Reviewing XDR Stories for Microsoft Defender for Endpoint Alerts

Using the Microsoft API, you can integrate alert data from Microsoft Defender for Endpoint to generate stories for endpoint devices. The endpoint stories help you get a more complete picture of potential threats in your network.

The Cato Endpoint Alerts engine creates a story by correlating data from Defender Alerts that occurred on the same device within a 24-hour period. Endpoint Alert stories include all relevant evidence for the Alert detected by Defender. The Stories Workbench shows the endpoint stories together with the other story types, and you can sort and filter the stories to focus on the Endpoint Alert stories.

To integrate Defender for Endpoint alert data with Cato XDR, you need to first set up API connectors for Microsoft 365 and for Defender for Endpoint. After creating the connectors, the Endpoint Alert engine retrieves and analyzes the alert data from Defender for Endpoint.

To configure Cato's Microsoft Defender connector to fetch alert data, first you need to configure the Microsoft 365 connector as the parent app to give read permissions for the Defender connector. The parent app only has permissions to manage the Microsoft connectors. After configuring the Microsoft 365 connector, you can configure a Defender connector to retrieve the alert data.

If you want to import alert data from different sub-organizations within your organization, create a separate Microsoft 365 connector for each relevant Azure tenant, and then configure a Defender connector for each tenant.

Configure a parent Microsoft 365 connector and then define a Defender connector for the Microsoft 365 account.

If your organization already configured a Microsoft 365 parent connector for another feature, such as a Saas Security API policy for Microsoft apps, or for importing MIP labels to your DLP policy, you only need to configure a Defender connector.

Configuring the Microsoft 365 Connector

Use the Cato Management Application to create the Microsoft 365 SaaS application connector for the relevant Azure tenant. You must have the correct credentials to authenticate to Microsoft 365 to add the connector to your Cato account.

To configure the Microsoft 365 parent endpoint connector:

1. From the navigation menu, select Security > Connectors, and select the Connectors Settings tab.

2. Click New. The New Connector panel opens.

3. From the SaaS Application drop-down menu, select the Microsoft 365 app.

   

4. Enter a unique Connector Name.

5. Click Authorize and Save.

   A new browser tab opens to the Microsoft 365 app.

6. In the new browser tab, authenticate to the Microsoft 365 app:

   1. Select the Microsoft account for the Microsoft 365 app.

   2. Enter the password for the app and approve it.

   3. Accept the permissions to let Cato access the Microsoft 365 app.

      

   4. The screen shows that you have successfully applied the permissions for the app.

      

      You can close the browser tab and return to the Cato Management Application.

7. The Microsoft 365 SaaS application is added to the Connectors Settings page.

   

   It can take Microsoft Azure several seconds to process the request, so if the Status shows Pending user consent, refresh the browser.

The Stories Workbench page shows a summary of the stories for the potential threats in your account.

For information about the columns in the Stories Workbench see Understanding the Stories Columns

You can group and filter the stories according to the Endpoint Alert story type to quickly find stories for endpoint devices. For more about grouping and filtering stories, see Reviewing Detection & Response (XDR) Stories in the Stories Workbench.

You can click on a story in the Stories Workbench to drill-down and investigate the details in a different page. This page contains a number of widgets that help you evaluate the potential threat identified in the story.

When you drill-down to investigate an Endpoint Alert story, you can review all the Defender Alerts that the story is based on, and examine in detail the pieces of evidence that relate to each Alert. The Evidences include processes, files, and registry values, and can be reviewed in two different ways:

Understanding the Endpoint Alert Story Drill-Down Widgets

These are the story drill-down widgets:

Name	Description
Story summary (top row)	The Overview shows a summary of basic information about the story, including: Indication for the detected attack The Detection & Response engine that created the story Severity of the threat as determined by analyst Verdict for the threat as determined by analyst Attack type (for example, Browser Extension, Native Application, Scanner, Web App) Detailed classification of the threat as determined by analyst (for example, Port Scan, Newly Registered Domain, SMB Scan) Number of compromised devices Number of signals (traffic flows) associated with the attack Duration of the story since it was created Story status Use the Actions drop-down menu and select Manage Story change story settings such as Analyst Verdict, Analyst Severity, Status, and Classification. The Related Stories tab provides context for the story you're investigating by letting you quickly review stories with the same source and stories with similar characteristics involving different sources on your network.
Story timeline (second row)	Shows a timeline of the story, such as changes made to the story verdict and severity, and when new Alerts are added to the story
Details	Basic information for analyzing the story, including: Criticality - Overall risk score for the story as calculated by Cato's machine learning risk analysis algorithm (values are from 1 (least critical) to 10 (most critical)) Created At - Time of the first traffic flow for the story Updated At - Time of the latest story update, such as a new alert or changed verdict
Device	Name and operating system for the endpoint device associated with the story
User	Shows the user name and domain name for the user logged into the endpoint device
Alerts	Shows details for the Alerts related to the story. Expand an Alert to show a chronological process tree for the Evidences related to the Alert, including processes, files, and registry values Click an item in the process tree to drill-down further and show granular data about the Evidence These are the columns in the Alerts table: An Alert Name that describes the suspicious activity Criticality - Overall risk score for the Alert as calculated by Cato's machine learning risk analysis algorithm (values are from 1 - 10) MITRE Techniques - MITRE ATT&CK® techniques identified for the threat For more about the MITRE ATT&CK® framework, see Working with the MITRE ATT&CK® Dashboard. Status - Shows whether the Alert is New or was already Resolved First Activity Date - Date of initial suspicious activity detected for the Alert Last Activity Date - Date of most recent suspicious activity detected for the Alert Threat Name - Name of malware detected. For example: Trojan:Win32/Startpage Description & Recommended Actions - Click View for a brief Alert description and recommended steps for investigating and mitigating the threat Target - The URL involved in the Alert Destination IP - The remote IP address involved in the story
Evidences	Aggregates details for all the Processes, Files, and Registry values identified in the evidence for the various story Alerts. Some of the columns in the Evidences table are shared by all the types of Evidences, and some are specific per type. These are the columns that appear for all types of Evidences: Verdict - Verdict generated by Defender for the piece of evidence (Malicious, Suspicious, or No threats found) Remediation Status - Shows whether the threat was remediated Created - Date and time when the event was recorded These are the specific columns for each type of Evidence: Processes: Process Name - Name of the executable file for the process Process ID - Windows-assigned ID number for the process Process Command Line - Arguments that were passed to the process in Windows. This can reveal important context about the execution of a suspicious process File Path - Location on the endpoint device of the executable file for the process Files: File Path - Location of the file on the endpoint device File Name - Name of the file including extension File Size - Size of the file in bytes, kilobytes, or megabytes Registry: Registry key Name Registry Value Type - Format of the data stored in the registry value Registry Value - The value of the registry entry