How the Defender for Endpoint input brings alerts into Graylog
The Graylog Microsoft Defender for Endpoint input is an Enterprise-licensed pull input that polls Defender data on a schedule, which is the first thing a security team should plan for if it wants Defender alerts searchable next to firewall, identity and server logs. The input needs a Microsoft Entra application holding Alert.Read.All, Alert.ReadWrite.All, User.Read.All, Vulnerability.Read.All and Machine.Read.All permissions with admin consent, and every Graylog node must reach Microsoft API endpoints on port 443. Graylog Open does not include this input, so the license decision comes before any app registration work. The input collects alerts and related Defender data so that analysts can search, correlate and build dashboards in Graylog. It does not block processes, isolate devices, quarantine files or remediate anything on endpoints. Those actions stay in the Microsoft Defender portal or in a response tool you operate.
The default poll interval is 5 minutes, so alerts reach Graylog with a delay of up to roughly that period plus processing time. Confirm the interval you need with your SOC, because a shorter interval increases API calls against Microsoft endpoints and the volume of messages Graylog must index. Also confirm with your Microsoft administrators which tenant and permission model you will use, since admin consent for the five permissions is a tenant-level decision that affects every node polling the API. Before you build streams or alerts, run a test input on a single node and check that alerts arrive with the fields your detections expect.
Ask your Microsoft 365 administrator to confirm the consent process early, because admin consent is often the slowest approval in this setup. Document the Entra application, the permissions granted and the owner of the client secret so that rotation does not stop ingestion without warning. Plan network rules for all Graylog nodes, not only the leader, because each node that runs the input must reach the Microsoft endpoints on port 443. Treat the Defender input as one source among many: it shows what Defender detected, while the logs from your endpoints and network devices show the context around those detections.
What you need before creating the input
Four things must be in place before anyone opens the input form: a licensed Graylog edition, a Microsoft Entra application with the right permissions and consent, a person who can grant that consent, and network paths from every Graylog node. Confirm each one with the people who own the tenant and the cluster, because a gap in any of them stops the input before it polls its first alert.
Graylog Enterprise license
The Defender for Endpoint input is an Enterprise pull input, so Graylog Open cannot run it. Confirm that your license covers this input before planning the build, and check the Graylog pricing page for the current tiers and minimums. Licensing is based on processed data, not on users or devices, so ask your Graylog contact how expected Defender alert volume fits inside your licensed data volume. Also confirm the Graylog version you run against the current documentation and the compatibility matrix.
Microsoft Entra application registration
Create a dedicated application registration in Microsoft Entra for the Graylog input rather than reusing an existing integration. Record the tenant ID, application (client) ID and client secret, and store the secret in your secrets management process, since it is entered into the input configuration. Plan a secret rotation date at creation so the input does not stop when the secret expires.
Application permissions with admin consent
Assign the five application permissions the input needs: Alert.Read.All, Alert.ReadWrite.All, User.Read.All, Vulnerability.Read.All and Machine.Read.All. Each is an application permission, so it must be granted with admin consent before the input can read data. Review whether the Read-Write alert permission is acceptable under your change control, since it is broader than read access.
Admin rights to grant consent
The person granting consent needs rights in Microsoft Entra that allow admin consent for application permissions in your tenant, and Defender for Endpoint access to the data the permissions expose. Confirm this with your identity team before the change window, since a consent request from a user without the right role will stall. Record who approved the consent for your audit trail.
Outbound port 443 from every node
Each Graylog node that runs the input must reach Microsoft API endpoints on port 443 outbound. In a multi-node cluster, the input runs on every node, so check each node separately, including any node behind a proxy or restricted egress policy. Ask your network team to confirm the exact Microsoft endpoints your tenant and region use, and test them from each node before creating the input.
Configuring the Defender input in order
This sequence takes a Graylog cluster from no Defender connection to alert data arriving in a stream that your team can search. Each step has a check, so a failure is caught at the step where it occurs rather than after the input is running.
