This article guides you through the process of connecting Red Canary to your Microsoft Defender for Endpoint instance.

Prerequisites

Please review the following articles before connecting Red Canary to your Microsoft Defender for Endpoint instance:

• Minimum requirements for Microsoft Defender for Endpoint
• Compare Microsoft Defender for Endpoint plans

Set up a Red Canary onboarding account

Before beginning the onboarding process, you must provide Red Canary with the name and email address for an account with global administrator privileges within your Azure organization. You’ll use this account throughout the onboarding process.

If you already have a global administrator account, follow these steps:

1. Provide the name and email address of the account to your Red Canary contact.
2. Check your email for an invitation to accept access permissions. If your account doesn’t have an associated email inbox, notify your Red Canary contact, who will provide you with an invitation link.
   Note: When logging in to this site, you should be prompted to accept certain permissions. If you do not see this permissions page on your first login, try accessing this link via an incognito or private window.

If you don’t have a global administrator account, follow these steps:

1. Log in to your Azure tenant at https://portal.azure.com.
2. Create a new user by following the steps in Add or delete users using Azure Active Directory.
3. Assign “Global Administrator” or “Security Administrator” to the new user by following the steps in Assign administrator and non-administrator roles to users with Azure Active Directory.
4. Confirm that permissions are correct by logging into Azure, searching for the new user, and validating that the user belongs to the “Global Administrator” or “Security Administrator” role.
5. Provide the name and email address of the account to your Red Canary contact.
6. Check your email for an invitation to accept access permissions. If your account doesn’t have an associated email inbox, you can accept the invitation by logging in to https://portal.azure.com/microsoft-production.redcanary.co.

Set up data export (Streaming API)

After you configure your onboarding account, you can set up data export from your Defender for Endpoint instance to Red Canary’s Event Hub. This configuration instructs the Defender for Endpoint platform to begin sending your telemetry to Red Canary for processing.

1. Log in to Microsoft Defender Security Center using your global administrator account.
2. Navigate to Settings > Microsoft 365 Defender, and then select Streaming API.
3. Click + Add.
4. Please name the export “MXDRPartner-{ Your Company Name}”
5. Click Forward events to Event Hub.
6. Fill in the values of Event-Hub Resource ID and Event-Hub name using the credentials Red Canary has provided to you via email.
7. Select all Event Types.
8. Click Submit. It will take 30 minutes to four hours after the final step is completed before the data stream is established within Red Canary.

Note: If you get “Failed to created Streaming API Settings Request Body is invalid or missing” dialogue box try the steps below: 

• The Event Hub Resource ID and Event Hub name are really sensitive. fI you have a space in it, it will not allow you to submit it. You can try loading the resource ID and event-hub name into notepad to ensure that no spaces are copied, and attempt to resubmit. 
• Clear all the event fields, refresh the window, and try again. 
• Try to do this step from an incognito browser if the above steps do not resolve. 

For a walkthrough of these steps, review this video:

Grant Red Canary permissions to your Microsoft Defender for Endpoint API

After you configure your onboarding account, you can grant Red Canary permissions to your Defender for Endpoint API. This enables the Red Canary platform to retrieve alerts, process endpoint metadata, and orchestrate actions on endpoints.

To grant permissions to your Microsoft Defender for Endpoint API:

1. Log in to your global administrator Microsoft account.
2. Approve permissions for Red Canary API integration by clicking this link: https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=69561a74-a59d-43f4-a113-8bc2da00f822&response_type=code&sso_reload=true

Grant Red Canary analysts read-only access to your Microsoft Defender console

After you grant permissions to your Microsoft Defender for Endpoint API, you can give Red Canary read-only access to your Defender for Endpoint console using role-based access control; see Manage portal access using role-based access control in Microsoft Docs for more information. This enables your Red Canary teams, such as your threat hunting and detection engineering teams, to perform ad-hoc hunting and investigation of potential threats in your environment.

Note: This process requires an Azure AD Premium P2 license. If you have an Azure AD Premium P1 license, see P1 Azure License - Granting Red Canary analysts read-only access to Microsoft Defender in the Red Canary Help Center.

For a guided walkthrough of these steps, review this video.

Step 1: Prepare your Microsoft Azure group for Role-Based Access Control, and link the Red Canary active directory tenant

1. Navigate to https://portal.azure.com, and log in with your global administrator account.
2. Expand the navigation pane, and then select Azure Active Directory | Groups | New Group.
3. Fill in the group parameters with the following values:
   • Group Type: Security
   • Group Name: Red Canary
   • Group Description: Red Canary Access Group
   • Azure AD roles can be assigned to the group (Preview): Yes
   • Roles: Security Reader
   • Membership Type: Assigned
   • Owners: No owners selected
   • Members: No members selected
4. Click Create, and then click Identity Governance. (You may need to enter this in the search bar) 
5. Under Entitlement Management, select Connected organizations, and then Add connected organization.
6. Fill out the form with the following values:
   • • Basics
       • • Name: Red Canary
         • Description: Red Canary Access Group
         • State: Configured
     • Directory + domain
       1. 1. Click Add directory + domain.
          2. Type redcanary.com into the tenant ID search bar.
          3. Highlight the entry, and click Select.
     • Sponsors
       1. 1. Under Add Internal Sponsor, click Add/Remove.
          2. Search for the name of your active directory administrator, highlight the account, and click Select.
7. Review the parameters, and then click Create.

