Microsoft Defender Connector Guide

Microsoft Defender (formerly Microsoft Defender ATP) enables enterprises to prevent, detect, investigate, and respond to advanced threats. The Balbix integration with Microsoft Defender ingests assets and associated vulnerabilities discovered by Microsoft Defender.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

Integration summary

This table provides a summary of the Balbix integration for the Microsoft Defender connector.

Prerequisites

To configure the Balbix connector, you must first create Microsoft Defender API credentials with the appropriate permissions. These credentials are required for completing the configuration process. `

1. Register an app: Set up an application in Microsoft Azure for connector integration.

2. Add API permissions: Specify the APIs the app can access.

3. Add auth permissions and assign roles: Ensure the app has the appropriate roles for data access.

4. Create an API key: Generate an API key to authenticate the app with Balbix.

Register an app

To create an app registration:

1. Log in to the MS Azure portal and select Microsoft Entra ID from the left navigation panel.

2. On the Overview page, click + Add and select App Registration.

3. Enter the registration information for your application.

   • Name: Balbix

   • Supported account types: Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant)

   • (Optional) Redirect URI: Specify if desired

4. Click Register to create the registration application.

5. On the Overview page, copy the application ID and the directory ID and save them in a safe place to use later when configuring the Balbix connector.

Add API permissions

Add API permissions after you have registered the Balbix app:

1. Under Manage on the Balbix App Registration page, select API Permissions then click + Add a permission.

2. On the Request API permissions page, select the APIs my organization uses tab.

3. You must add permissions from two applications: WindowsDefenderATP and Microsoft Graph.

   • Select WindowsDefenderATP and add permissions:

     Type	Permission Name
     Application	Machine.Read.All
     	Vulnerability.Read.All
     	Software.Read.All
     	User.Read.All
     	AdvancedQuery.Read.All
     	SecurityRecommendation.Read.All
     Delegated	AdvancedQuery.Read

4. Click All APIs to return to the Request API Permissions page.

   • Select Microsoft Graph and add permissions:

     Type	Permission Name
     Application	Directory.Read.All

5. Click Grant admin consent for Default Directory to apply the permissions.

Add auth permissions and roles

To generate an API key, ensure that roles are assigned and the necessary permissions are added.

1. In the MS Azure portal, go to Subscriptions.

2. Choose the subscription where you want to create the custom role.

3. Go to the Access Control (IAM) tab and select Roles.

4. Click Add > Add Custom Role.

5. Enter a custom role name and description.

6. Click the Permissions tab, then click + Add Permissions to open the Add permissions panel.

7. In the Search for a permission field, search for the permissions listed below:

   • Microsoft.AppConfiguration/configurationStores/ListKeyValue/action

   • Microsoft.Web/sites/config/list/Action

   • Microsoft.Storage/storageAccounts/queueServices/queues/read

   • Microsoft.Network/networkWatchers/queryFlowLogStatus/action

   • Microsoft.ContainerService/managedClusters/listClusterUserCredential/action

   • Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action

8. Click the permission card that displays after your search, then click the checkboxes for the individual permissions as they are listed.

9. Click Review + create.

10. In the Access control (IAM) page, click the Role assignments tab to view the role assignments.

11. Click Add > Add role assignment.

12. In the Role tab, assign both your newly created custom IAM role and Reader role for the registered Balbix app service.

Create a Client Secret

To generate a client secret from Microsoft Defender:

1. Go to Microsoft Entra ID, click App registrations and select the Balbix application.

2. Select Certificates & secrets > Client secrets > New client secret.

3. Provide a description for your client secret and set an expiration date or specify a custom duration.

4. Click Add.

5. Copy the client secret and save to a safe place for use later when configuring Microsoft Defender in Balbix.

   Caution: Be sure to copy and save the client secret—it will no longer be visible after you leave the page.

Set up your MS Defender connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for MS Defender.

Controls Information

In addition to ingesting asset and vulnerability data from Microsoft Defender, the integration now supports retrieving secure configuration assessments on a per-device basis. The connector will pull controls information that includes the current assessment status—indicating whether each control has passed or failed—and the last observed timestamp when the assessment was updated. This enhancement provides a real-time view of each device’s secure configuration compliance, enabling a more comprehensive security posture assessment and helping organizations quickly identify and remediate configuration issues.

API reference documentation

To learn more about the Microsoft Defender API, see the references listed below:

• Microsoft 365 Defender XDR Incidents API

• Access the Microsoft Defender for Endpoint APIs