Microsoft Defender for Endpoint Plugin for Threat Exchange (en anglais)

This document explains how to configure the Microsoft Defender for Endpoint v1.4.0 plugin for the Threat Exchange module of the Netskope Cloud Exchange platform. This plugin is used to pull indicators of type URL, IPv4, IPv6, Domain, MD5 and SHA256 from the System > Settings > Endpoints > Indicators page of the Microsoft Defender for Endpoint platform. This plugin supports sharing indicators of type URL, IPv4, IPv6, Domain, MD5 and SHA256 to the System > Settings > Endpoints > Indicators page in the Microsoft Defender for Endpoint platform. This plugin also supports pull and push retraction of indicators from the Microsoft Defender for Endpoint platform.

Conditions préalables

Pour compléter cette configuration, vous avez besoin de :

• Un locataire Netskope (ou plusieurs, par exemple des instances de production et de développement/test).
• Un profil de fichier sur votre locataire Netskope.
• A URL List on your Netskope tenant.
• A Destination Profile on your Netskope tenant.
• A Private App on your Netskope tenant.
• A DNS Profile on your Netskope tenant.
• Un abonnement à Secure Web Gateway pour le partage d'URL.
• A Netskope Cloud Exchange tenant with the the Tenant plugin and Threat Exchange plugin already configured.
• Un compte Microsoft Defender for Endpoint.
• Votre identifiant de locataire Microsoft Azure, votre identifiant de client et votre secret de client.
• Une application Microsoft Azure disposant de l'autorisation Ti.ReadWrite.All. Pour plus d'informations, consultez cet article.
• Connectivité avec ces hôtes :
  • https://api.securitycenter.microsoft.com/api/indicators
  • https://securitycenter.windows.com
  • https://login.microsoftonline.com
  • https://portal.azure.com

Prise en charge de Microsoft Defender for Endpoint Plugin

This plugin is used to pull indicators of type URL, IPv4, IPv6, Domain, MD5 and SHA256 from the System > Settings > Endpoints > Indicators page of the Microsoft Defender for Endpoint platform. This plugin supports sharing indicators of type URL, IPv4, IPv6, Domain, MD5 and SHA256 to the System > Settings > Endpoints > Indicators page in the Microsoft Defender for Endpoint platform. This plugin also supports pull and push retraction of indicators from the Microsoft Defender for Endpoint platform.

Retrait de l'IoC

IoC Retraction (Pull): Indicators will be fetched from Microsoft Defender for Endpoint and in the subsequent pull cycles if some indicators are deleted on Microsoft Defender for Endpoint or not within the retraction interval range then they will be marked as Retraced in Cloud Exchange.

IoC Retraction (Push): Retracted indicators present on Cloud Exchange will be deleted from Microsoft Defender for Endpoint during sharing.

Mises en correspondance

Mappages de traction

Voici les mappings pour les IoCs tirés.

Correspondances de gravité pour la traction

Mappages de poussée

Voici les mappings pour les IoCs partagés.

Severity Mapping for push

Permissions

Application Microsoft Azure avec l'autorisation Ti.ReadWrite.All . Pour plus d'informations, cliquez ici.

scope = ["https://api.securitycenter.microsoft.com/.default"]
authority = "https://login.microsoftonline.com/{tenantID}

app = msal.ConfidentialClientApplication(
           client_id={clientID}, authority=authority, client_credential={clientSecret}, proxies=proxy
)
auth_json = app.acquire_token_for_client(scopes=scope)
auth_token = auth_json.get("access_token", "")

