Microsoft 365 Defender

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.

Network Security · Microsoft 365 Defender

Details

IDMicrosoft 365 Defender
ProviderMicrosoft
CategoryNetwork Security
From Version5.5.0
Docker Imagedemisto/crypto:1.0.0.10120494
Supported ModulesAgentix Cloud Runtime Security XSIAM EDR Cortex Cloud

README

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection,
prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated
protection against sophisticated attacks.

Authentication Using the Device Code Flow

Use the device code flow
to link Microsoft 365 Defender with Cortex XSOAR.

To connect to the Microsoft 365 Defender:

  1. Fill in the required parameters.
  2. Run the !microsoft-365-defender-auth-start command.
  3. Follow the instructions that appear.
  4. Run the !microsoft-365-defender-auth-complete command.

At the end of the process you’ll see a message that you’ve logged in successfully.

Note: In case of a password change, the microsoft-365-defender-auth-reset command should be executed followed by the authentication process described above.

Cortex XSOAR App

In order to use the Cortex XSOAR application, use the default application ID.
9093c354-630a-47f1-b087-6768eb9427e6

Self-Deployed Application - Device Code Flow

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. For more details, follow Self Deployed Application - Device Code Flow.

Required Permissions

The required API permissions are for the Microsoft Threat Protection app.

  • offline_access - Delegate
  • AdvancedHunting.Read - Delegated
  • Incident.ReadWrite.All - Application - See section 4 in this article
  • AdvancedHunting.Read.All - Application - See section 4 in this article

Self-Deployed Application - Client Credentials Flow

Follow these steps for a self-deployed configuration:

  1. To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the following Microsoft article steps 1-8.
  2. In the instance configuration, select the client-credentials checkbox.
  3. Enter your Client/Application ID in the Application ID parameter.
  4. Enter your Client Secret in the Client Secret parameter.
  5. Enter your Tenant ID in the Tenant ID parameter.

Required Permissions

  • AdvancedHunting.Read.All - Application
  • Incident.ReadWrite.All - Application

