Microsoft Defender for Cloud Apps

Details
Content
Dependencies
Version History

Microsoft Cloud App Security Integration, a Cloud Access Security Broker that supports various deployment modes

License Information

Available for E3 (EMS), E5, and standalone licenses.

Note: Time parsing is supported only when the field "timestamp" is in epoch milliseconds format (for example 1674208800123).

License Information

Available for E3 (EMS), E5, and standalone licenses.

Note: Time parsing is supported only when the field "timestamp" is in epoch milliseconds format (for example 1674208800123).

Classifiers

Name	Description
Microsoft CAS Classifier	Classifies Microsoft CAS Alerts
Microsoft CAS	Maps incoming Microsoft CAS fields

Incident Types

Name	Description
Microsoft CAS Alert

Integrations

Name	Description
Microsoft Defender for Cloud Apps	Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.

Layouts

Name	Description
MicrosoftCloudAppSecurity

Classifiers

Name	Description
Microsoft CAS Classifier	Classifies Microsoft CAS Alerts
Microsoft CAS	Maps incoming Microsoft CAS fields

Incident Types

Name	Description
Microsoft CAS Alert

Integrations

Name	Description
Microsoft Defender for Cloud Apps Event Collector	Collects the events log for alerts and activities provided Microsoft Defender for Cloud Apps API.
Microsoft Defender for Cloud Apps	Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.

Modeling Rules

Name	Description
Microsoft Defender Cloud Apps Modeling Rule

Parsing Rules

Name	Description
Microsoft Cloud App Security Parsing Rule

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

2.2.9 - R1741355 (December 3, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.114611.

Related pull requests:
- 37375
- 37353

Download

2.2.8 - 1669335 (November 19, 2024)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue in MicrosoftApiModule where the GCC High Defender endpoint was incorrect.

Related pull requests:
- 37253

Download

2.2.7 - 1615839 (November 10, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 37120
- 37113

Download

2.2.6 - 1480610 (October 8, 2024)

Integrations

Microsoft Defender for Cloud Apps

Added infrastructure support for Microsoft Graph Application endpoints.

Related pull requests:
- 36407

Download

2.2.5 - 1316088 (August 27, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35955

Download

2.2.4 - 1244506 (August 5, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the MicrosoftApiModule with exchange_online endpoints.

Related pull requests:
- 34917
- 34909
- 34903
- 34906
- 34147
- 34217
- 34908
- 34619
- 34911
- 34823
- 34837
- 34918
- 34816
- 34630
- 34871
- 34767
- 34879
- 34912
- 34840
- 34931
- 34892
- 34920
- 34926
- 34814
- 34811
- 34964
- 34967
- 34979
- 34921
- 34990
- 34896
- 34966
- 34985
- 34983
- 34255
- 34975
- 34999
- 34913
- 35000
- 34990
- 35002
- 34932
- 34862
- 35005
- 34868
- 34977
- 35009
- 34969
- 34591
- 34693
- 34657
- 34671
- 34681
- 34676
- 34672
- 34372
- 34701
- 34660
- 34684
- 34700
- 34702
- 34696
- 34117
- 34704
- 34706
- 34692
- 33735
- 34714
- 34703
- 34353
- 34725
- 34694
- 34734
- 34640
- 34724
- 34652
- 34443
- 34730
- 34653
- 34732
- 34667
- 34709
- 34755
- 34759
- 32423
- 34598
- 34758
- 34745
- 34762
- 34327
- 34742
- 34474
- 34766
- 34774
- 34782
- 34763
- 34756
- 34747
- 34645
- 34532
- 34675
- 34777
- 34788
- 34804
- 34729
- 34796
- 34691
- 34784
- 34783
- 34765
- 34485
- 34768
- 34593
- 34813
- 34818
- 34832
- 34772
- 34830
- 34833
- 34829
- 34834
- 34839
- 34828
- 34388
- 34838
- 34761
- 34858
- 34861
- 34764
- 34738
- 34538
- 34831
- 34748
- 34846
- 34845
- 34864
- 34817
- 34686
- 34865
- 34867
- 34863
- 34880
- 34876
- 34386
- 34881
- 34884
- 34799
- 34827
- 34883
- 34886
- 34512
- 34887
- 34889
- 34877
- 34904
- 34905
- 34909
- 34903
- 34906
- 34147
- 34217
- 34908
- 34619
- 34911
- 34823
- 34837
- 34918
- 34816
- 34630
- 34871
- 34767
- 34879
- 34912
- 34840
- 34931
- 34892
- 34920
- 34926
- 34814
- 34811
- 34964
- 34967
- 34979
- 34921
- 34990
- 34896
- 34966
- 34985
- 34983
- 34255
- 34608
- 35026
- 35029
- 35015
- 35023
- 34776
- 34654
- 34978
- 34986
- 34938
- 34506
- 35011
- 35014
- 34779
- 35019
- 35039
- 34897
- 35049
- 35016
- 35046
- 35051
- 35040
- 34614
- 32477

Download

2.2.3 - 1234417 (August 1, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35725

Download

2.2.2 - 1180297 (July 16, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35425

Download

2.2.1 - 1162940 (July 9, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35083

Download

2.2.0 - 1094962 (June 16, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 34764

Download

2.1.62 - 1066075 (June 3, 2024)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue in where the GCC endpoints were incorrect in the supported integrations.

Related pull requests:
- 34634

Download

2.1.61 - 1051712 (May 28, 2024)

Integrations

Microsoft Defender for Cloud Apps

Added support for Microsoft Defender 365 Endpoint in the Microsoft API Module.
Updated the MicrosoftApiModule to better handle the Authorization Code flow in the supported integrations.

Related pull requests:
- 34495

Download

2.1.60 - R1047063 (May 27, 2024)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue in MicrosoftApiModule where the GCC endpoints were incorrect.

Related pull requests:
- 34360

Download

2.1.59 - 919924 (March 28, 2024)

Integrations

Microsoft Defender for Cloud Apps

Added a timeout value to the retry on rate limit mechanism.

Related pull requests:
- 33566

Download

2.1.58 - 919001 (March 27, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.91402.

Related pull requests:
- 33588

Download

2.1.57 - 860237 (February 29, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the MicrosoftApiModule to better handle the Authorization Code flow in the supported integrations.

Related pull requests:
- 31942

Download

2.1.56 - R828628 (February 14, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.87358.

Related pull requests:
- 32843

Download

2.1.55 - 798475 (February 1, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.86361.

Related pull requests:
- 32524

Download

2.1.54 - 762016 (January 14, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 32170

Download

2.1.53 - 760302 (January 14, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.84658.

Related pull requests:
- 32156

Download

2.1.52 - 7209615 (December 19, 2023)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.83343.

Related pull requests:
- 31556

Download

2.1.51 - 7066068 (December 4, 2023)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.82278.

Related pull requests:
- 31292

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 9, 2020
Last Release	December 3, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.