Microsoft Defender for Endpoint - Get Machine CVEs
This atomic belongs to the Microsoft Defender for Endpoint atomic group.
Fetches a list of CVEs applicable to the specified machine from Microsoft Defender for Endpoint. This atomic requires the following API permission: Vulnerability.Read.All.
Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path
Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target
Steps:
[] Build the authorization header
[] Build the request payload
[] Request the CVE list
[] Check if the API request was successful:
[]> If it was, get the number of CVEs and set output variables
[]> If it wasn't, output an error
More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-discovered-vulnerabilities?view=o365-worldwide