topic Re: microsoft defender add on using certificates in Deployment Architecture

Can microsoft defender add on use certificates?

siuolkl — Wed, 16 Mar 2022 14:28:05 GMT

Hi Experts,

would like to check if anyone tried using certificates for the Microsoft defender add-on.

how / where do I generate the certificates to upload to azure app registration.

currently from splunkbase im using this add on.

https://splunkbase.splunk.com/app/4959/#/details

would like to check if there is any supported version by splunk ?

Re: microsoft defender add on using certificates

VatsalJagani — Tue, 15 Mar 2022 12:58:04 GMT

Hi @siuolkl ,

Can you please explain the reason you need to add a certificate?

I would just generate credentials on Azure App Registration and just add in the Add-on configuration UI and that's all.

Re: microsoft defender add on using certificates

siuolkl — Wed, 16 Mar 2022 01:40:07 GMT

@VatsalJagani hello thank you for the reply.

the add on is working fine but I am posting this question as my environment requires the use of certificates.

I am not sure if splunk support this method.

Also from Microsoft documentation. the option to use cert is more secure compared to client secrets for app registration from azure.

https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app

Re: microsoft defender add on using certificates

VatsalJagani — Wed, 16 Mar 2022 14:01:52 GMT

@siuolkl - My understanding of this tells me that following the document you have on Microsoft Azure and below for the Add-on should give you what you need.

FYI, communication is done by the Add-on, Splunk is not involved here. The screenshot is from the Add-on document.