Summary

Customers leverage the Microsoft Defender Advanced Threat Protection (ATP) built-in Threat & Vulnerability Management (TVM) capability to discover, prioritize, and remediate endpoint vulnerabilities. Managed in the cloud and powered by integrated Windows endpoint discovery via the OS, Microsoft Defender for Endpoint TVM (MSDTVM) provides comprehensive insight into your environment, on-prem or in the cloud, within seconds. By bringing in data from Microsoft Defender for Endpoint TVM, you combine the ubiquity of reach from Microsoft Defender and the holistic view across numerous vulnerability management solutions from Cisco Vulnerability Management.

Connector Scope

In scope and included for this release

• API Endpoint of Vulnerabilities and Assets
• List vulnerabilities by machine (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-assessment-software-vulnerabilities)
• List machines (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-machines)
  • Collect asset specific details and data

Out of scope for this release

• List changed vulnerabilities by machine (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-assessment-software-vulnerabilities)
  • Incremental runs are out of scope for this release.
  • For incremental runs, Cisco Vulnerability Management looks back to the start date time of the last successful connector run.
• Fix/Fixes (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-all-recommendations) data from Microsoft Defender is not in this release.
  • Cisco Vulnerability Management supplemental fix data is available for each vulnerability sourced from Microsoft Defender for Endpoint TVM.

User Prerequisites/Microsoft Defender TVM setup

Please refer to this help article on the Microsoft Defender ATP Required Setup.

Configuring Your Microsoft Defender TVM Connector in Cisco Vulnerability Management

Important: Only Cisco Vulnerability Management Administrators have the permissions to add a connector.

1) Click the “Connectors” link at the top of the Cisco Vulnerability Management homepage.

2) Click the green “Add Connector” button in the top right corner of the page.

3) Scroll down to the “Vulnerability Management” section and look for the MS Defender Connector. Click it.

4) Submit the following when setting up the Microsoft Defender TVM connector.

5) Click the green “Save and Verify” button. The connector is now visible in the list of configured Connectors.

Locations in Azure to find MSDTVM connector configuration fields

Vulnerability Date Information

Within Cisco Vulnerability Management, you will notice several dates in the Vulnerabilities tab. When importing your Microsoft Defender data, the following criteria are used to populate these date fields.

• "Found" within Cisco Vulnerability Management is when Microsoft first detected the vulnerability and maps to the ‘firstSeenTimestamp’ field in Microsoft Defender TVM.
• "Last Seen" within Cisco Vulnerability Management is the last date Microsoft detected the vulnerability and maps to the ‘lastSeenTimestamp’ field in Microsoft Defender TVM.
• "Created" within Cisco Vulnerability Management is the date the vulnerability was passed to Cisco Vulnerability Management via the Microsoft Defender TVM integration. This date is not the result of a mapping from a field from Microsoft.

Asset Information

Similar to Vulnerability Date data, notice the asset data in the Asset tab. The following are clarifications to asset data that may differ from Microsoft Defender TVM.

• For each asset seen in Connector runs, its activity is set to “active”. Cisco Vulnerability Management assumes that assets arriving via Connector runs are active. Assets from MS Defender TVM may be systematically inactivated if it is not seen for the duration specified in the “Asset Inactivity Period”.

Microsoft Defender TVM Connector Data Mapping