New Defender Plugin

plugins/MicrosoftDefender/v1/configValidation.json

@@ -0,0 +1,13 @@
+{
+    "steps": [
+        {
+            "displayName": "API Access Test",
+            "dataStream": { 
+                "name": "validation"
+            },
+            "success": "Successfully connected to Endpoint",
+            "error": "Cannot access the Endpoint API - check your client ID & secret. Do you have the correct permissions set?",
+            "required": true
+        }
+    ]
+}

plugins/MicrosoftDefender/v1/custom_types.json

@@ -0,0 +1,9 @@
+[
+    {
+        "name": "device",
+        "sourceType": "device",
+        "icon": "server",
+        "singular": "Device",
+        "plural": "Devices"
+    }
+]

plugins/MicrosoftDefender/v1/dataStreams/Vulnerabilities.json

@@ -0,0 +1,44 @@
+{
+    "name": "Vulnerabilities",
+    "displayName": "Vulnerabilities",
+    "baseDataSourceName": "httpRequestScoped",
+    "config": {
+        "httpMethod": "post",
+        "errorHandling": {
+            "type": "default"
+        },
+        "paging": {
+            "mode": "none"
+        },
+        "expandInnerObjects": true,
+        "endpointPath": "runHuntingQuery",
+        "postBody": {
+            "Query": "DeviceTvmSoftwareVulnerabilities | where DeviceId in ({{objects.map(o => {return `\"${o.deviceid}\"`}).join(\",\")}})",
+            "Timespan": "{{timeframe.enum != \"none\" ? `${timeframe.start}/${timeframe.end}` : \"\" }}"
+        },
+        "pathToData": "results",
+        "getArgs": [],
+        "headers": []
+    },
+    "metadata": [
+        {
+            "sourceId": "DeviceId",
+            "name": "DeviceName",
+            "shape": "string",
+            "role": "label",
+            "sourceType": "device"
+        },
+        {
+            "pattern": ".*"
+        }
+    ],
+    "matches": {
+        "sourceType": {
+            "type": "equals",
+            "value": "device"
+        }
+    },
+    "timeframes": false,
+    "providesPluginDiagnostics": true,
+    "tags": []
+}

plugins/MicrosoftDefender/v1/dataStreams/advancedHuntingQuery.json

@@ -0,0 +1,51 @@
+{
+    "name": "advancedHuntingQuery",
+    "displayName": "Advanced Hunting Query",
+    "baseDataSourceName": "httpRequestUnscoped",
+    "config": {
+        "httpMethod": "post",
+        "errorHandling": {
+            "type": "default"
+        },
+        "paging": {
+            "mode": "none"
+        },
+        "expandInnerObjects": true,
+        "endpointPath": "runHuntingQuery",
+        "postBody": {
+            "Query": "{{query}}",
+            "Timespan": "{{timeframe.enum != \"none\" ? `${timeframe.start}/${timeframe.end}` : \"\" }}"
+        },
+        "pathToData": "results",
+        "getArgs": [],
+        "headers": []
+    },
+    "timeframes": [
+        "last1hour",
+        "last12hours",
+        "last24hours",
+        "last7days",
+        "last30days",
+        "thisMonth",
+        "thisQuarter",
+        "thisYear",
+        "lastMonth",
+        "lastQuarter",
+        "lastYear"
+    ],
+    "supportsNoneTimeframe": true,
+    "providesPluginDiagnostics": true,
+    "manualConfigApply": true,
+    "tags": [],
+    "ui": [
+        {
+            "name": "query",
+            "language": "kusto",
+            "label": "Query",
+            "type": "code",
+            "validation": {
+                "required": true
+            }
+        }
+    ]
+}

