you need:

• Netskope Tenant (or multiple, for example, production and development/test instances)
• A Netskope Cloud Exchange instance with the Tenant plugin and Threat Exchange plugin already configured with the Threat Exchange module enabled.
• A URL List on your Netskope tenant.
• A Destination Profile on your Netskope tenant.
• A Private App on your Netskope tenant.
• A DNS Profile on your Netskope Tenant
• Microsoft Defender for Cloud Apps platform credentials
• Connectivity to the following hosts:
  • Microsoft Defender Cloud Apps instance URL
    Example: https://your-instance.portal.cloudappsecurity.com

Microsoft Defender for Cloud Apps Plugin Support

This plugin is used to pull IoCs of type Domains (Domains, FQDNs and Hostnames) from Show navigation > Cloud apps > Cloud app catalog under Microsoft Defender platform. The plugin supports pull retraction of IoCs from Microsoft Defender. This plugin does not support sharing of IoCs to Microsoft Defender platform.

IOC Retraction

IOC Retraction (Pull): IoCs that are deleted on the Microsoft Defender or that are not under the selected status in the plugin configuration will be marked as retraced in Cloud Exchange.

Mappings

Mappings for Pull(Netskope field – Microsoft Defender for Cloud Apps fields)

Permissions 

Microsoft Defender Cloud Apps API token with Read-only access.

{
    "data": [
        {
            "_id": "mock0000abc1",
            "appId": 10000,
            "name": "Microsoft Office 365",
            "domainList": [
                "office.com",
                "outlook.com",
                "teams.com"
            ]
        },
        {
            "_id": "mock0000def2",
            "appId": 10001,
            "name": "Salesforce",
            "domainList": [
                "salesforce.com",
                "app.salesforce.com"
            ]
        }
    ]
}

Performance Matrix

Here is the performance reading conducted for fetching 100K IoCs in each plugin lifecycle on a Large CE instance with these specifications.

User Agent

netskope-ce-6.1.0-cte-microsoft-defender-for-cloud-apps-v1.1.0

Workflow

1. Get your API URL and API token.
2. Configure the Microsoft Defender for Cloud Apps plugin.
3. Configure a Business Rule.
4. Configure Sharing.
5. Validate the plugin.

Watch a Video

Click play to watch a video.

Get your API URL from Microsoft Defender

1. Log in to Microsoft Defender platform and go to Show navigation > System > Settings > About.

2. Copy the API URL as it will be used while configuring the plugin.

   

Get your API Token from Microsoft Defender

1. Log in to Microsoft Defender platform and go to Show navigation > System > Settings > API tokens.

   

2. Click Add token, enter a Token name, and click Generate.

   

3. Copy the generated API token as it will be used while configuring the plugin.

Configuring Microsoft Defender for Cloud Apps Plugin

1. In Cloud Exchange, and go to Settings > Plugin Store.

2. Search for and select the Microsoft Defender for Cloud Apps v1.1.0 (CTE) plugin.

   

3. Enter the Basic Information:

   • Configuration Name: Plugin configuration name.
   • Sync Interval: Interval to fetch data from this plugin and share data to this plugin from other sources.
   • Indicator Aging Criteria: Expire indicators after specific time.(. Default: 90)
   • Override Reputation: Set a value to override the reputation of indicators received from this configuration. (Default: 5)
   • Tags Aggregate Strategy: Choose whether to append new tags to existing IoC(s) or overwrite them. This configuration parameter determines how tags are stored for indicators pulled for this configuration.
   • Enable SSL Validation: Enable or Disable SSL Certificate validation.

   

4. Click Next and enter the Configuration Parameters:

   • URL: Microsoft Defender Cloud Apps instance URL obtained previously. Example: https://your-instance.portal.cloudappsecurity.com.
   • API Token: Microsoft Defender Cloud Apps API token with Read-only permissions you generated previously.
   • Status: Select the Cloud App status types to pull IoCs from. If no status is selected, IoCs from all Cloud Apps will be pulled.
   • Enable Tagging: Enable/Disable tagging functionality. When Yes is selected, status-specific tags will be added to the pulled IoCs.
   • Add Wildcard Prefix to IoCs: Add Wildcard Prefix functionality. When Yes is selected, a wildcard character will be prepended to each pulled IoC.
   • Wildcard: Wildcard character to prepend to each IoC when Add Wildcard Prefix to IoC(s) is set to Yes. A dot (.) is automatically inserted between the wildcard character and the IoC. Note that if the wildcard is kept empty while configuring the plugin, then it will prepend ‘*’ by default to all pulled IoCs ,and while editing the plugin configuring, it will throw a validation error to set the wildcard.