Configure Microsoft 365 Defender on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Microsoft 365 Defender.
  3. Click Add instance to create and configure a new integration instance.
  4. To ensure that mirroring works:
    1. Select Incident Mirroring Direction. Choose the direction to mirror the incident: Incoming (from Microsoft 365 Defender to Cortex XSOAR), Outgoing (from Cortex XSOAR to Microsoft 365 Defender), or Incoming And Outgoing (from/to Cortex XSOAR and Microsoft 365 Defender).
    2. Select the Fetches incidents radio button.
    3. Under Incident type, select Microsoft 365 Defender Incident.
    4. Under Mapper (incoming), select Microsoft 365 Defender - Incoming Mapper.
    5. Under Mapper (outgoing), select Microsoft 365 Defender - Outgoing Mapper.
    6. To enable mirroring to close a ticket in Cortex XSOAR, check the Close Mirrored Cortex XSOAR Incidents checkbox.
    7. To enable mirroring to close an incident in Microsoft 365 Defender, check the Close Mirrored Microsoft 365 Defender Incidents checkbox.
Parameter Description Required
Endpoint URI The United States: api-us.security.microsoft.com
Europe: api-eu.security.microsoft.com
The United Kingdom: api-uk.security.microsoft.co		 True
ID or Client ID   False
Token or Tenant ID   False
Application ID The API key to use to connect. False
Use Client Credentials Authorization Flow Use a self-deployed Azure application and authenticate using the Client Credentials flow. False
Tenant ID (for Client Credentials mode)   False
Client Secret (for Client Credentials mode)   False
Client Secret   False
Certificate Thumbprint Used for certificate authentication. As appears in the “Certificates & secrets” page of the app. False
Private Key   False
Certificate Thumbprint Used for certificate authentication. As appears in the “Certificates & secrets” page of the app. False
Private Key Used for certificate authentication. The private key of the registered certificate. False
Use Azure Managed Identities Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. False
Azure Managed Identities Client ID The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
Fetch incidents timeout The time limit in seconds for fetch incidents to run. Leave this empty to cancel the timeout limit. False
Number of incidents for each fetch. Due to API limitations, the maximum is 100. False
Incident type   False
Fetch incidents   False
Trust any certificate (not secure)   False
Use system proxy settings   False
Application ID (Deprecated)   False
Tenant ID (for Client Credentials mode) (Deprecated)   False
Client Secret (for Client Credentials mode) (Deprecated)   False
Incidents Fetch Interval   False
Incident Mirroring Direction Choose the direction to mirror the incident: Incoming (from Microsoft 365 Defender to Cortex XSOAR), Outgoing (from Cortex XSOAR to Microsoft 365 Defender), or Incoming and Outgoing (from/to Cortex XSOAR and Microsoft 365 Defender). False
Close Mirrored Cortex XSOAR Incidents Incoming Mirroring - when selected, closing the Microsoft 365 Defender incident is mirrored in Cortex XSOAR. False
Close Mirrored Microsoft 365 Defender Incidents Outgoing Mirroring - when selected, closing the Cortex XSOAR incident is mirrored in Microsoft 365 Defender. False
Comment Entry Tag To Microsoft 365 Defender Choose a tag to add to an entry to mirror it as a comment into Microsoft 365 Defender. False
Comment Entry Tag From Microsoft 365 Defender Choose a tag to add to an entry to mirror it as a comment from Microsoft 365 Defender. False
Custom close-reason mapping (XSOAR -> Defender mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR) Define how to close the mirrored incidents from Cortex XSOAR into Defender with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XSOAR close reason}={Defender close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Defender. Not following this format will result in closing the incident with a default close reason. Example: “Resolved=Other,Duplicate=Other”. Refer to Outgoing Closing Logic (XSOAR → Microsoft 365 Defender) for possible close-reasons. False
Custom close-reason mapping (Defender -> XSOAR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR) Define how to close the mirrored incidents from Defender into Cortex XSOAR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Defender close reason}={Cortex XSOAR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Defender. Not following this format will result in closing the incident with a default close reason. Example: “Known Issue=Resolved, Duplicate Incident=Other”. Refer to Incoming Closing Logic (Microsoft 365 Defender → XSOAR) for possible close-reasons. False
  1. Run the !microsoft-365-defender-auth-test command to validate the authentication process.

Incident Mirroring

Mirroring In (Microsoft 365 Defender → XSOAR)

When incidents are mirrored into XSOAR from Microsoft 365 Defender:

  1. Comments mirrored from Microsoft 365 Defender will be added to the incident as entries in XSOAR and tagged with the Comment Entry Tag From Microsoft 365 Defender.
    • By default, the tag is set to: CommentFromMicrosoft365Defender.
  2. If an incident is closed in Microsoft 365 Defender (status = Resolved) and Close Mirrored Cortex XSOAR Incidents is enabled:
    • The “classification” field in Microsoft 365 Defender will be mapped to the Close Reason field in XSOAR.

Mirroring Out (XSOAR → Microsoft 365 Defender)

When incidents are mirrored out from XSOAR to Microsoft 365 Defender:

  1. Supported Fields:
    The following fields are mirrored:
    • Microsoft 365 Defender Status
    • Assigned User
    • Microsoft 365 Defender Classification
    • Microsoft 365 Defender Tags
  2. Comments:
    • XSOAR entries with the Comment Entry Tag To Microsoft 365 Defender tag are mirrored as comments in Microsoft 365 Defender.
    • Note: Comments cannot be edited or deleted in Microsoft 365 Defender, as this functionality is not supported.
  3. If an incident is closed in XSOAR and Close Mirrored Microsoft 365 Defender Incidents is enabled:
    • The Close Reason field is mirrored to the status, classification and determination fields in Microsoft 365 Defender.

