Microsoft 365 Defender

This app integrates with Microsoft 365 Defender to execute various generic and investigative actions

Supported Actions

• test connectivity: Validate the asset configuration for connectivity using supplied configuration
• on poll: Callback action for the on_poll ingest functionality
• run query: An advanced search query
• list incidents: List all the incidents
• list alerts: List all the alerts
• get incident: Retrieve specific incident by its ID
• update incident: Update the properties of an incident object
• get alert: Retrieve specific alert by its ID
• update alert: Update properties of existing alert