This is the web application that leverages Microsoft Graph Security API.
This app is not intended to be a feature-complete security dashboard,
rather a sample app built to illustrate what’s possible with the API.
As a multi-tenanted application, it authenticates against the Azure tenant directory system using the Microsoft Online login experience.
Once signed in as a user with appropriate privileges, the app provides a rich landing page with various views of severity
and number of alerts by status, user, machines, domains most at risk, and by provider.
It serves as a ‘single pane of glass’ for SecOps and Administrators by surfacing data from across multiple security products.
You can drill down into any alert or set of alerts by clicking on it.
Selecting the “Alerts” icon on the left navigation bar, displays a list of the latest two active alerts from each security provider.
The Filter sidebar on the right lets you customize the filters applied to the alerts list in an easy, visual manner.
The list of Matching Alerts displays alerts from both Microsoft and other security vendors.
The Security Graph API is already integrated with several third-party services, such as Palo Alto Networks, ContrastSecurity, and Lookout.
Additional third-party vendors are constantly onboarding to the Microsoft Graph Security API.
Clicking on any of these security alerts – such as this one from Azure Security Center – will display rich details about the alert
and its context, along with recommended actions for remediation.
You can manage this alert from right here – without stepping away from the app to Azure Security Center.
Scrolling down you can see organizational context related to this alert, for example:
details about the user beyond what's included in the alert.
The details retrieved from the organization’s directory service – Azure AD in this instance.
Seamlessly merging directory information with a security alert provides additional context,
such as the user’s role in the organization and their physical location.
This way, you can assess the risk posed to the organization and prioritize the remediation actions accordingly.
Once you have completed your alert investigation and determined the alert is a True Positive,
the next step is to take necessary response and/or remediation action.
The Graph Security API lets you select the relevant indicator in the alert and the desired action to take on that indicator
right from the app.
The Graph Security API sends your remediation action to the appropriate security systems to be enforced.
Once you’ve fine-tuned your filtered alerts query, you can subscribe
and retrieve notifications of any new or updated alerts matching it with the click of a button.
For example, you can subscribe to be notified of alerts for a specific group of highly sensitive users or devices,
or about an IP Address you are currently investigating.
The “Actions” tab in the left navigation bar shows a list of all actions that have been invoked – including the one you've just taken.
The “Actions” list shows the latest status of each action, and the right-side filters allow you quickly zero in on specific actions.
The Subscriptions tab shows a list of all current notification subscriptions you have set up.
Clicking on the Notifications button will open a new tab showing pushed notifications for any of these subscriptions.
This simulates a listener process in your network that would receive alert notifications.
The right-side filter bar helps you quickly find any subscription/s that match the criteria of your choice.
Secure Score is now exposed by the Graph Security API.
Here we see how you can retrieve your organization’s Secure Score and display it in the app.
This pane displays your org’s current, and maximum achievable scores.
It also lets you drill down into each of the actions, or controls, to improve your score.