{
  "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators",
  "value": [
    {
      "id": "66407",
      "indicatorValue": "a40da157d2e56d26c01d8d57947779e1b403999ed32a1ac3553b46f501542e0d",
      "indicatorType": "FileSha256",
      "action": "Audit",
      "createdBy": "d45ccecf-7406-47f6-90e5-05f0b3f76094",
      "severity": "Informational",
      "category": 1,
      "application": null,
      "educateUrl": null,
      "bypassDurationHours": null,
      "title": "Indicator a40da157d2e56d26c01d8d57947779e1b403497e999a1ac3553b46f501542e0d of type FileSha256",
      "description": "Pull Test",
      "recommendedActions": null,
      "creationTimeDateTimeUtc": "2026-01-21T09:08:36.9319034Z",
      "expirationTime": null,
      "lastUpdateTime": "2026-01-21T09:08:36.9319034Z",
      "lastUpdatedBy": null,
      "rbacGroupNames": [],
      "rbacGroupIds": [],
      "notificationId": null,
      "notificationBody": null,
      "version": null,
      "mitreTechniques": [],
      "historicalDetection": false,
      "lookBackPeriod": null,
      "generateAlert": true,
      "additionalInfo": null,
      "createdByDisplayName": "Demo app",
      "externalId": null,
      "createdBySource": "PublicApi",
      "certificateInfo": null
    },
    {
      "id": "66408",
      "indicatorValue": "521e25b2d1bb9f8059dc7b0e86d05454bd599941e2a59620521ba1510be110e6",
      "indicatorType": "FileSha256",
      "action": "Audit",
      "createdBy": "d45ccecf-7406-47f6-90e5-05f999f76094",
      "severity": "Informational",
      "category": 1,
      "application": null,
      "educateUrl": null,
      "bypassDurationHours": null,
      "title": "Indicator 521e25b2d1bb9f8059dc7b0e86d05454bd565441e9999620521ba1510be110e6 of type FileSha256",
      "description": "Pull Test",
      "recommendedActions": null,
      "creationTimeDateTimeUtc": "2026-01-21T09:08:37.7747306Z",
      "expirationTime": null,
      "lastUpdateTime": "2026-01-21T09:08:37.7747306Z",
      "lastUpdatedBy": null,
      "rbacGroupNames": [],
      "rbacGroupIds": [],
      "notificationId": null,
      "notificationBody": null,
      "version": null,
      "mitreTechniques": [],
      "historicalDetection": false,
      "lookBackPeriod": null,
      "generateAlert": true,
      "additionalInfo": null,
      "createdByDisplayName": "Demo app",
      "externalId": null,
      "createdBySource": "PublicApi",
      "certificateInfo": null
    }
]
}

{
        "indicatorValue": "malicious.example.com",
        "indicatorType": "DomainName",
        "action": "Block",
        "title": "Indicator malicious.example.com of type DomainName",
        "description": " Netskope-CTE | demo | Example domain IOC",
        "severity": "High",
        "generateAlert": true,
}

{
  "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators/$entity",
  "id": "67908",
  "indicatorValue": "malicious.example.com",
  "indicatorType": "DomainName",
  "action": "Block",
  "createdBy": "d45ccecf-7406-47f6-90e5-05f0b3f76094",
  "severity": "High",
  "category": null,
  "application": null,
  "educateUrl": null,
  "bypassDurationHours": null,
  "title": "Indicator malicious.example.com of type DomainName",
  "description": " Netskope-CTE | demo | Example domain IOC",
  "recommendedActions": null,
  "creationTimeDateTimeUtc": "2026-02-09T07:01:36.6399107Z",
  "expirationTime": null,
  "lastUpdateTime": "2026-02-09T07:01:36.6399107Z",
  "lastUpdatedBy": null,
  "rbacGroupNames": [],
  "rbacGroupIds": [],
  "notificationId": null,
  "notificationBody": null,
  "version": null,
  "mitreTechniques": [],
  "historicalDetection": false,
  "lookBackPeriod": null,
  "generateAlert": true,
  "additionalInfo": null,
  "createdByDisplayName": "Demo app",
  "externalId": null,
  "createdBySource": "PublicApi",
  "certificateInfo": null
}

{
    "IndicatorIds": [
        "<Indicator ID>"
    ]
}

Status Code: 204 No Content

Matrice de performance

Here is the performance reading conducted by pulling and sharing 15K indicators from/to Microsoft Defender for Endpoint on a Large CE Stack with these specifications.

Agent utilisateur

netskope-ce-6.1.0-cte-microsoft-defender-for-endpoint-v1.4.0

Workflow

1. Get your Tenant ID, Application (Client) ID, and Client Secret from Microsoft Defender.
2. Add API Permissions for Microsoft Defender.
3. Configurez le plugin Microsoft Defender for Endpoint.
4. Configure a Business Rule for Microsoft Defender for Endpoint.
5. Configure Sharing for Netskope and Microsoft Defender for Endpoint.
6. Validate the Microsoft Defender for Endpoint Plugin.

Regardez une vidéo

Cliquer sur « play » pour regarder une vidéo.

Get your Tenant ID, Application (Client) ID and Client Secret from Microsoft Defender

1. Go to https://entra.microsoft.com/ and log in with your credentials 

2. Cliquez sur App registrations.

   

3. Cliquez sur New Registration.

   

4. Indiquez le nom de la candidature et cliquez Register.

   

5. Copy the Application (Client ID), which is the Client (Application) ID in Netskope. Also copy the Directory (tenant) ID, which is tenant ID in Netskope. Click Certificates & Secrets.

