ZenBOT-Garibaldi-Defender-Basic
Overview
Details
This app contains "defenderisolate" search command, which calls Microsoft Defender REST API to isolate selected device id.
Splunk | defenderisolate command by NTT DATA
This app contains "defenderisolate" search command, which calls Microsoft Defender REST API to isolate selected device id.
Syntax is as follows; question mark indicating the optional Options.
App name is ispired to:
- zen: Japanese Zen philosophy, since that NTT DATA is Japanese multinational information technology service and consulting company headquartered in Tokyo
- BOT: robot automation
- Garibaldi: Italian general, patriot, revolutionary and republican. He contributed to Italian unification and creation of the Kingdom of Italy ledding the Expedition of the Thousand. "Obbedisco" was a famous answer to its king, Vittorio Emanuele II, to obey at its commands.
- Defender: integrated technology used
- Basic: app features
Do you want to know more about the “pro” version, or need a customized version?
Please contact us: splunk@nttzen.cloud
Command Syntax
| defenderisolate <stanza> <log_level>? <testmode>? <comment> <isolationType> <id>Options in detail
| Option | Type | Value |
|---|---|---|
| stanza | string | stanza name inside ntt_data_defender_settings.conf in which are defined Microsoft Defender access configurations |
| log_level | string | "INFO" OR "DEBUG" (default: "INFO") |
| testmode | string | "True" OR "False" (default: "False") |
| comment | string | text |
| isolationType | string | "Full" OR "Selective" |
| id | string | text |
Configuration
Microsoft Defender access configurations are defined in ntt_data_defender_settings.conf file inside default or local folder
[stanza_name_for_defender_instance]
auth_url = Microsoft Defender Base URL # defult: https://login.microsoftonline.com
auth_resourceappiduri = Defender API Base URL # default: https://api.securitycenter.microsoft.com
auth_tenantid = Tenant ID UUID created on Application Permission process
auth_appid = App ID UUID created on Application Permission process
auth_appsecret = App Secret created on Application Permission processExamples
Calls Microsoft Defender to isolate defined device id
| defenderisolate stanza="asset" log_level=INFO comment="isolate device" isolationType="Full" id="3cbb6e31c3b298fd3f523a0e1252940e0f51b3ba0"Enable test mode call to check payload format
| defenderisolate stanza="asset" log_level="DEBUG" testmode="True" comment="isolate device test" isolationType="Selective" id="3cbb6e31c3b298fd3f523a0e1252940e0f51b3ba0"Offical Documentation Microsoft Defender Machine Isolate API
Requirement
- Create Application Permission on Microsoft Defender. Do not use "Delegated Permissions"
- On Request API Permission find APIs my organization uses and select WindowsDefenderATP
- Set read and write permission to Machine.Isolate
| WindowsDefenderATP | |||
|---|---|---|---|
| AdvancedQuery.Read.All | Application | Run advanced queries | Yes |
| Alert.Read.All | Application | Read all alerts | Yes |
| Alert.Read\Write.All | Application | Read and write all alerts | Yes |
| Ip.Read.All | Application | Read IP address profiles | Yes |
| Machine.Isolate | Application | Isolate machine | Yes |
| Machine.Read.All | Application | Read all machine profiles | Yes |
| Machine.RestrictExecution | Application | Restrict code execution | Yes |
| Machine.Scan | Application | Scan machine | Yes |
| Machine.StopAndQuarantine | Application | Stop and quarantine file | Yes |
| Ti.Read.All | Application | Read all IOCs | Yes |
| Ti.Read.Write | Application | Read and write IOCs belonging to the app | Yes |
| Ti.ReadWrite.All | Application | Read and write all IOCs | Yes |
License\
Splunk End User for Third Party
Release Notes
This app contains "defenderisolate" search command, which calls Microsoft Defender REST API to isoltate selected device id.
Version 1.0.0
May. 23, 2022
© 2022 NTT DATA
Release Notes
Version 1.0.0
Release Notes
This app contains "defenderisolate" search command, which calls Microsoft Defender REST API to isoltate selected device id.\
Version 1.0.0\
May. 23, 2022\
\
© 2022 NTT DATA