https://fletch.ai/images/general/defender_vuln_edr_notice.PNG

https://fletch.ai/images/general/defender_caveat_malware.PNG

Overview

We will walk you through setting the appropriate read only permissions needed to bring Microsoft Defender data into this Fletch solution. You’ll need to register Fletch as an app and create the appropriate read only permissions. The following steps will guide you to create the Tenant ID, Application (client) ID and Secret, which you will need to provide in Fletch.

  1. Create an App Registration through the Azure portal.

  2. Set up the required API permissions.

  3. Create a secret for the App you registered.

Create an app registration

Step 1. Log in to the Azure portal. In the top search bar, search for App registrations, and click on the App registrations listed on the results in services.

https://fletch.ai/images/general/msft1.png

Step 2. Click on + New registration.

https://fletch.ai/images/general/msft2.png

Step 3. Provide the Name (name of the app registration) and Supported Account Types (select the first option, Accounts in this registration only).

https://fletch.ai/images/general/msft3.png

Step 4. Click Register.

Please save the Application (client) ID and the Directory (tenant) ID. You will need to provide these to the Fletch site later.

https://fletch.ai/images/general/msft4.png

Set up the required API permissions

Step 5. Click API permissions.

https://fletch.ai/images/general/msft5.png