MicrosoftDefenderXDR

Microsoft Defender for Endpoint is an Endpoint Detection and Response (EDR) product that monitors the security of endpoints. The module required, at least, the Microsoft Defender for Endpoint plan 1

Configuration

Name	Type	Description
base_url	string	Base URL
app_id	string	The identifier of the Azure Application
app_secret	string	The value of the secret associated to the Azure Application
tenant_id	string	The identifier of the Azure Directory

Actions

Comment an alert

Comment an alert

Arguments

Name	Type	Description
alert_id	string	Alert ID
comment	string	Comment

Outputs

Name	Type	Description
id	string	The identifier of the alert

Cancel machine action

Cancel machine action

Arguments

Name	Type	Description
action_id	string	Action ID
comment	string	Comment

Outputs

Name	Type	Description
id	string	The identifier of the action
type	string	The type of the action
status	string	The status of the action
requestor	string	Identify who executed the action
title	string	The title of the action
machineid	string	The identifier of the machine

Get action info

Retrieve the status of an action of the machine

Arguments

Name	Type	Description
action_id	string	Action ID

Outputs

Name	Type	Description
id	string	The identifier of the action
type	string	The type of the action
status	string	The status of the action
requestor	string	Identify who executed the action
title	string	The title of the action
machineid	string	The identifier of the machine

Isolate a machine

Isolate a machine

Arguments

Name	Type	Description
machine_id	string	Machine ID
comment	string	Comment
isolation_type	string	Isolation Type

Outputs

Name	Type	Description
id	string	The identifier of the action
type	string	The type of the action
scope	string	The scope of the action
status	string	The status of the action
requestor	string	Identify who executed the action
title	string	The title of the action
machineid	string	The identifier of the machine

Push IOCs

Push IOCs in the TI API of Microsoft Defender

Arguments

Name	Type	Description
stix_objects_path	string	Filepath of the STIX objects fetched from the collection
sekoia_base_url	string	[Optional] Sekoia base url, used to generate direct links to IOCs
action	string	Action to apply
severity	string	Severity
generate_alert	boolean	Generate Alert?

Restrict code execution

Restrict the execution of code on a machine

Arguments

Name	Type	Description
machine_id	string	Machine ID
comment	string	Comment

Outputs

Name	Type	Description
id	string	The identifier of the action
type	string	The type of the action
status	string	The status of the action
requestor	string	Identify who executed the action
title	string	The title of the action
machineid	string	The identifier of the machine

Scan a machine

Run an Anti-Virus scan on a machine

Arguments

Name	Type	Description
machine_id	string	Machine ID
comment	string	Comment
scan_type	string	Scan Type

Outputs

Name	Type	Description
id	string	The identifier of the action
type	string	The type of the action
scope	string	The scope of the action
status	string	The status of the action
requestor	string	Identify who executed the action
title	string	The title of the action
machineid	string	The identifier of the machine

Deisolate a machine

Deisolate a machine

Arguments

Name	Type	Description
machine_id	string	Machine ID
comment	string	Comment

Outputs

Name	Type	Description
id	string	The identifier of the action
type	string	The type of the action
status	string	The status of the action
requestor	string	Identify who executed the action
title	string	The title of the action
machineid	string	The identifier of the machine

Unrestrict code execution

Remove the restriction of the code execution on a machine

Arguments

Name	Type	Description
machine_id	string	Machine ID
comment	string	Comment

Outputs

Name	Type	Description
id	string	The identifier of the action
type	string	The type of the action
status	string	The status of the action
requestor	string	Identify who executed the action
title	string	The title of the action
machineid	string	The identifier of the machine

Update an alert

Update an alert

Arguments

Name	Type	Description
alert_id	string	Alert ID
status	string	Status
classification	string	Classification of the alert
determination	string	Determination of the alert. The determination must match the classification (see https://learn.microsoft.com/en-us/defender-endpoint/api/update-alert)
comment	string	Comment
owner	string	Owner of the alert

Outputs

Name	Type	Description
id	string	The identifier of the alert
title	string	The title of the alert
description	string	The description of the alert
status	string	The status of the alert
classification	string	The classification of the alert
determination	string	The determination of the alert
category	string	The category of the alert

Set up

Configuration

Collect events

Create an Azure application

1. On the Azure Portal, in the search bar, go to App registrations
2. Click + New registration
3. Type a name
4. Select Accounts in this organizational directory only option as account type
5. Click Register
6. From the Overview page, copy Application (client) ID and Directory (tenant) ID

Create a client secret

1. Go to Manage > Certificates & secrets
2. Click + New client secret
3. Type a description and select the desirated expiration period
4. Click Add
5. Copy the Value of the client secret

Add permissions

1. Go to Manage > API permissions
2. Click Add a permissions
3. On the right panel, Select APIs my organization uses tab
4. Click Office 365 Management APIs
5. Click Application permissions
6. Select ActivityFeed.Read
7. Click Add permissions
8. In the API permissions page, click Grant admin consent for TENANT_NAME
9. Click Yes in the Grant admin consent confirmation modal

Install Agent

1. On security.microsoft.com, go to System > Parameters
2. Click Endpoints
3. Go to Device Management > Onboarding
4. Download the Integration package

Read More

Create an application with the permission

1. In Microsoft EntraID, create a new application under App registrations.
2. For the permissions, go to API permission
3. Click + Add a permission. Select APIs my organization uses and type WindowsDefenderATP.
4. Select WindowsDefenderATP.
5. In the permissions, select:
6. Machine.Isolate
7. Machine.Offboard
8. Machine.Read.All
9. Machine.RestrictExecution
10. Machine.Scan
11. Machine.StopAndQuarantine
12. Ti.Read.All
13. Ti.ReadWrite
14. Ti.ReadWrite.All
15. Alert.ReadWrite.All
16. After permissions selection, grant the admin consent.

Read More

Extra

Module MicrosoftDefenderXDR v1.0.0