   

   Note

   • When the Allow status is selected, all indicators associated with apps, except Sanctioned, Unsanctioned, and Protected apps are pulled from the Cloud app catalog page into Cloud Exchange and are assigned with the allow tag.
   • IoC retraction will be based on Status field. Example: If the plugin was configured with Unsanctioned, Sanctioned, and Protected statuses, and then you edit the plugin and keep only Unsanctioned, Sanctioned statuses, then the IoCs that were pulled from apps with the Protected status will be marked as retracted yes in Cloud Exchange.

5. Click Save. Your plugin will be added on the Threat Exchange > Plugins page.

   

Configure a Threat Exchange Business Rule for Microsoft Defender for Cloud Apps

To share indicators fetched from the Microsoft Defender for Cloud Apps to the Netskope Tenant or any 3rd-party platform, you need to have a business rule that filters out the indicators that you want to share.

1. Go to Threat Exchange > Business Rules and Create New Rule.

   

2. Add the filter according to your requirements in the rule, and then click Save.

   

Configure Threat Exchange Sharing for Microsoft Defender for Cloud Apps

To share IOCs from the Microsoft Defender for Cloud Apps to the Netskope Tenant or any 3rd-party platform, you need to create a Sharing configuration.

1. Go to Threat Exchange > Sharing and click Add Sharing Configuration.

2. Select your Source Configuration (CTE Microsoft Defender for Cloud Apps), Business Rule, Destination Configuration (CTE Netskope Threat Exchange), and Targets. 

   

3. Click Save.

   

Validation

Validate the Pull

To verify the data available for pulling on Microsoft Defender for Cloud Apps. Log in to Microsoft Defender platform and navigate to Show navigation > Cloud apps > Cloud app catalog.

Open any of the applications, and then you will be able to see the Domain field. Those are the IoCs that will be pulled in Cloud Exchange.

Pulled data will be listed on the Threat IoCs page in Cloud Exchange. You can filter the IOCs pulled from the platform using the filter: sources.source Like “<plugin configuration name>”.

Here are some sample IoCs pulled with the Add Wildcard Prefix to IoCs as Yes:

Here are some sample IoCs pulled with the Add Wildcard Prefix to IoCs as No:

To verify pulled logs on Cloud Exchange, go to Logging and search logs from the CTE Microsoft Defender for Cloud Apps plugin using the plugin configuration name.

Validate the Pull Retraction

You can filter the logs related to retraction by using the filter: sources.source Like “[Retraction]”

You can validate the retracted IoCs on the Threat IoCs page:

Validate the Push Retraction

Push Retraction is not supported for Microsoft Defender for Cloud Apps. To push IoCs from Microsoft Defender for Cloud Apps to Netskope, or to see IoC retraction workflow, refer to the Netskope plugin guide.

IoCs pulled from Microsoft Defender for Cloud Apps were shared to the Destination Profile CTE Demo on the Netskope Tenant.

If any of the shared IoCs are marked as retracted in Cloud Exchange, it would be deleted from the Netskope tenant as well, and then retraction result will be marked as CTE Netskope Threat Exchange: retracted. 

Here you can see the IoCs that were marked Retracted Yes in the retraction screenshot, and were also deleted from the Destination Profile on the Netskope tenant.

Troubleshooting the Microsoft Defender for Cloud Apps plugin

Unable to configure the Microsoft Defender for Cloud Apps plugin

 It might be due to invalid credentials for Microsoft Defender for Cloud Apps.

What to do: Follow the steps in Configuration on the Microsoft Defender Platform.

Unable to pull IoCs from the Microsoft Defender for Cloud Apps platform

After the plugin configuration if the IoCs are not pulled from the platform, it might be due to there being no IoCs available on the platform to pull.

What to do: Identity your root cause from above and check if the IoCs are available on the platform to pull.

Known Behaviors

• We have observed that the IoCs with the ‘*’ Wildcard prepended cannot be shared to the Destination Profile. 
• If the same IoC is present under multiple applications having different status, then that IoC will not be marked as retracted in Cloud Exchange.