Register the Entra application
A Microsoft Entra administrator creates an app registration in the tenant whose Defender data you want to collect. Record the application (client) ID and the directory (tenant) ID, since the Graylog input asks for both. Keep the registration in the same tenant that owns the Defender for Endpoint data, or the API calls will return no records. Check: the app appears in the Entra app registrations list with both IDs visible on its overview page.
Add the five Defender API permissions
In the app's API permissions, add the Microsoft Defender for Endpoint application permissions Alert.Read.All, Alert.ReadWrite.All, Vulnerability.Read.All and Machine.Read.All. Add User.Read.All as well, which the input also requires. Use application permissions rather than delegated ones, because the poller runs without a signed-in user. Check: the permissions list shows all five with the Application type and a status that still says admin consent is required.
Grant admin consent
A tenant administrator with the rights to consent for the organization selects Grant admin consent for the tenant. Until this is done, the app cannot obtain tokens with these permissions, and the poll will fail with an authorization error. Check: every permission in the list shows Granted for the tenant, with no pending consent warnings.
Create a client secret or certificate and record its expiry
Under certificates and secrets, create a client secret or upload a certificate for the app. Copy the secret value at creation, because Entra does not show it again, and store it in your secrets manager. Record the expiry date in your renewal calendar, since an expired credential silently stops the input. Check: the credential is listed with an expiry date, and a token request using the client ID and this credential returns an access token from the Microsoft login endpoint.
Confirm Enterprise licensing on the cluster
The Defender for Endpoint input is an Enterprise feature, so a Graylog administrator confirms the license is applied to the cluster before creating the input. Graylog Open does not include this input. Check: the input type appears in the Inputs page under the available input types, and the license status in the system view shows an active Enterprise license.
Create the input with tenant and application details
In Graylog, go to System, Inputs, choose the Microsoft Defender for Endpoint input and launch it on the node you intend to use. Enter the tenant ID, client ID and client secret, and keep the default poll interval of 5 minutes unless you have a reason to change it. Select a target index set. Check: the input shows Running on the node, and the input's diagnostics page reports no authentication errors after the first poll.
Route messages into a stream
Create a stream with a rule that matches the source or fields your Defender messages carry, and send matching messages to a stream with its own index set and retention. Keeping Defender data apart from general logs makes alerting and access control easier. Check: after the next poll, messages appear in the stream's search results and not only in the default stream.
Verify each node reaches Microsoft endpoints
Every Graylog node that may run the input must reach Microsoft API endpoints on port 443. Test outbound HTTPS from each node to the login and Defender API hosts, through any proxy or firewall in the path, and confirm the same results from each node. Check: the test succeeds from every node, and a test poll after failover to a second node also returns records. Confirm the exact endpoint list with Microsoft's documentation for your cloud before you open the firewall.
Which Defender data fields map into Graylog
This table pairs each category of Defender data the input collects with the Entra permission that enables it and the Graylog stream or search approach a team would use. Read it as a checklist: if a category matters to your investigations, confirm its permission is granted with admin consent before you expect messages from it. Field names are not listed here, so verify them against the Graylog documentation and a test message from your own cluster.
| Data category | Entra permission needed | How teams use it in Graylog | Verify before relying on it |
|---|---|---|---|
| Alerts | Alert.Read.All (read) or Alert.ReadWrite.All (read and write) | Core stream for detections; search by alert severity, title and affected device, then build event definitions on top | Exact alert field names and whether status changes appear as new messages |
| Machines (devices) | Machine.Read.All | Stream for device inventory context; join to alerts by host identifier in searches and dashboards | Which machine attributes are included and how often device records refresh |
| Users | User.Read.All | Enrich alerts with the account or user associated with the device or event for investigation pivots | Whether user fields are populated on each message type and how they are named |
| Vulnerabilities | Vulnerability.Read.All | Separate stream or dashboard for exposure trends by device and severity, kept apart from alert streams | Whether vulnerability records are emitted through the same polling cycle as alerts |
| Alert write actions | Alert.ReadWrite.All | Only needed if your process requires the input or related tooling to update alert state; otherwise limit scope to read access | Whether your chosen configuration uses any write capability at all |
| Stream and search design | Not a permission | Route each category to its own stream with index set choices sized for its volume, then use consistent field names in saved searches | Test message from your cluster, not assumptions, before writing parsing rules or dashboards |
Securing the app registration and the input
The Defender input runs on a Microsoft Entra application that can read alerts, devices and vulnerabilities across your tenant, so its permissions, credentials and network paths deserve the same review as any privileged integration. The cards below cover the controls that keep that access narrow, recoverable and visible.
