Graph Security API

ways to better connect 7 your security operations Table of contents Introduction ................................................................. 1 7 scenarios that use the ......................... 9 How to use this guide.......................................................2 Microsoft Graph Security API 1. Streamline alert life-cycle management .........9 Microsoft Graph ........................................................ 3 2. Automate creation of security incidents ........9 Microsoft Graph Security API ......................... 4 3. Automate security response workflows .......10 Authentication .....................................................................5 4. Unlock additional security insights to inform threat response .......................................11 Connect to the API .............................................................8 5. Use custom threat intelligence in Microsoft security solutions ..............................13 6. Proactively manage security risks ...................14 7. Understand security threats targeting the organization and view trends ...................14 1 Introduction To combat the increasing number of cyberthreats, most Multiple schemas. Disparate schemas organizations rely on a diverse portfolio of security for alerts and other entities make solutions: endpoint protection, network firewalls, correlation of security data difficult. Core capabilities identity and access controls, cloud security, and so on. of the Microsoft Graph Security API This defense-in-depth strategy offers many security Inaccessible context. Critical information advantages, but gaps may still exist between solutions, about users or devices often lives outside Connect your and these gaps can hinder the organization’s ability the organization’s security tools. security solutions. to effectively manage vulnerabilities and respond to threats. By sharing security insights and enabling The Microsoft Graph Security API greatly simplifies Build intelligent orchestration across security solutions, organizations integration with Microsoft and third-party security security apps. can gain an advantage over today’s adversaries. solutions. Using one endpoint, one software development Unify security kit (SDK), one schema, and one authentication mechanism, management and Despite the benefits of connecting multiple security customers and partners can easily build integrated incident response. tools and workflows, integration challenges such security applications, workflows, and analytics. as the following can add cost and complexity: Automate security workflows. Multiple application programming interfaces Simplify reporting (APIs). Different endpoints, authentication and analytics. models, and data sets make integration time- consuming to set up and difficult to maintain. INTRODUCTION 2 How to use this guide This guide provides a comprehensive overview the insights from other security providers, of the Microsoft Graph Security API, including aggregating alerts into their own dashboards, common scenarios, and code samples for and enriching them with contextual information each. The primary audience for this guide is from related entities such as users and hosts. architects, developers, and scripters/tool smiths This guide helps you: from the following types of organizations: IT services and system integrators (SIs). SIs help customers integrate their security Understand Microsoft Graph and the Microsoft Independent software vendors (ISVs). ISVs can tools and workflows, implementing security Graph Security API. integrate their commercial security products and operations programs and processes. services with the Microsoft Graph Security API to Get familiar with use gain visibility into security alerts, secure score, and Enterprises. Enterprises build custom security apps, cases and scenarios that use the Microsoft contextual data from Microsoft Graph providers integrate security tools and workflows, and develop Graph Security API. and shared threat intelligence. Optionally, ISVs tools and analytics for hunting and detection. can also become providers to the Microsoft Graph Connect with additional Security API as peers to Microsoft providers. Partners can integrate their applications with Microsoft documentation, Graph Security API to build connected security solutions. resources, and sample applications and code Managed security service providers (MSSPs) or They can also surface their data through the Microsoft to get started quickly. managed service providers (MSPs). MSSPs and MSPs Graph Security API to become a security provider. develop applications to support security management Contact the Microsoft Graph Security team by email at and monitoring services. They can immediately benefit [email protected] if you’re interested from the Microsoft Graph Security API, integrating in onboarding as a Microsoft Graph Security provider. various security solutions, taking advantage of MICROSOFT GRAPH 3 Microsoft Graph Microsoft Graph (graph.microsoft.com) is a collection of the information you need. For example, to get the APIs that together provide a standard unified interface list of important messages for a user, you send a GET and schema for accessing information from Microsoft request of https://graph.microsoft.com/v1.0/ Documentation online services (for example, Azure Active Directory me/messages?$filter=importance eq 'high'. [Azure AD], Office 365, OneDrive, OneNote, Microsoft These APIs are easy to implement; share a common For more information SharePoint, Microsoft Planner, Microsoft Intune, etc.) authentication framework based on OpenID Connect, about Microsoft and third-party vendors (in applicable APIs). This single OAuth 2.0, and a Web Representational State Transfer Graph, see Use the connection point (graph.microsoft.com) is the root for (REST) API with standard JavaScript Object Notation Microsoft Graph API. the other namespaces assigned to the services accessible (JSON) response formats; and support a variety of through the Microsoft Graph API. You can simply add platforms, with easy-to-use SDKs and code samples. additional namespaces and filtering elements to get MICROSOFT GRAPH SECURITY API 4 Microsoft Graph Security API Part of Microsoft Graph, the Microsoft Graph Security and identity, through Secure Score Control Profiles. API integrates with security solutions from Microsoft Scores and profiles are available from each security Frequently asked and partners in a federated model; it can also be used provider that offers them—valuable information that in conjunction with other Microsoft Graph entities to can help guide vulnerability remediation actions The Microsoft Graph gain additional context (for example, Office 365 and based on the suggested actions available in each Security API is not Azure AD). The API has multiple entities, including: profile. By default, 90 days of data is retained. about security for Microsoft Graph. This API provides security Alerts from multiple security solutions, each Example Query data across different representing that potentially malicious activity security products running GET https://graph.microsoft.com/v1.0/ in your organization. has been detected within the organization. security/secureScores?$top=1 Example Query No extra cost GET https://graph.microsoft.com/v1.0/ Threat intelligence indicators refer to information security/alerts?$filter=severity eq 'high' about known threats, such as malicious IP addresses, An Azure subscription domains, or URLs. Organizations can send their threat is all you need to use intelligence to targeted Microsoft services to enable the Microsoft Graph Secure Score provides information about an custom detections. An action can be specified for each Security API. There is no organization’s security posture, including a numeric indicator (either block, alert, or allow) signaling to the additional cost. Access rating based on elements like the enabled security target solution what action to take on that indicator. to data from third-party service providers may features in your environment and outstanding security require corresponding risks. This score is available at the tenant level as subscriptions with well as at a specific control area, such as device, app, those vendors. MICROSOFT GRAPH SECURITY API 5 Example Query Example Query POST https://graph.microsoft.com/ POST https://graph.microsoft.com/ beta/security/tiIndicators/ beta/security/securityActions Content-type: application/json Content-type: application/json Accessing the API { { "action": "alert", "name": "BlockIp", Access the Microsoft "confidence": 0, "actionReason": "Test", Graph Security API by "description": "MD5 hash on watch while "parameters": [ using the following URL: system vulnerabilities being addressed", { https://graph.microsoft. "expirationDateTime": "2019-03- "name": "IP", 01T21:43:37.5031462+00:00", com/VERSION/security/ "value": "1.2.3.4" ENTITY?$filter=FILTER "externalId": "Test-- } 8586509942679764298MS501", ], VERSION is the API "fileHashType": "MD5", "vendorInformation": { version (e.g., v1.0, beta) "fileHashValue": "provider": "Windows Defender ATP", "fe8a8226a4cfd0deffe209069a7e64d908b74de8", ENTITY is the specific "severity": 0, "vendor": "Microsoft" entity (e.g., alerts) "targetProduct": "Azure Sentinel", } "threatType": "WatchList", } FILTER limits the results (e.g., severity eq 'high') "tlpLevel": "green"} The following is a Authentication complete example: Security actions provide the ability to perform tasks pertaining to specific

Load more