Closing Logic

Incoming Closing Logic (Microsoft 365 Defender → XSOAR)

When an incident is resolved in Microsoft 365 Defender:

  1. If the status = Resolved:
    • The “classification” field will be mapped to the Close Reason field in XSOAR using the Close Reason Mapping Table.
    • The “classification” and “determination” fields will be mirrored into the Microsoft 365 Defender Classification field in XSOAR.

Example:

  • An incident closed in Microsoft 365 Defender with:
    • status = Resolved
    • Classification = True Positive
    • Determination = Phishing

    Results in XSOAR:

    • Close Reason = Resolved
    • Microsoft 365 Defender Classification = True Positive - Phishing

Close Reason Mapping Table (Incoming):

Classification in Microsoft 365 Defender Close Reason in XSOAR
Not set Other
True Positive Resolved
False Positive False Positive
Informational / Expected Activity Resolved

Outgoing Closing Logic (XSOAR → Microsoft 365 Defender)

Disclaimer: The closing form currently does not support the Microsoft 365 Defender Classification field, and False Positive Classification is not yet enforced when selecting “False Positive” as the close reason.
If classification is required, please manually update the Microsoft 365 Defender Classification via the layout before closing the incident.

When closing incidents from XSOAR to Microsoft 365 Defender, the following logic is applied to map the Close Reason field:

  1. General Status Update:
    When an incident is marked as closed in XSOAR, the status field in Microsoft 365 Defender will always be set to Resolved.

  2. Close Reason: Resolved or False Positive
    If the Close Reason in XSOAR is Resolved, the Microsoft 365 Defender Classification field is mirrored to classification and determination fields as-is into Microsoft 365 Defender without any changes.

  3. Close Reason: Other or Duplicate
    If the Close Reason in XSOAR is either Other or Duplicate, the following updates occur:

    • classification → Unknown
    • determination → NotAvailable

Close Reason Mapping Table (Outgoing):

Close Reason in XSOAR Classification in Microsoft 365 Defender Determination in Microsoft 365 Defender Status in Defender
Resolved Mirrored as-is Mirrored as-is Resolved
FalsePositive FalsePositive Mirrored as-is \ Other Resolved
Other Unknown NotAvailable Resolved
Duplicate Unknown NotAvailable Resolved

Notes

  1. Configuration Requirements for Closing Incidents:
    To close incidents in both directions, ensure the following settings in XSOAR:
    • Close Mirrored XSOAR Incident checkbox = True
    • Close Mirrored Microsoft 365 Defender Incident checkbox = True

    If these checkboxes are False, only the Microsoft 365 Defender Status and Microsoft 365 Defender Classification fields will be updated, and incidents will not be closed.

Configure Incident Mirroring

This feature is compliant with XSOAR version 6.0 and above.
When mirroring incidents, you can make changes in Microsoft 365 Defender that will be reflected in Cortex XSOAR, or vice versa.

The following instructions include steps for configuring the integration and incoming and outgoing mappers. However, they do not cover every option available in the integration nor classification and mapping features.
For information about classification and mapping see Classification and Mapping.

Note:

  • For Cortex XSOAR version 6.1 only, the final source of truth for an incident are the values in Cortex XSOAR. For example, if you change the severity in Cortex XSOAR and then change it back in Microsoft 365 Defender, the final value that will be presented is the one in Cortex XSOAR. For versions 6.2 and later, if mirroring is in both directions then the latest update is the source of truth.
  • The mirroring settings apply only for incidents that are fetched after applying the settings.
  • To use a custom mapper, you must first duplicate the mapper and edit the field in the copy of the mapper. If you detach the out of the box mapper and make changes to it, the pack does not automatically get updates.