Review the five permissions
The input asks for Alert.Read.All, Alert.ReadWrite.All, User.Read.All, Vulnerability.Read.All and Machine.Read.All, each with admin consent. Walk through each one with your security owner and ask whether the input needs it. Alert.ReadWrite.All is the one to challenge first, because it allows changes to alerts, not only reads. Record the decision and the reason for each permission.
Store the secret in a vault
Whether the app uses a client secret or a certificate, keep the credential out of Graylog configuration files, tickets and shared notes. Store it in a secrets manager your team already operates, and limit who can read it. Set a rotation date at creation, and schedule the replacement before the expiry date so the input does not stop polling without warning.
Limit who can edit inputs
Anyone who can edit a Graylog input can change its credentials, polling interval and target stream, so the role that manages inputs should be small and reviewed. Keep Defender input edits separate from general stream and dashboard administration. Check the role assignments after staff changes, and confirm that the audit trail of input changes is kept where your review team can read it.
Treat tenant identifiers as sensitive
The tenant ID, application ID and secret together let someone request Defender data from your tenant. Do not paste them into chat, screenshots or public issue trackers, and mask them in exported Graylog configuration backups. When a copy of the configuration leaves the team, check whether these values were removed first.
Allow only the Microsoft endpoints
Every Graylog node needs outbound access to Microsoft API endpoints on port 443, and nothing else in this path requires internet reach. Ask the network team to write rules for each node's address, through the firewall or proxy, and to block other destinations from the same hosts. Confirm the exact endpoint list with Microsoft documentation and the Graylog input page before writing rules.
Log changes to the app registration
Changes to the Entra app, including permission grants, new secrets and owner changes, should appear in your Entra audit logs and reach your security team. Set an alert or review for these events, because a new secret added to this app is a common way to extend access quietly. Compare the audit record with the change ticket each quarter. The CIS Controls treat anti-malware software and its central management as a control area, and a reviewed record of changes to this integration supports that expectation.
What the Enterprise license adds to the cost
The Defender for Endpoint input is a Graylog Enterprise feature, so the license is a recurring cost on top of Graylog Open, which is free. According to the Graylog pricing page, Graylog Enterprise starts at 15,000 US dollars per year, with a minimum of 10 GB per day or 100 Graylog Compute Units. The license is priced on processed data, with no per-user or per-device fees, so the figure that moves the total is volume. Before comparing quotes, confirm the minimum tier that applies to your daily ingest, whether Defender alerts would count toward that volume, and whether the Enterprise tier includes the 24/7 support you expect. Also ask whether the pricing page figure is the starting list price for your region and term, since the page is the only figure this section relies on.
The one-time work is the Microsoft Entra app registration and the Graylog input. Your identity or security team must create the application, grant the Alert.Read.All, Alert.ReadWrite.All, User.Read.All, Vulnerability.Read.All and Machine.Read.All permissions, and have an administrator give admin consent. Someone then configures the input, confirms the default five-minute polling interval fits your alerting needs, and checks that every Graylog node can reach Microsoft API endpoints on port 443. Effort rises with the number of Microsoft tenants, since each tenant typically needs its own registration and consent, and with the number of Graylog nodes, because each one needs the network path and firewall rule. Alert volume also matters: a high volume of Defender alerts reaching search and event definitions adds index storage and tuning work after go-live.
When requesting a quote, ask for the work to be listed separately: license tier and volume basis, app registration and consent steps, input configuration per tenant, network validation across each node, and test alerts confirmed in search. Ask who holds the Entra administrator role during the build and who performs consent, because that dependency often sets the schedule. Ask for the assumed tenant count, node count and expected Defender alert volume written into the scope, so a later change in any of them can be priced against that baseline rather than negotiated from scratch. Finally, ask what recurs after handover, such as credential rotation for the app registration and periodic review of the permissions granted.