   

6. Cliquez New client secret. Ajoutez une description et cliquez Save.

   

7. Copy the value; it is the Client Secret needed for the plugin configuration.

   

Add API Permissions 

1. Dans le panneau de gauche, cliquez sur API permissions.

   

2. Cliquez sur Add a permission.

   

3. Cliquez sur APIs my organization uses puis sur WindowsDefenderATP.

   

4. Cliquez sur Application permissions.

   

5. Select the Ti.ReadWrite.All permissions and click Add permission.

   

    Cliquez sur Grant admin consent for Contoso.

   

   Cliquez sur Yes.

   

Configurer le plugin Microsoft Defender for Endpoint

1. Dans Cloud Exchange, accédez à Settings > Plugin Store.

2. Recherchez et sélectionnez le plugin Microsoft Defender for Endpoint v1.4.0 (CTE).

   

3. Saisissez les informations de base :

   • Configuration Name: Nom unique pour la configuration.
   • Sync Interval: Leave the default.
   • Aging Criteria: Durée d'expiration du plugin en jours. (Valeur par défaut : 90)
   • Override Reputation: Set a value to override the reputation of indicators received from this configuration.
   • Tags Aggregate Strategy: Choisissez d'ajouter les balises New aux IoC existants ou de les écraser. Ces paramètres de configuration déterminent la manière dont les étiquettes sont stockées pour les indicateurs tirés dans le cadre de cette configuration.
   • Enable SSL Validation: Enable SSL Certificate validation.

   

4. Cliquez sur Next et entrez les paramètres de configuration :

   • Base URL: Base URL of the Microsoft Defender for Endpoint platform.
   • Tenant ID: Directory (Tenant) ID of the Microsoft Entra ID application.
   • Application ID: Application (Client) ID of the Microsoft Entra ID application.
   • Application Secret: Client Secret of the Microsoft Entra ID application.
   • IOC Source (Applicable only while sharing IoCs): The source where this indicator originated. This can be used for tracking where this indicator was defined. Limit 200 characters.
   • Type of Threat data to pull: Type of Threat data to pull. If no threat type is selected, all threat type indicators will be pulled.
   • Actions: Select the action(s) to filter the pulled indicators. If no action is selected, all indicators will be pulled regardless of their action.
   • Indicators with Generated Alert: Select whether to pull indicators based on their Generate Alert flag. Both pulls all indicators regardless of this flag.
   • Enable Polling: Enable/Disable polling data from Microsoft Defender for Endpoint. Disable if you only need to push indicators to Microsoft Defender for Endpoint.
   • Retraction Interval (in days): Spécifiez le nombre de jours pendant lesquels la rétractation IoC doit être effectuée pour les indicateurs Microsoft Defender for Endpoint. Ce paramètre ne s’applique que si la rétractation IoC(s ) est activée dans les paramètres d’échange de menaces. La valeur doit être comprise entre 1 et 365.
   • Initial Range (in days): Nombre de jours pour extraire les données pour l'exécution initiale.

   

5. Cliquez sur Save. 

   

Configure a Threat Exchange Business Rule for Microsoft Defender for Endpoint

Pour partager les indicateurs extraits de Microsoft Defender for Endpoint avec Netskope, et vice-versa, vous devez disposer d'une règle de gestion qui filtrera les indicateurs que vous souhaitez partager. Pour configurer une règle de gestion :

1. Dans Threat Exchange, allez à Business Rules et cliquez sur Create New Rule.

   

2. Ajoutez le filtre selon vos exigences dans la règle, puis cliquez sur Save.

   

   FQDN present in Cloud Exchange will be shared as URL/Domain in Microsoft Defender.

Configurer le partage pour Netskope et Microsoft Defender for Endpoint

Pour partager des IoC de Netskope Cloud Exchange vers la plateforme Microsoft Defender for Endpoint, et vice versa, suivez les étapes suivantes :

1. Dans Threat Exchange, allez à Sharing et cliquez sur Add Sharing Configuration.

2. Select la configuration de la source (Netskope CTE), la règle de gestion, la configuration de la destination (Microsoft Defender for Endpoint) et la (les) cible(s). Entrez ces valeurs :

   • Action: The action that is taken if the indicator is discovered in the organization.
   • Generate Alert: Generate alerts for the indicators. Note that for the action type Audit, the Generate Alert will be Yes by default, so even if you keep it as No with the action type Audit you will see the shared IoCs on Defender will have Generate alert as Yes.
   • Allow Existing Indicators to be deleted?: Whether or not to delete the existing indicator(s) from the Microsoft Defender for Endpoint platform to insert new indicator(s). If Yes is selected, the oldest indicator will be deleted when max capacity of 15000 active indicators per tenant is exceeded.

