Overview

Cloud App Security monitoring is a key feature of Microsoft Defender for Cloud Apps. It enables organizations to monitor their cloud-based applications and services for potential security risks, such as unauthorized access, data leakage, and malware. With Cloud App Security monitoring, organizations can gain visibility into all of their cloud-based assets, including applications, services, and data. This enables them to identify and remediate potential security risks before they can cause any harm.

Steps to Configure the CCE on the O365 portal:

1. Go to: https://www.office.com/?auth=2

2. Login with your credentials: 

username-  For example Someone@seceon.onmicrosoft.com

3. Go into security and compliance :  

4.- Expand Alert menu -> manage advanced alerts-> click on go to office 365 Cloud App Security

5.Go to setting option right up corner -> click on security extension

6. select SIEM Agents -> add SIEM Agents->start wizards -> add SIEM agent name "Seceon SIEM Agent" 

•  select SIEM Format "Generic CEF"

7. Enter the remote syslog host "127.0.0.1 is used for internal forwarding"

• Enter the remote syslog port "514"

8. Select the remote syslog protocol "UDP"

9.Select the data type you want to export to your SIEM agent:

   "All activities"

10. Copy token - For example: "XEpMSkBBAVpcHQFfQF1bTkMBTENAWktOX19cSkxaXUZbVgFMQEJTGEwXTk4dTRYcHx1NSx5LHB1JGx8fGR5KHxkZG04YGh0WSk4YHBhLHRoaTktMShgfHB8eHhcfF0kfGB5LSUossjsjj==" (for example)

Note : Invalid token will cause container to restart , in this case  installation will  fail.

Steps to Configure the O365 from the Seceon GUI:

1. Log in to the Seceon GUI(tenant side, if into an MSSP) with the administrator role. Go to "Provisioning" tab.

2. Go to the "Cloud Device Configuration".

3. Click on Add button, and choose "Office 365" in "Cloud Log Devices".

4. Fill in the form with CCE IP and token ID

URLs needs to be allowed:

1. graph.microsoft.com
2. manage.office.com
3. login.microsoftonline.com
4. login.windows.net

VERIFICATION OF CONFIGURATION

Verification can be done either from CCE Server or from UI.

Using UI

STEP 1: Log in to UI >> SYSTEM

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS.

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.

Notes:

Microsoft has 2 main products: Microsoft Cloud App Security & Office365 Cloud App Security The Seceon instructions prior provided is for Microsoft Cloud App Security: https://docs.microsoft.com/en-us/cloud-app-security/siem On that same link, there is a Compare area for MCAS and 0365CAS: https://docs.microsoft.com/en-us/cloud-app-security/editions-cloud-app-security-o365 MCAS includes: Alerts and activity logs for cross-SaaS apps O365CAS includes: For Office 365 alerts only, those who purchased an E5 license for our Office365 environment, thus can only see Office365 Alerts only