Common failures when the Defender input does not poll
This table lists the failures most likely to stop or slow the Defender input, with the likely cause, the check to run and the fix for each. Work through the rows in order, since licensing and consent problems are quick to confirm and rule out before you look at network paths. Confirm exact permission names, polling options and error behavior in the Graylog Defender input documentation for your version.
| Failure | Likely cause and check | Fix |
|---|---|---|
| Missing admin consent | The Entra app permissions were added but a tenant administrator never granted consent. Check the app's API permissions page in Entra for a pending consent status. | Have a tenant administrator grant admin consent for Alert.Read.All, Alert.ReadWrite.All, User.Read.All, Vulnerability.Read.All and Machine.Read.All, then restart the input and confirm it polls. |
| Client secret has expired | The client secret in the input configuration reached its end date and token requests fail. Check the secret's expiry in the app registration and the input's error log for authentication failures. | Create a new client secret, store it in your secrets process, update the input, and set a calendar reminder before the next expiry date. |
| Missing permission causing partial data | One of the five required permissions was not granted, so some data types, such as vulnerabilities or user details, are absent while alerts still arrive. Compare the granted permissions against the documented list. | Add the missing application permission, grant admin consent again, and check that the expected message types appear in search after the next poll. |
| Outbound port 443 blocked on one node | Only one Graylog node cannot reach Microsoft API endpoints, often because of a host firewall rule, security group or proxy difference. Test each node separately with an HTTPS connection to the endpoints on port 443 and review its logs. | Open outbound 443 from that node to the required Microsoft endpoints, or correct its route or firewall policy, then confirm the input runs on every node. |
| Proxy breaks token requests | The node sends traffic through a proxy that intercepts or rejects the OAuth token request to Entra, or the proxy is not configured for Graylog. Check proxy settings on the affected node and any TLS inspection in the path. | Add the Microsoft endpoints to the proxy allow list or bypass rules where your policy permits, and confirm the proxy certificate chain is trusted by the Graylog node. |
| Input running on Graylog Open without a license | The Defender input is an Enterprise feature, so an unlicensed Graylog Open installation cannot run it successfully. Check the input type list and the license status in the system overview before troubleshooting credentials. | Apply an Enterprise license that covers the input, restart the affected nodes if the documentation requires it, and recheck the input status. |
| Poll interval delays expected data | The input polls on a schedule, so alerts raised in Defender appear only after the next poll. Compare the time an alert was created in Defender with the time it reached Graylog, and check the configured interval. | Adjust the polling interval to match your detection and response needs, keeping the load on the API in mind, and document the expected delay for analysts. |
Questions teams ask before connecting Defender to Graylog
How much does connecting Defender for Endpoint to Graylog cost?
The cost has three parts: the Graylog license, the Microsoft side and the labor to build and run the input. The Graylog Enterprise license is the only price figure to plan around: the Graylog pricing page lists Enterprise from 15,000 US dollars per year, with a minimum of 10 GB per day or 100 Graylog Compute Units, licensed on processed data with no per-user or per-device fees. Labor is the variable part. It covers the Entra app registration, permission review, network rules for port 443 on every node, testing and documentation, and it recurs when secrets rotate or the input changes. Ask any partner for a written quote that lists each of these items separately, along with what is one-time and what recurs.
How long does the Defender input setup take?
Duration depends mostly on how quickly the identity and security teams approve the work, not on the Graylog configuration itself. The steps are an Entra application registration, five application permissions that need admin consent, a client secret stored securely, network paths from each Graylog node to Microsoft API endpoints on port 443, and a test that confirms alerts arrive. Delays usually come from approvals, firewall change windows, a Graylog cluster with several nodes, or an unclear owner for the secret. Ask for a scope with named tasks and a dependency list before agreeing to a timeline.
Can an internal engineer set up the Defender input without a partner?