plugins/MicrosoftDefender/v1/dataStreams/alerts.json

@@ -0,0 +1,144 @@
+{
+    "name": "alerts",
+    "displayName": "Alerts",
+    "baseDataSourceName": "httpRequestUnscoped",
+    "config": {
+        "httpMethod": "get",
+        "errorHandling": {
+            "type": "default"
+        },
+        "paging": {
+            "mode": "nextUrl",
+            "pageSize": {
+                "realm": {
+                    "value": "none",
+                    "label": "none"
+                }
+            },
+            "in": {
+                "realm": {
+                    "value": "payload",
+                    "label": "payload"
+                },
+                "path": "@odata.nextLink"
+            }
+        },
+        "expandInnerObjects": true,
+        "endpointPath": "alerts",
+        "pathToData": "value",
+        "getArgs": [
+            {
+                "key": "$filter",
+                "value": "{{ status && status.length > 0 ? \"(status eq \" + status.map((m) => { return `'${m}'` }).join(\" or status eq \") + \") and \" : \"\" }}{{ severity && severity.length > 0 ? \"(severity eq \" + severity.map((m) => { return `'${m}'` }).join(\" or severity eq \") + \") and \" : \"\" }}{{timeframe.enum !== \"none\" ? timeframeCol + \" ge \" + timeframe.start + \" and \" + timeframeCol + \" le \" + timeframe.end : \"1 eq 1\"}}"
+            }
+        ],
+        "headers": []
+    },
+    "timeframes": [
+        "last1hour",
+        "last12hours",
+        "last24hours",
+        "last7days",
+        "last30days",
+        "thisMonth",
+        "thisQuarter",
+        "thisYear",
+        "lastMonth",
+        "lastQuarter",
+        "lastYear"
+    ],
+    "supportsNoneTimeframe": true,
+    "manualConfigApply": true,
+    "providesPluginDiagnostics": true,
+    "tags": [],
+    "ui": [
+        {
+            "name": "severity",
+            "label": "Severity",
+            "type": "autocomplete",
+            "data": {
+                "source": "fixed",
+                "values": [
+                    {
+                        "value": "low",
+                        "label": "Low"
+                    },
+                    {
+                        "value": "medium",
+                        "label": "Medium"
+                    },
+                    {
+                        "value": "high",
+                        "label": "High"
+                    },
+                    {
+                        "value": "informational",
+                        "label": "Informational"
+                    },
+                    {
+                        "value": "unknown",
+                        "label": "Unknown"
+                    },
+                    {
+                        "value": "unknownFutureValue",
+                        "label": "Unknown Future Value"
+                    }
+                ]
+            },
+            "isClearable": true
+        },
+        {
+            "name": "status",
+            "label": "Status",
+            "type": "autocomplete",
+            "data": {
+                "source": "fixed",
+                "values": [
+                    {
+                        "value": "new",
+                        "label": "New"
+                    },
+                    {
+                        "value": "inProgress",
+                        "label": "In Progress"
+                    },
+                    {
+                        "value": "resolved",
+                        "label": "Resolved"
+                    },
+                    {
+                        "value": "unknown",
+                        "label": "Unknown"
+                    },
+                    {
+                        "value": "unknownFutureValue",
+                        "label": "Unknown Future Value"
+                    }
+                ]
+            },
+            "isClearable": true
+        },
+        {
+            "isMulti": false,
+            "help": "Select the column to apply the timeframe",
+            "data": {
+                "source": "fixed",
+                "values": [
+                    {
+                        "value": "createdDateTime",
+                        "label": "Creation Time"
+                    },
+                    {
+                        "value": "lastUpdateDateTime",
+                        "label": "Last Update Time"
+                    }
+                ]
+            },
+            "defaultValue": "createdDateTime",
+            "name": "timeframeCol",
+            "label": "Timeframe Column",
+            "type": "autocomplete",
+            "isClearable": false
+        }
+    ]
+}

plugins/MicrosoftDefender/v1/dataStreams/devices.json

@@ -0,0 +1,64 @@
+{
+    "name": "devices",
+    "displayName": "Devices",
+    "baseDataSourceName": "httpRequestScoped",
+    "config": {
+        "httpMethod": "post",
+        "errorHandling": {
+            "type": "default"
+        },
+        "paging": {
+            "mode": "none"
+        },
+        "expandInnerObjects": true,
+        "endpointPath": "runHuntingQuery",
+        "postBody": {
+            "Query": "DeviceInfo | where DeviceId in ({{objects.map(o => {return `\"${o.deviceid}\"`}).join(\",\")}}) | summarize arg_max(Timestamp, *) by DeviceId"
+        },
+        "pathToData": "results",
+        "getArgs": [],
+        "headers": []
+    },
+    "metadata": [
+        {
+            "sourceId": "DeviceId",
+            "name": "DeviceName",
+            "shape": "string",
+            "role": "label",
+            "sourceType": "device"
+        },
+        {
+            "shape": [
+                "state",
+                {
+                    "map": {
+                        "unmonitored": [],
+                        "unknown": [],
+                        "error": [
+                            "High"
+                        ],
+                        "warning": [
+                            "Medium"
+                        ],
+                        "success": [
+                            "Low"
+                        ]
+                    }
+                }
+            ],
+            "name": "ExposureLevel"
+        },
+        {
+            "pattern": ".*"
+        }
+    ],
+    "matches": {
+        "sourceType": {
+            "type": "equals",
+            "value": "device"
+        }
+    },
+    "timeframes": false,
+    "providesPluginDiagnostics": true,
+    "tags": []
+}