> For the complete documentation index, see [llms.txt](https://cybrhawksoc.gitbook.io/cybrhawk-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybrhawksoc.gitbook.io/cybrhawk-docs/microsoft-365/microsoft-defender-for-endpoint.md).

# Microsoft Defender for Endpoint

This guide walks you through enabling Microsoft Defender API access in CybrHawk SIEM.

> **Requirements:**
>
> * Access to Microsoft 365 services (Microsoft 365 Compliance Center, Azure Active Directory)
> * **Premium P1/P2 Licensing** (CybrHawk will automatically extract available security events based on your license tier)

***

## Step 1: Grant API Permissions in Azure

### 1. Register an Application

* Create an Application ID and secret as described in the [Microsoft 365 Guide](/cybrhawk-docs/microsoft-365/microsoft-365.md).

![Create Application](/files/fxXkFfovW6DG3r7Ja9vm)

### 2. Assign Windows Defender ATP Permissions

* In your application page for CybrHawk, go to **API Permissions** > **Add permission** > **APIs my organization uses**.
* Search for **WindowsDefenderATP** and select it.

![Windows Defender ATP Permissions](/files/ITyBFsgkVCQVJqCZTufX)

* Select **Application Permissions** and add the following:

#### Standard Permissions

```
Alert.ReadWrite.All
Software.Read.All
Vulnerability.Read.All
SecurityRecommendation.Read.All
BrowserExtensionsInventoryByMachine
Machine.Read.All
runAntiVirusScan
```

#### Host Isolation Permissions (Optional, for host isolation via MS Defender endpoint agents)

To enable Host Isolation features, also add:

```
Machine.Isolate
```

* Click **Add Permissions**.

### 3. Grant Admin Consent

* Click **Grant admin consent for \[Your Organization]** to grant the permissions you just added.

![Grant Admin Consent](/files/jm3D2N8iDvFetBuTcb92)

***

## Step 2: Configure CybrHawk SIEM

1. Log in to your [CybrHawk SIEM Portal](https://portal.cybrhawk.com).
2. Navigate to **Deployments** > **Integrations**.
3. Click **Add** and select **Microsoft Defender API**.

***

## Need Help?

If you have any questions or need further assistance, please contact [**CybrHawk Support**](mailto:socv2@cybrhawk.com).

***