STEP 1 - Configure the Microsoft 365 Defender Integration Instance for Mirroring

  1. Navigate to Integrations and search for Microsoft 365 Defender.
  2. Click Add instance.
  3. Select Fetches incidents.
  4. Select the Incident Mirroring Direction:
    • Incoming - Mirrors changes on the Microsoft 365 Defender incident in to the Cortex XSOAR incident.
    • Outgoing - Mirrors changes on the Cortex XSOAR incident to the Microsoft 365 Defender incident.
    • Incoming And Outgoing - Mirrors changes both in and out on both incidents.
  5. Under Incident type, select Microsoft 365 Defender Incident.
  6. Under Mapper (incoming), for default mapping select Microsoft 365 Defender - Incoming Mapper. For custom mapping, follow the instructions in STEP 2 and then select the custom mapper name.
  7. Under Mapper (outgoing), for default mapping select Microsoft 365 Defender - Outgoing Mapper. For custom mapping, follow the instructions in STEP 3 and then select the custom mapper name.
  8. Enter the relevant Comment Entry Tag To Microsoft 365 Defender and Comment Entry Tag From Microsoft 365 Defender values.
    These values are mapped to the dbotMirrorTags incident field in Cortex XSOAR, which defines how Cortex XSOAR handles comments when you tag them in the War Room.
    Note:
    These tags work only for mirroring comments from Cortex XSOAR to Microsoft 365 Defender.
  9. To enable mirroring when closing an incident in Cortex XSOAR and Microsoft 365 Defender, select the Close Mirrored Cortex XSOAR Incidents and Close Mirrored Microsoft 365 Defender Incidents checkboxes respectively.
  10. Click Save & Exit.

STEP 2 (Optional) Configure the Incoming Mapper by Incident Type

Note:
Any modifications require that the mappers be cloned before any changes can be applied.

  1. Navigate to Classification and Mapping and for Incidents search for the Microsoft 365 Defender - Incoming Mapper.
  2. Select it and click Duplicate.
  3. Under the Incident Type dropdown, select Microsoft 365 Defender Incident.
  4. Verify the mapper has these fields mapped. They will pull the values configured on the integration instance settings at the time of ingestion.
    • dbotMirrorId - dbotMirrorId - the field used by the third-party integration to identify the incident. This should be the incidentId of the Microsoft 365 Defender Incident.
    • dbotMirrorDirection - determines whether mirroring is incoming, outgoing, or both. Default is Both. This should match the instance configuration.
    • dbotMirrorInstance - determines the Microsoft 365 Defender instance with which to mirror. This should match the instance configuration.
    • dbotMirrorLastSync - determines the field by which to indicate the last time that the systems synchronized.
    • dbotMirrorTags - determines the tags that you need to add in Cortex XSOAR for entries to be pushed to Microsoft 365 Defender. They should be copied from the tags in the instance configuration. These are also the tags that must be put on the War Room record in order for it to sync.

STEP 3 - Modify the Outgoing Mapper

Note:
Any modifications require that the mappers be cloned before any changes can be applied.

  1. Navigate to Classification and Mapping, and for Incidents search for the Microsoft 365 Defender - Outgoing Mapper.
  2. Select it and click Duplicate.
    The left side of the screen shows the Microsoft 365 Defender fields to which to map and the right side of the
    screen shows the Cortex XSOAR fields by which you are mapping.
  3. Under the Incident Type dropdown, select the relevant incident type (for example Microsoft 365 Defender Incident).
  4. Under Schema Type, select incident. The Schema Type represents the Microsoft 365 Defender entity that
    you are mapping to.
  5. On the right side of the screen, under Incident, select the incident based on which you want to
    match.
  6. Change the mapping according to your needs, including any fields you want mapped outward to Microsoft 365 Defender.
  7. Save your changes.

STEP 4 - Create an Incident in Microsoft 365 Defender

For purposes of this use case, it can be a simple incident. The new incident will be ingested in Cortex XSOAR in approximately one minute.

STEP 5 - Add a Comment from Cortex XSOAR to Microsoft 365 Defender

In the example below, we have written A comment from Cortex XSOAR to Microsoft 365 Defender.

