Set up Microsoft Sentinel integration for Defender for Cloud Apps (Preview)

You can integrate Microsoft Defender for Cloud Apps with Microsoft Sentinel (a scalable, cloud-native SIEM and SOAR) to enable centralized monitoring of alerts and discovery data. Integrating with Microsoft Sentinel allows you to better protect your cloud applications while maintaining your usual security workflow, automating security procedures, and correlating between cloud-based and on-premises events.

Benefits of using Microsoft Sentinel include:

• Longer data retention provided by Log Analytics.
• Out-of-the-box visualizations.
• Use tools such as Microsoft Power BI or Microsoft Sentinel workbooks to create your own discovery data visualizations that fit your organizational needs.

Other supported integration solutions for Defender for Cloud Apps include:

• Generic SIEMs - Integrate Defender for Cloud Apps with your generic SIEM server. For information in integrating with a Generic SIEM, see Generic SIEM integration.
• Microsoft security graph API - An intermediary service (or broker) that provides a single programmatic interface to connect multiple security providers. For more information, see Security solution integrations using the Microsoft Graph Security API.

Integrating with Microsoft Sentinel includes configuration in both Defender for Cloud Apps and Microsoft Sentinel.

Prerequisites

To integrate with Microsoft Sentinel:

• You must have a valid Microsoft Sentinel license
• You must be at least a Security Administrator in your tenant.

US Government support

The direct Defender for Cloud Apps - Microsoft Sentinel integration is available to commercial customers only.

However, all Defender for Cloud Apps data is available in Microsoft Defender XDR, and therefore available in Microsoft Sentinel via the Microsoft Defender XDR connector.

We recommend that GCC, GCC High, and DoD customers who are interested in seeing Defender for Cloud Apps data in Microsoft Sentinel install the Microsoft Defender XDR solution.

For more information, see:

• Microsoft Defender XDR integration with Microsoft Sentinel
• Microsoft Defender for Cloud Apps for US Government offerings

Integrating with Microsoft Sentinel

1. In the Microsoft Defender Portal, select Settings > Cloud Apps.

2. Under System, select SIEM agents > Add SIEM agent > Sentinel. For example:

   

   Note

   The option to add Microsoft Sentinel is not available if you have previously performed the integration.

3. In the wizard, select the data types you want to forward to Microsoft Sentinel. You can configure the integration, as follows:

   • Alerts: Alerts are automatically turned on once Microsoft Sentinel is enabled.
   • Discovery logs: Use the slider to enable and disable them, by default, everything is selected, and then use the Apply to drop-down to filter which discovery logs are sent to Microsoft Sentinel.

   For example:

   

4. Select Next, and continue to Microsoft Sentinel to finalize the integration. For information on configuring Microsoft Sentinel, see Microsoft Sentinel data connector for Defender for Cloud Apps. For example:

   

Alerts and discovery logs in Microsoft Sentinel

Once the integration is completed, you can view Defender for Cloud Apps alerts and discovery logs in Microsoft Sentinel.

In Microsoft Sentinel, under Logs, under Security Insights, you can find the logs for the Defender for Cloud Apps data types, as follows:

The following table describes each field in the McasShadowItReporting schema:

Use Power BI with Defender for Cloud Apps data in Microsoft Sentinel

Once the integration is completed, you can also use the Defender for Cloud Apps data stored in Microsoft Sentinel in other tools.

You can use Microsoft Power BI with Defender for Cloud Apps data in Microsoft Sentinel to shape and combine data and build reports and dashboards that meet the needs of your organization.

To get started:

1. In Power BI, import queries from Microsoft Sentinel for Defender for Cloud Apps data. For more information, see Import Azure Monitor log data into Power BI.

2. Install the Defender for Cloud Apps Shadow IT Discovery app and connect it to your discovery log data to view the built-in Shadow IT Discovery dashboard. To connect the app, open it in Power BI, select Connect, enter your Microsoft Sentinel workspace ID, and then sign in. For detailed steps, see Connect the Defender for Cloud Apps app.

   Note

   Currently, the app is not published on Microsoft AppSource. Therefore, you may need to contact your Power BI admin for permissions to install the app.

   For example:

   

3. Optionally, build custom dashboards in Power BI Desktop and tweak it to fit the visual analytics and reporting requirements of your organization.

Connect the Defender for Cloud Apps app

Use the following steps to connect the Defender for Cloud Apps Shadow IT Discovery app in Power BI.

1. In Power BI, select Apps > Shadow IT Discovery app.

2. On the Get started with your new app page, select Connect. For example:

   

3. On the workspace ID page, enter your Microsoft Sentinel workspace ID as displayed in your log analytics overview page, and then select Next. For example:

   

4. On the authentication page, specify the authentication method and privacy level, and then select Sign in. For example:

   

5. After connecting your data, go to the workspace Datasets tab and select Refresh. This will update the report with your own data.

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.