No, you can still use Graph API. The only one that is deprecated is the REST API. Here is how to configure on Azure side: https://www.ibm.com/docs/en/dsm?topic=options-configuring-microsoft-graph-security-api-communicate-qradar
I've used it a dozen times for clients using /alerts_v2 and Microsoft 365 Defender DSM. No issues.
If you use log source type 'Microsoft 365 Defender' and protocol type 'Microsoft Security Graph API' you don't get asked for a login endpoint.
------------------------------
Jason Quinn
------------------------------
Original Message:
Sent: Tue March 19, 2024 09:45 AM
From: Simone Tacchella
Subject: Microsoft Defender 365 - Graph Security API
Really appreciated your answer, so the only way to integrate on Qradar the microsoft 365 defender logs it is with the azure event hub, cause my costurmer didn't want to configure it, all API the REST one and the GRAPH one aren't avaible right?
------------------------------
Simone Tacchella
Original Message:
Sent: Tue March 19, 2024 09:28 AM
From: JOHN HANDROP
Subject: Microsoft Defender 365 - Graph Security API
The API is probably no longer available from Microsoft. I assume neither work:
"Microsoft no longer allows the onboarding of new integrations with their SIEM API. For more information, see Deprecating the legacy SIEM API (https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/deprecating-the-legacy-siem-api/ba-p/3139643)."
Reference: https://www.ibm.com/docs/en/dsm?topic=m3d-microsoft-defender-endpoint-siem-rest-api-log-source-parameters
------------------------------
JOHN HANDROP
Original Message:
Sent: Mon March 18, 2024 11:07 AM
From: Simone Tacchella
Subject: Microsoft Defender 365 - Graph Security API
Hi everyone, i have a problem on configuring the microsoft defender log source protocol tab for my client. I didn't find anything about what kind of url i need to add at "Login Endpoint" voice. I try with login.microsoftonline.com or https://login.microsoftonline.com/"with tenant id correct"/oauth2/v2.0/authorize but the test at the dns resolutions step tell me "Unable to resolve login.microsoft.com" any suggestions on the cause of the problem? and anyone could tell me the right url to add?
Thanks a lot
------------------------------
Simone Tacchella
------------------------------