  1. Create an entry in the incidents’ war room.
  2. Click Actions > Tags and add the Comment Entry Tag To Microsoft 365 Defender tag.
  3. Navigate back to the incident in Microsoft 365 Defender and within approximately one minute, the changes will be reflected there, too. The note is mirrored out as a comment in Microsoft 365 Defender.
    You can make additional changes like closing the incident or changing the assignee and those will be reflected in both systems.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you
successfully execute a command, a DBot message appears in the War Room with the command details.

microsoft-365-defender-auth-start

Run this command to start the authorization process and follow the instructions in the command results. (for device-code mode)

Base Command

microsoft-365-defender-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!microsoft-365-defender-auth-start

Human Readable Output

###Authorization instructions

  1. To sign in, use a web browser to open the page {URL}
    and enter the code {code} to authenticate.
  2. Run the !microsoft-365-defender-auth-complete command in the War Room.

microsoft-365-defender-auth-complete

Run this command to complete the authorization process. Should be used after running the microsoft-365-defender-auth-start command. (for device-code mode)

Base Command

microsoft-365-defender-auth-complete

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!microsoft-365-defender-auth-complete

Human Readable Output

✅ Authorization completed successfully.

microsoft-365-defender-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

microsoft-365-defender-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!microsoft-365-defender-auth-reset

Human Readable Output

Authorization was reset successfully.
You can now run !microsoft-365-defender-auth-start and
!microsoft-365-defender-auth-complete.

microsoft-365-defender-auth-test

Tests the connectivity to the Microsoft 365 Defender.

Base Command

microsoft-365-defender-auth-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!microsoft-365-defender-auth-test

Human Readable Output

✅ Success!

microsoft-365-defender-incidents-list

Get the most recent incidents.

Base Command

microsoft-365-defender-incidents-list

Input

Argument Name Description Required
status Categorize incidents (as Active, Resolved, or Redirected). Possible values are: Active, Resolved, Redirected. Optional
assigned_to Owner of the incident. Optional
limit Number of incidents in the list. Maximum is 100. Default is 100. Optional
offset Number of entries to skip. Optional
timeout The time limit in seconds for the http request to run. Default is 30. Optional
odata Filter incidents using odata query: https://docs.microsoft.com/en-us/microsoft-365/security/defender/api-list-incidents?view=o365-worldwide. Example: {"$filter":"lastUpdateTime gt 2022-08-29T06:00:00.29Z"}. Optional

Context Output

Path Type Description
Microsoft365Defender.Incident.incidentId Number Incident’s ID.
Microsoft365Defender.Incident.redirectIncidentId Unknown Only populated in case an incident is grouped together with another incident, as part of the incident processing logic.
Microsoft365Defender.Incident.incidentName String The name of the incident.
Microsoft365Defender.Incident.createdTime Date The date and time (in UTC) the incident was created.
Microsoft365Defender.Incident.lastUpdateTime Date The date and time (in UTC) the incident was last updated.
Microsoft365Defender.Incident.assignedTo String Owner of the incident.
Microsoft365Defender.Incident.classification String Specification of the incident. Possible values are: Unknown, FalsePositive, and TruePositive.
Microsoft365Defender.Incident.determination String The determination of the incident. Possible values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, and Other.
Microsoft365Defender.Incident.status String The current status of the incident. Possible values are: Active, Resolved, and Redirected.
Microsoft365Defender.Incident.severity String Severity of the incident. Possible values are: UnSpecified, Informational, Low, Medium, and High.
Microsoft365Defender.Incident.alerts Unknown List of alerts relevant for the incidents.
Microsoft365Defender.Incident.tags unknown List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
Microsoft365Defender.Incident.comments unknown List of comments created by secops when managing the incident, for example additional information about the classification selection.

Command Example

!ms-365-defender-incidents-list status=Active limit=10 assigned_to=user

Human Readable Output

Incidents

Incident name Tags Severity Incident ID Categories Impacted entities Active alerts Service sources Detection sources First activity Last activity Status Assigned to Classification Device groups
Automated investigation started manually on one endpoint tag1, tag2 Informational 263 SuspiciousActivity user 5 / 12 MicrosoftDefenderForEndpoint AutomatedInvestigation 2021-03-22T12:34:31.8123759Z 2021-03-22T12:59:07.526847Z Active email Unknown computer
Impossible travel activity involving one user   Medium 264 InitialAccess user 1 / 1 MicrosoftCloudAppSecurity MCAS 2021-04-05T06:56:06.833Z 2021-04-05T15:34:25.736Z Resolved email Unknown  

microsoft-365-defender-incident-get

Get incident with the given ID.