   

3. Cliquez sur Save.

4. Follow these steps again, but vice-versa for sharing Microsoft Defender for Endpoint IoCs to Netskope. Select your Source Configuration as Microsoft Defender for Endpoint, a Business Rule, Destination Configuration (CTE Netskope Threat Exchange), and Target.

5. Lorsque vous avez terminé, cliquez sur Save.

   

Valider le plugin Microsoft Defender for Endpoint

Valider le retrait

Les données extraites seront répertoriées dans Threat Exchange à l'adresse Threat IoCs. Vous pouvez filtrer les IoCs extraits de la plateforme en utilisant le filtre : sources.source,contains <plugin name>.

Pour vérifier les journaux tirés dans Cloud Exchange, allez sur Logging et recherchez les journaux pour le plugin Microsoft Defender for Endpoint.

To verify the data available for pulling on Microsoft Defender for Endpoint, log in to Microsoft Defender and go to Settings > Endpoints > Indicators. You can verify URL indicators from IP Addresses and URLs/Domains page, and MD5 and SHA256 from the File Hashes page.

Valider le push

Shared IoCs to Microsoft Defender for Endpoint can be verified at Logging in Cloud Exchange.

Pour vérifier les indicateurs partagés sur Microsoft Defender. Connectez-vous à Microsoft Defender et allez sur Settings > Endpoints > Indicators. 

Vous pouvez filtrer les indicateurs partagés en appliquant un filtre du type "Created by : <app_name>".

Validez la rétractation

Pour vérifier les IoC rétractés de Microsoft Defender, consultez les journaux pour l'exemple de rétractation d'IoC : message Like “CTE Microsoft Defender for Endpoint” && message Like “retraction”. 

Pour vérifier les IoCs rétractés dans Cloud Exchange, allez sur Threat IoCs et cherchez "sources.source Like "CTE CrowdStrike" && sources.retracted Is equal true". 

Here’s the Destination Profile on the Netskope tenant before push retraction for CTE Netskope Threat Exchange executes:

You can verify the deletion of IoC from Netskope tenant from the Retraction result filed under particular IoC. In the below image you can see the Retraction result is marked as CTE Netskope Threat Exchange: retracted that means it was deleted from the Netskope tenant.

Here’s the URL List on the Netskope tenant after push retraction for CTE Netskope Threat Exchange executes:

This plugin also supports push retraction, which means IoCs pulled from 3rd-party platforms that were shared to Microsoft Defender platforms, and were marked as retracted in Cloud Exchange, will also get deleted from the Microsoft Defender platform. You can verify the same through the Retraction result field.
This is an MD file present on Defender:

Here the retraction result is CTE Microsoft Defender for Endpoint: retracted this means that particular IoC was deleted from Microsoft Defender platform as it was marked as retracted yes in Cloud Exchange.

MD5 was deleted from the Defender platform:

Dépannage du plugin Microsoft Defender for Endpoint

Impossible de configurer le plugin

This may be due to one of these reasons:

• Invalid configuration parameters. 
• Insufficient permissions.
• License Error: During configuration of plugin if you receive error message “Plugin: Microsoft Defender for Endpoint, Validation error occurred. Received status code: 403, Unauthorized request – No active license found”, it may indicate that you have selected an incorrect Base URL for the credentials used.

What to do:

1. Vérifiez que tous les identifiants locataires, identifiants d’application et secrets d’application sont corrects et disposent des autorisations appropriées. Suivez la section Configuration sur Microsoft Defender .
2. Verify proper permissions are provided.

Unable to share IOCs to Microsoft Defender for Endpoint. 

This may be due to the max capacity of 15000 active indicators per tenant on Microsoft Defender for Endpoint.

What to do:

Check the total number of IoCs on your Microsoft Defender for Endpoint. If it is 15k then you can edit the sharing configuration with Allow Existing Indicators to be deleted? fieldas Yes. If Yes is selected, the oldest indicator will be deleted when max capacity of 15000 active indicators per tenant is exceeded.

Error while upgrading the plugin

While updating the plugin from version v1.3.0 to version v1.3.1 user will get an validation error while saving the plugin as follows:

What to do:
In this case the follow the steps to successfully enable the plugin:

1. Select the skip option.
2. Go to the configured Threat exchange plugin, click on the edit icon for the Microsoft Defender for Endpoint plugin, and remove the actions Alert and Alert And Block if selected previously. 
3. Select the value for Indicators with Generated Alert field as per your requirement whether you want to pull all the indicators or the one with generated alerts yes or no.
4. Enregistrez le plugin.
5. Cliquez sur l’icône d’activer et sélectionnez Enable.