Investigate apps discovered by Microsoft Defender for Endpoint

The Microsoft Defender for Cloud Apps integration with Microsoft Defender for Endpoint provides a seamless Shadow IT visibility and control solution. Our integration enables Defender for Cloud Apps administrators to investigate discovered devices, network events, and app usage.

Investigate discovered devices in Defender for Cloud Apps

After you integrate Defender for Endpoint with Defender for Cloud Apps, you can investigate discovered device data in the Cloud Discovery dashboard.

1. In Defender for Cloud Apps, select Cloud Discovery and then Cloud Discovery dashboard.
2. In the top navigation bar, under Continuous reports, select Win10 endpoint users. 
3. Across the top, you’ll see the number of discovered devices added after the integration.
4. Select the Devices tab.
5. You can drill down into each device that’s listed, and use the tabs to view the investigation data. Find correlations between the devices, the users, IP addresses, and apps that were involved in incidents:
   • Overview
     • Device risk level: Shows how risky the device’s profile is relative to other devices in your organization, as indicated by the severity (high, medium, low, informational). Defender for Cloud Apps uses device profiles from Defender for Endpoint for each device based on advanced analytics. Activity that is anomalous to a device’s baseline is evaluated and determines the device’s risk level. Use the device risk level to determine which devices to investigate first.
     • Transactions: Information about the number of transactions that took place on the device over the selected period of time.
     • Total traffic: Information about the total amount of traffic (in MB) over the selected period of time.
     • Uploads: Information about the total amount of traffic (in MB) uploaded by the device over the selected period of time.
     • Downloads: Information about the total amount of traffic (in MB) downloaded by the device over the selected period of time.
   • Discovered apps
     Lists all the discovered apps that were accessed by the device.
   • User history
     Lists all the users who signed in to the device.
   • IP address history
     Lists all the IP addresses that were assigned to the device. 

As with any other Cloud Discovery source, you can export the data from the Win10 endpoint users report for further investigation.

Investigate device network events in Microsoft 365 Defender

Use the following steps to gain more granular visibility on device’s network activity in Microsoft Defender for Endpoint:

1. In Defender for Cloud Apps, under Discovery and then select Devices.
2. Select the machine you want to investigate and then in the top-right select View in Microsoft Defender for Endpoint.
3. In Microsoft 365 Defender, under Devices > {selected device}, select Timeline.
4. Under Filters, select Network events.
5. Investigate the device’s network events as required.

Investigate app usage in Microsoft 365 Defender with advanced hunting

Use the following steps to gain more granular visibility on app-related network events in Defender for Endpoint:

1. In Defender for Cloud Apps, under Discovery select Discovered apps.
2. Select the app you want to investigate to open its drawer.
3. Select the app’s Domain list and then copy the list of domains.
4. In Microsoft 365 Defender, under Devices, select Advanced hunting.
5. Paste the following query and replace <DOMAIN_LIST> with the list of domains you copied earlier.
   KustoCopy

   DeviceNetworkEvents
   | where RemoteUrl in ("<DOMAIN_LIST>")
   | order by Timestamp desc
   

6. Run the query and investigate network events for this app.

Investigate unsanctioned apps in Microsoft 365 Defender

Every attempt to access an unsanctioned app triggers an alert in Microsoft 365 Defender with in-depth details about the entire session. This enables you to perform deeper investigations into attempts to access unsanctioned apps, as well as providing additional relevant information for use in endpoint device investigation.

Sometimes, access to an unsanctioned app isn’t blocked, either because the endpoint device isn’t configured correctly or if the enforcement policy hasn’t yet propagated to the endpoint. In this instance, Defender for Endpoint administrators will receive an alert in Microsoft 365 Defender that the unsanctioned app wasn’t blocked.