Base Command

microsoft-365-defender-incident-get

Input

microsoft-365-defender-incident-get

Gets the incident with the given ID.

Base Command

microsoft-365-defender-incident-get

Input

Argument Name Description Required
id Incident’s ID. Required
timeout The time limit in seconds for the http request to run. Default is 30. Optional

Context Output

Path Type Description
Microsoft365Defender.Incident.incidentId number Incident’s ID.
Microsoft365Defender.Incident.redirectIncidentId unknown Only populated in case an incident is grouped together with another incident, as part of the incident processing logic.
Microsoft365Defender.Incident.incidentName string The name of the incident.
Microsoft365Defender.Incident.createdTime date The date and time (in UTC) the incident was created.
Microsoft365Defender.Incident.tags unknown List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
Microsoft365Defender.Incident.lastUpdateTime date The date and time (in UTC) the incident was last updated.
Microsoft365Defender.Incident.assignedTo string Owner of the incident.
Microsoft365Defender.Incident.classification string Specification of the incident. Possible values are: Unknown, FalsePositive, and TruePositive.
Microsoft365Defender.Incident.determination string The determination of the incident. Possible values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, and Other.
Microsoft365Defender.Incident.severity string Severity of the incident. Possible values are: UnSpecified, Informational, Low, Medium, and High.
Microsoft365Defender.Incident.status string The current status of the incident. Possible values are: Active, Resolved, and Redirected.
Microsoft365Defender.Incident.alerts unknown List of alerts relevant for the incidents.
Microsoft365Defender.Incident.tags unknown List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
Microsoft365Defender.Incident.comments unknown List of comments created by secops when managing the incident, for example additional information about the classification selection.

microsoft-365-defender-incident-update

Update the incident with the given ID.

Base Command

microsoft-365-defender-incident-update

Input

Argument Name Description Required
status Categorize incidents (as Active, Resolved, or Redirected). Possible values are: Active, Resolved, Redirected, InProgress. Optional
assigned_to Owner of the incident. Optional
id Incident’s ID. Required
classification The specification for the incident. Possible values are: Unknown, FalsePositive, TruePositive, InformationalExpectedActivity. Optional
determination Determination of the incident. Must be used with the classification field. Possible values depend on the classification field: TruePositive - MultiStagedAttack, MaliciousUserActivity, Malware, Phishing, CompromisedAccount, UnwantedSoftware, Other (default), InformationalExpectedActivity- SecurityTesting, LineOfBusinessApplication, ConfirmedActivity, Other (default), FalsePositive - NotMalicious, NoEnoughDataToValidate, Other (default), Unknown - NotAvailable. Possible values are: NotAvailable, Malware, SecurityTesting, UnwantedSoftware, MultiStagedAttack, MaliciousUserActivity, CompromisedAccount, Phishing, LineOfBusinessApplication, ConfirmedActivity, NotMalicious, Other. Optional
comment Comment to be added to the incident. Optional
tags A comma-separated list of custom tags associated with an incident. For example: tag1,tag2,tag3. Optional
timeout The time limit in seconds for the http request to run. Default is 30. Optional

