Microsoft Defender Incidents - need authentication / setup documentation

InsightConnect Plugins
1

Greetings. Our CSM alerted us to the new ICON plugin “Microsoft Defender Incidents” today and I wanted to check it out. Link here: Rapid7 Extensions

That said, the “Setup” documentation is a bit sparse at this time, specifically how you go about setting up the authentication/credentials needed is not documented. Based on what it says, you need:

  • Client_id
  • Client_secret
  • Tenant_id
    Based on that, I am guessing it needs to be set up as an AzureAD “Enterprise Application” with a certain set of permissions? But what permissions?

Anyway - asking in case anyone else has figured it out and can share what worked!

1 Like
2

@nick_defoe you need to create an app and then you can get the client id etc.
1
2
Create a secret for client secret:
3
Some permissions that we used while testing:
4

Hope this helps. Kindly let us know if you still have any questions.

Thanks
Bindu

3

One year on and set up documentation still super minimal. Fact the little set up info that there is isn’t on ‘Set up guides’ on What is InsightConnect? | InsightConnect Documentation (rapid7.com) makes me wonder if this is even still supported

1 Like
4

apparently it is stills supported

5

managed to get this running in a test tenant so progress :slight_smile: