Microsoft Defender for Endpoint

Adds a tag to a machine in Microsoft Defender for Endpoint. This atomic requires the following API permission: Machine.ReadWrite.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the tag be added to the machine
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/add-or-remove-machine-tags?view=o365-worldwide

Microsoft Defender for Endpoint - Add Tag to Machine

prod-nam

prod-eu

prod-apjc

Submits an IOC to Microsoft Defender for Endpoint to be blocked, alerted, or allowed. This atomic requires the following API permission: Ti.ReadWrite.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[]> Update the "Descrption" and "Title" variables
[]> Build authorization headers
[]> Request to update the Indicator list with provided parameters
[]> Check if request was successful
[]> If it didn't, output an error
[]> Extract isolation status from the body response
[]> Check if extraction was successful
[]> If it didn't, output an error
[]> If it did, update the status to the output variable

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/post-ti-indicator?view=o365-worldwide

Microsoft Defender for Endpoint - Block IOC

Fetches a list of indicators of compromise from Microsoft Defender for Endpoint. This atomic requires the following API permission: Ti.ReadWrite.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the indicators
[] Check if the API request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/get-ti-indicators-collection?view=o365-worldwide

Microsoft Defender for Endpoint - Get List of IOCs

Fetches a list of CVEs applicable to the specified machine from Microsoft Defender for Endpoint. This atomic requires the following API permission: Vulnerability.Read.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the CVE list
[] Check if the API request was successful:
[]> If it was, get the number of CVEs and set output variables
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-discovered-vulnerabilities?view=o365-worldwide

Microsoft Defender for Endpoint - Get Machine CVEs

Gets a machine by its ID from Microsoft Defender for Endpoint. This atomic requires the following API permission: Machine.ReadWrite.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the device
[] Check if the API request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/get-machine-by-id?view=o365-worldwide

Microsoft Defender for Endpoint - Get Machine by ID

Isolates a host by machine ID in Microsoft Defender for Endpoint. This atomic requires the following API permission: Machine.Isolate.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Isolate the machine
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/isolate-machine?view=o365-worldwide

Microsoft Defender for Endpoint - Isolate Machine

Releases a machine from isolation in Microsoft Defender for Endpoint. This atomic requires the following API permission: Machine.Isolate.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the machine be removed from isolation
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/unisolate-machine?view=o365-worldwide

Microsoft Defender for Endpoint - Release Machine from Isolation

Removes a tag from a machine in Microsoft Defender for Endpoint. This atomic requires the following API permission: Machine.ReadWrite.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the tag be removed from the machine
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/add-or-remove-machine-tags?view=o365-worldwide

Microsoft Defender for Endpoint - Remove Tag from Machine

Runs an antivirus scan using Microsoft Defender for Endpoint. This atomic requires the following API permission: Machine.Scan.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the antivirus scan
[] Check if the API request was successful:
[]> If it was, set output variables
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/run-av-scan?view=o365-worldwide

Microsoft Defender for Endpoint - Run Antivirus Scan

Searches for machines in Microsoft Defender for Endpoint. If an IP address or DNS name are provided, the machines are filtered. If neither of those inputs are provided, all machines are returned. This atomic requires the following API permission: Ti.ReadWrite.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the relative URL
[] Search for devices
[] Check if the API request was successful:
[]> If it was, extract the first machine ID and set output variables
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-machines?view=o365-worldwide

Microsoft Defender for Endpoint - Search Machines

Unblocks an IOC in Microsoft Defender for Endpoint. This atomic requires the following API permission: Ti.ReadWrite.All.

Target: Microsoft Defender for Endpoint (Commercial or GCC) integration target or HTTP Endpoint for "api.securitycenter.microsoft.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request to unblock the IOC
[] Check if the request was successful:
[]> If it wasn't, output an error

More information about this API: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/delete-ti-indicator-by-id