Context Output

Path Type Description
Microsoft365Defender.Incident.incidentId Number Incident’s ID.
Microsoft365Defender.Incident.redirectIncidentId Unknown Only populated in case an incident is grouped together with another incident, as part of the incident processing logic.
Microsoft365Defender.Incident.incidentName String The name of the incident.
Microsoft365Defender.Incident.createdTime Date The date and time (in UTC) the incident was created.
Microsoft365Defender.Incident.lastUpdateTime Date The date and time (in UTC) the incident was last updated.
Microsoft365Defender.Incident.assignedTo String Owner of the incident.
Microsoft365Defender.Incident.classification String Specification of the incident. Possible values are: Unknown, FalsePositive, and TruePositive.
Microsoft365Defender.Incident.determination String The determination of the incident. Possible values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, and Other.
Microsoft365Defender.Incident.severity String Severity of the incident. Possible values are: UnSpecified, Informational, Low, Medium, and High.
Microsoft365Defender.Incident.status String The current status of the incident. Possible values are: Active, Resolved, and Redirected.
Microsoft365Defender.Incident.alerts Unknown List of alerts relevant for the incidents.
Microsoft365Defender.Incident.tags unknown List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
Microsoft365Defender.Incident.comments unknown List of comments created by secops when managing the incident, for example additional information about the classification selection.

Command Example

!microsoft-365-defender-incident-update id=264 tags=test5

Human Readable Output

Updated incident No. 263

Incident name Tags Severity Incident ID Categories Impacted entities Active alerts Service sources Detection sources First activity Last activity Status Assigned to Classification Device groups
Automated investigation started manually on one endpoint test5 Informational 263 SuspiciousActivity   10 / 12 MicrosoftDefenderForEndpoint AutomatedInvestigation 2021-03-22T12:34:31.8123759Z 2021-03-22T12:59:07.526847Z Active User Unknown computer

microsoft-365-defender-advanced-hunting

NOTE: This endpoint will be deprecated by Microsoft on January 31, 2027. We recommend switching to the Microsoft Graph Security Integration and using the msg-advanced-hunting command. For more information, see the Microsoft documentation.

Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft 365 Defender.
Details on how to write queries you can find here.

Base Command

microsoft-365-defender-advanced-hunting

Input

Argument Name Description Required
query Advanced hunting query. Required
timeout The time limit in seconds for the http request to run. Default is 30. Optional
limit Number of entries. Enter -1 for unlimited query. Default is 50. Required

Context Output

Path Type Description
Microsoft365Defender.Hunt.query String The query used, also acted as a key.
Microsoft365Defender.Hunt.results. Unknown The results of the query.

Command Example

!microsoft-365-defender-advanced-hunting query=AlertInfo

Human Readable Output

Result of query: AlertInfo

Timestamp AlertId Title Category Severity ServiceSource DetectionSource AttackTechniques
2021-04-25T10:11:00Z alertId eDiscovery search started or exported InitialAccess Medium Microsoft Defender for Office 365 Microsoft Defender for Office 365  

get-mapping-fields

Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

update-remote-system

Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.

Base Command

update-remote-system

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

get-remote-data

Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

Base Command

get-remote-data

Input

Argument Name Description Required
id The remote incident ID. Required
lastUpdate The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time. Default is 0. Optional

Context Output

There is no context output for this command.

get-modified-remote-data

Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.

Base Command

get-modified-remote-data

Input

Argument Name Description Required
lastUpdate Date string representing the local time. The incident is only returned if it was modified after the last update time. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • base_url — Endpoint URI (required)
  • creds_client_id —
  • creds_tenant_id —
  • _app_id — Application ID
  • client_credentials — Use Client Credentials Authorization Flow
  • _tenant_id — Tenant ID (for Client Credentials mode)
  • credentials — Client Secret (for Client Credentials mode)
  • creds_certificate — Certificate Thumbprint
  • certificate_thumbprint — Certificate Thumbprint
  • private_key — Private Key
  • use_managed_identities — Use Azure Managed Identities
  • managed_identities_client_id —
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • fetch_timeout — Fetch incidents timeout
  • max_fetch — Number of incidents for each fetch.
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • app_id — Application ID (Deprecated)
  • tenant_id — Tenant ID (for Client Credentials mode) (Deprecated)
  • enc_key — Client Secret (for Client Credentials mode) (Deprecated)
  • incidentFetchInterval — Incidents Fetch Interval
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored Cortex XSOAR Incidents
  • custom_xsoar_to_defender_close_reason — Enable custom XSOAR to Defender Close Reason
  • custom_defender_to_xsoar_close_reason — Enable custom Defender to XSOAR Close Reason
  • close_out — Close Mirrored Microsoft 365 Defender Incidents
  • comment_tag — Comment Entry Tag To Microsoft 365 Defender
  • comment_tag_from_microsoft365defender — Comment Entry Tag From Microsoft 365 Defender
  • custom_xsoar_to_defender_close_reason_mapping — Custom close-reason mapping (XSOAR -> Defender mirrored incident)
  • custom_defender_to_xsoar_close_reason_mapping — Custom close-reason mapping (Defender -> XSOAR mirrored incident)