Step 2: Enable Role-Based Access Controls (RBAC) in Microsoft Defender for Endpoint

Create a RBAC role within Defender for your endpoint, and then assign the Red Canary Azure AD security group to the role.

1. Navigate to https://security.microsoft.com, and log in with your global administrator account. 
2. Select Settings | Endpoints | Roles | Add item.
3. Fill out the form with the following values:
   • Role Name: Red Canary
   • Description: Red Canary Access Role
   • Check the following boxes:
     • • View Data
         • • Security Operations
           • Threat and Vulnerability Management
4. Click Assigned user groups, Red Canary, and then Add Selected Groups.
5. Click Save.

Step 3: Configure your Microsoft Azure Identity Governance Access Packages

1. Navigate to https://portal.azure.com and log in with your global administrator account. 
2. Expand the navigation pane, and then select Azure Active Directory | Identity Governance. 
3. Under Entitlement Management, select Catalogs, and then New Catalog.
4. Fill out the form with the following values:
   • • Name: Red Canary Access
     • Description: Red Canary MTP Service Access Catalog
     • Enabled: Yes
     • Enabled for external users: Yes
5. Under Entitlement Management, select Access Package, and then New Access Package.
6. Fill out the forms with the following values:
   • Basics
     • • Name: Red Canary Access Package
       • Description: Red Canary Access
       • Catalog: Red Canary Access
   • Resource Roles
     • • Select Groups and Teams | Red Canary | Member | Select.
         • Important: In order to select the Red Canary Group, make sure to select See all Group and Team(s) not in the Red Canary Access catalog. You must have the correct permissions to add them in this access package.
   • Requests
     • • Select For users not in your directory, Specific connected organizations, and then Red Canary.
       • Require Approval: No
       • Enable new requests and assignments: Yes
   • Lifecycle
     • • Access package assignments expire: Never 
       • Require access reviews: Yes
       • Starting on: [today's date]
       • Review frequency: Bi-annually
       • Duration in days: 90
       • Reviewers: Specific reviewers
         1. 1. Click Add reviewers. 
            2. Select the members of your organization responsible for IAM review procedures.
7. Review the parameters, and then click Create.
8. Select the newly created access package under Azure Portal | Active Directory | Identity Governance | Access Packages | Red Canary.  
9. Under Properties, copy the “My access portal link.”
10. Provide the link to your Red Canary contact.

What if my organization uses device groups?

If your organization uses device groups, add permissions by completing the following steps:

1. Navigate to https://security.microsoft.com and log in with your global administrator account.
2. Select Settings | Endpoints | Device Groups.
3. Navigate to ​Assigned User Groups.
4. Select the Red Canary group previously created in Azure AD. Add that group to Azure AD user groups with this role, and click​ Save.
5. Go to Settings | Permissions | Machine Groups.
6. Click on a machine group name.
7. From User Access, select the checkbox to grant access to the ​Red Canary ​group.
8. Repeat steps 6 and 7 for all machine groups.

Provisioning Process

1. Log into the provisioning portal (<customer_identifier>provisioning.my.redcanary.co).
2. ClickCreate new request.
3. Under the Request type drop-down selectProvision new environment.
4. Fill in the following fields that were collected during the scoping call with the user.
   
   

   Field	What you'll fill out
   or select…	Four hours from now.
   Engagement type	Short-term (incident response).
   Number of endpoints	The number of endpoints we expect to monitor in the environment. This number can be an estimate.
   Customer contact email	The email address for a user contact who will be responsible for following setup instructions. The configuration instructions, if any, will be sent to this email address for the user to follow.
   Organization name	The legal business name of the organization.
   Desired subdomain name	The subdomain identifier that needs to be provisioned. Subdomain names are two or more lowercase alphanumeric characters.
   Desired telemetry collection platform	Microsoft Defender for Endpoint
   Group ID	The Tenant UUID of your Microsoft Defender for Endpoint environment, such as 53196a92-f350-4248-975c-3c911c178e1d
   Admin User Email	The email address that will be assigned permissions within Red Canary's Event Hub as a Data Exporter. This account is required to establish the data connection between the Microsoft Defender tenant and Red Canary, and must be a Global Admin or Security Admin.

   
   
5. Click Save.
6. The User Contact email address and the Requestor from the provisioning request will receive an identical email with Data Export configuration instructions specific for that user. If the user doesn’t receive the instructions, we will forward the instructions to the partner to send to the user.
7. The user will receive a separate Azure invite from Red Canary. They should accept this invitation. The invitation will have been sent to the account you entered in the Customer Data export account field in the provisioning request. This invitation allows us to collect their Defender for Endpoint Alerts from their account. If they never got this email, reach out to your Technical Account Manager.
8. Once we detect data in the user's newly provisioned infrastructure, engineering will update the provisioning request page. Please check there for status updates. If you have questions or concerns, please contact your TAM.
9. The user must configure the MSSP access package so that the Red Canary team can access the user's environment. Red Canary will send the partner instructions for that procedure. 

Integrate Graph v2 Security Alerts

As a last step to integrating this EDR source, please follow the directions in Integrate Microsoft Graph v2 with red Canary.