Monitors the alerts within Microsoft Defender for Cloud.

SETUP:

Microsoft Entra Configuration

Register an Application

Sign in to the Microsoft Entra Admin Center (https://entra.microsoft.com) as a Global Administrator (or at least a Privileged Role Administrator)
Browse to Identity > Applications > App registrations
Select New registration
Provide a meaningful name (e.g. "Checkmk Special Agent")
Select Accounts in this organizational directory only
Do not specify a Redirect URI
Click Register
Save Application (Client) ID and Directory (tenant) ID vor later.

Configure the Application

Go to API permissions
Click Add a permission > Microsoft Graph > Application permissions
Add API permissions SecurityAlert.Read.All
Select Grant admin consent > Yes
Go to Certificates & secrets and click New client secret
Enter a description (e.g. the Checkmk Site name) and select an expiration period for the secret
Save Client secret for later

Checkmk Special Agent Configuration

Log in to your Checkmk site

Add a New Password

Browse to Setup > Passwords
Select Add password
Specify a Unique ID and a Title
Copy the generated secret from the Microsoft Entra Admin Center to the Password field
Click Save

Add Checkmk Host

Add a new host in Setup > Hosts
Configure your custom settings and set
    IP address family: No IP
    Checkmk agent / API integrations: API integrations if configured, else Checkmk agent
Save

Add Special Agent Rule

Navigate to the Special Agent rule Setup > Microsoft Defender Alerts (use the search bar)
Add a new rule and configure the required settings
    Application (client) ID and Directory (tenant) ID from the Microsoft Entra Application
    For Client Secret select From password store and the password from Add a New Password
    Add the newly created host in Explicit hosts
Save and go to your new host and discover your new service
Activate the changes