Yes, if the team has someone who can administer Graylog and someone who can manage Entra app registrations and admin consent. The configuration is not large, but it touches three areas that rarely sit in one team: identity, endpoint security and the Graylog platform. The main risk for an internal team is a broad permission grant or a secret stored in the wrong place. A partner adds value when the team lacks Entra or Graylog experience, needs the work to fit a fixed scope, or wants the setup documented and tested before a security review. Compare the cost of your own staff time against a written, fixed-scope quote.
What does the security and identity team need to provide?
Identity administrators need to create the Microsoft Entra application, grant the Alert.Read.All, Alert.ReadWrite.All, User.Read.All, Vulnerability.Read.All and Machine.Read.All permissions, and give admin consent. Security operations needs to confirm which Defender data should flow, who owns alert triage and whether Graylog write permissions on alerts are acceptable. Network teams need to allow each Graylog node to reach Microsoft API endpoints over port 443. Agree in advance who owns the client secret, where it is stored and how rotation is scheduled, so the input does not stop unexpectedly.
Does the Defender for Endpoint input require a Graylog Enterprise license?
Yes. The Graylog Defender for Endpoint input is an Enterprise pull input, so it is not part of Graylog Open. Graylog Open is licensed under SSPL-1.0, which is not an OSI-approved open source license, and it does not include this input. Confirm the edition on your current Graylog version before you scope the work, because licensing terms can change. Also confirm whether the data volume fits the Enterprise minimum, since the license is based on processed data.
What happens if the client secret expires?
When the client secret expires or is revoked, the Entra application can no longer authenticate, so the input stops polling Defender data. Alerts will not arrive in Graylog until the credential is replaced and the input is updated. Gaps can go unnoticed if no one monitors the input's status, so the team should record the expiry date, set a reminder well before it, and add a check that flags missing Defender events. A written runbook should name who rotates the secret, how the new value is stored and how the input is tested afterward.
Can the 5-minute default polling interval be changed?
The input polls Defender data by default every 5 minutes, and the Graylog Defender input documentation describes that as the default setting. Whether you can change it, and what range is acceptable, should be confirmed against the Graylog version you run and the documentation for that release. Shorter intervals raise API call volume and may increase load on the Graylog cluster, while longer intervals increase the delay before an alert is visible to analysts. Set the interval with the security operations team, since it determines how quickly alerts can be investigated.
What should be checked after the Defender input is running?
Check that the input status is healthy, that alerts from a test device appear in the expected stream, and that the fields parse as expected. Confirm that each Graylog node can reach the Microsoft API endpoints, not only the primary node. Review the Entra sign-in and permission state after the first poll cycle. Then document the secret owner, rotation date, polling interval and the firewall rules used. These checks give the security team evidence that the input works and that a failure would be noticed.
How DeployOpen scopes and delivers this integration
DeployOpen plans and builds the Graylog Microsoft Defender for Endpoint input inside your own Graylog and Microsoft environment, starting from a written scope. Engagements are fixed-scope, with deliverables and timelines agreed before work begins, and ongoing support is available as a retainer.
How we scope
- Confirm your Graylog edition and license, since the Defender input requires Graylog Enterprise.
- Map the Entra tenant, app registration owner and admin consent path before any build work starts.
- Record the Graylog nodes that must reach Microsoft API endpoints on port 443, and the proxy or firewall rules involved.
How we build
- Register the Entra application with the Alert, Machine, User and Vulnerability read permissions the input needs.
- Configure the input on Graylog nodes, set the polling interval and confirm each node can reach the Microsoft endpoints.
- Test alert and device data arrival, then add streams and parsing that match your detection and review workflow.
How we hand over
- Document the app registration, permission list, admin consent record and client secret rotation steps for your team.
- Provide the input configuration, stream routing, network path diagram and a verification checklist for your operators.
- Walk through troubleshooting for missing data, throttled polling and permission errors with the engineers who will run it.
How we support
- Offer a retainer for input health checks, Graylog upgrades that affect the input, and Microsoft API change reviews.
- Review the polling interval and data volume as Defender coverage grows across your endpoints.
- Re-test the input after Graylog or Entra changes so alert ingestion keeps working without gaps.
