IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Parsing logs from Microsoft defender for cloud

    Posted 10/24/22 07:18 AM
    Hello all,

    does anyone have some tips/tricks/guides for parsing the Microsoft defender for cloud logs in Qradar? Info such what is important to parse, what not etc.
    Thank you.

    Regards

    ------------------------------
    Tomas Tyser
    ------------------------------


  • 2.  RE: Parsing logs from Microsoft defender for cloud

    Posted 10/25/22 07:44 AM
    Hi,

    For defender cloud I use "QRadar Microsoft 365 Defender DSM and depending on the event type, I make some custom properties. For example:

    Event Name: Process Created
    category
    DeviceName
    FileName
    FolderPath
    ProcessCommandLine
    Hash

    Event Name : Interactive Logon Success
    LogonType
    Protocol
    AccountDisplayName
    AccountUpn
    AccountName
    AccountDomain
    TargetComputerOperatingSystem

    And so on...

    https://www.ibm.com/docs/en/dsm?topic=microsoft-365-defender

    ------------------------------
    Carlos Medina
    ------------------------------



  • 3.  RE: Parsing logs from Microsoft defender for cloud

    Posted 10/26/22 09:13 AM
    Hello Carlos, thank you for the reply. I did try that first, but I could not find the type of events under M 365 D I get from the Cloud :/

    ------------------------------
    Tomas Tyser
    ------------------------------

    Original Message


  • 4.  RE: Parsing logs from Microsoft defender for cloud

    Posted 10/26/22 09:27 AM

    Hi Tomas,

    I would recommend to use content pack which parses fields from payload:

    take a look:

    https://exchange.xforce.ibmcloud.com/hub/extension/c8e594fa5d744dcb23859a8fb060bc9d



    ------------------------------
    [Ashish] [Khandewale] [Security Consultant]
    [SIOC]
    [IBM Canada]
    ------------------------------

    Original Message