Microsoft Azure is now called Entra ID

Requirements

• Lumu Defender API key.
• Windows Defender Cloud (Endpoint Plan 1 or 2)
• Entra ID Application
  
• The Entra ID application must have API Permissions Ti.readWrite.All, Ti.ReadWrite, and Ti.Read.All.
• Scripting Host
• Requires a host with Python v3.6+ and network visibility to Entra ID API and Defender API endpoints.
• Script package.
• Contact the Lumu Support team to request the package we created to deploy the required files.
  

Set up Entra ID

Add a new application

To integrate with Windows Defender, you must add a new application using the Microsoft Entra ID Active Directory portal.

1. In the Microsoft Entra ID Active Directory portal, go to the App Registrations menu under the Manage section in the left navigation bar. Click on the New registration button 
   
   
   
2. Fill in the requested data in the Register an application form. Give the app a name you can associate later with the integration (i.e., Lumu). In the Supported account types field, select Accounts in this organizational directory only. The Redirect URL is not required. Click the Register button.

Assign a secret to your Lumu application

You must associate a secret key to the application added before.

1. After adding the new application, you will see the details of your new application. Next to the Client credentials label, click the Add a certificate or secret link. Take note of the values for the fields Application (client) ID and Directory (tenant) ID. These will be required to deploy the integration script. 
   
2. Click the New client secret button in the Certificates & Secrets form. Fill in the requested data. It’s recommended to set the Expire field to 12 months.
   

It’s important to renew this key after this token has expired otherwise, the integration will stop working.

3. Copy the Value of the key from the Certificates & Secret page. Keep this value at hand, it will be required by the integration script.
   

Add required API permissions to the Lumu application

The new application created for Lumu integration requires the permissions Ti.Read.All , Ti.ReadWrite , and Ti.ReadWrite.All .

1. In the App Registrations menu, under the Manage section, select the application created in the steps above.

2. On the application page, click the API permissions menu under the Manage section. Click the Add a permission button.
3. In the Request API permissions screen, select the tab APIs my organization uses. Write windowsdefenderatp  in the search field. From the results, click on the WindowsDefenderATP option.
   

4. In the WindowsDefenderATP permissions window, click the Application permissions box.
   

5. In the detailed permissions screen, use the search box to type Ti. From the results, toggle the checkboxes near the Ti.Read.All, Ti.ReadWrite, and Ti.ReadWrite.All options. Then, click the Add permissions button.
   

6. Grant admin content to the added permissions by clicking the Grant admin consent button. Give your confirmation when prompted.
   

Deploy the script

First, contact the Lumu Support team to request the package we created to deploy the required files.

Script location

Unpack the deployed package provided by Lumu in your preferred path/folder. Keep in mind this location, as it will be required for further configurations. From now on, we will refer to this folder as <windows_defender_lumu_root>.

Install requirements

The file requirements.txt contains the list of dependencies for this data collector. After deploying the package locally, run the following command from the deployment folder:

Script details

For using the script, you must locate yourself on the path selected for deployment (<windows_defender_response>). Use the following command to show all options available for the package:

Usage: wdefender_response .py [options]

Usage examples

By default

Use the following command to fetch and push all adversaries detected by Lumu in the last 7 days to windows defender.

NOTE: Each time the script is run, it will overwrite the locks and execute locks by web access.

Clear Function

Use the following command to clear all indicators uploaded into windows defender.

Expected results:

After running the script, all adversaries will be pushed into Microsoft 365 Defender. You can check the uploaded IOCs using your Microsoft Defender Portal. Go to Settings > Endpoints. In the Endpoints screen, click the Indicators menu under the Rules section. There, you will see the IOCs populated by Lumu under its own category: File hashes and URLs/Domains.

Troubleshooting

To identify failures on the script, please use the -v flag. This will allow you to identify failures in the script execution.