Commands (12)

  • get-mapping-fields

    Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.

  • get-modified-remote-data

    Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.

  • microsoft-365-defender-advanced-hunting

    Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft 365 Defender. Details on how to write queries: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-language?view=o365-worldwide.

  • microsoft-365-defender-auth-complete

    Run this command to complete the authorization process. Should be used after running the microsoft-365-defender-auth-start command. (for device-code mode).

  • microsoft-365-defender-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • microsoft-365-defender-auth-start

    Run this command to start the authorization process and follow the instructions in the command results. (for device-code mode).

  • microsoft-365-defender-auth-test

    Tests the connectivity to the Microsoft 365 Defender.

  • microsoft-365-defender-incident-get

    Gets the incident with the given ID.

  • microsoft-365-defender-incident-update

    Update the incident with the given ID.

  • microsoft-365-defender-incidents-list

    Get the most recent incidents.

  • update-remote-system

    Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.

Source

Microsoft365Defender.py Microsoft365Defender_test.py Microsoft365Defender.yml Microsoft365Defender_description.md command_examples.txt
Download History Raw 
category: Network Security
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft 365 Defender
  version: -1
configuration:
- additionalinfo: |-
    The United States: api-us.security.microsoft.com
    Europe: api-eu.security.microsoft.com
    The United Kingdom: api-uk.security.microsoft.co
  defaultvalue: https://api.security.microsoft.com
  display: Endpoint URI
  name: base_url
  required: true
  type: 0
  section: Connect
- name: creds_client_id
  type: 9
  displaypassword: ID or Client ID
  hiddenusername: true
  section: Connect
  required: false
- name: creds_tenant_id
  type: 9
  displaypassword: Token or Tenant ID
  hiddenusername: true
  section: Connect
  required: false
- additionalinfo: The API key to use to connect.
  defaultvalue: 9093c354-630a-47f1-b087-6768eb9427e6
  display: Application ID
  name: _app_id
  type: 0
  section: Connect
  hidden: true
  required: false
- additionalinfo: Use a self-deployed Azure application and authenticate using the Client Credentials flow.
  display: Use Client Credentials Authorization Flow
  name: client_credentials
  type: 8
  section: Connect
  required: false
- display: Tenant ID (for Client Credentials mode)
  name: _tenant_id
  type: 0
  section: Connect
  hidden: true
  required: false
- display: Client Secret (for Client Credentials mode)
  hiddenusername: true
  name: credentials
  type: 9
  section: Connect
  displaypassword: Client Secret
  required: false
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: creds_certificate
  type: 9
  displaypassword: Private Key
  section: Connect
  advanced: true
  required: false
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  section: Connect
  advanced: true
  hidden: true
  required: false
- additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  display: Private Key
  name: private_key
  type: 14
  section: Connect
  advanced: true
  hidden: true
  required: false
- additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
  display: Use Azure Managed Identities
  name: use_managed_identities
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  section: Connect
  advanced: true
  required: false
- defaultvalue: 12 hours
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: The time limit in seconds for fetch incidents to run. Leave this empty to cancel the timeout limit.
  defaultvalue: '30'
  display: Fetch incidents timeout
  name: fetch_timeout
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: Due to API limitations, the maximum is 100.
  defaultvalue: '10'
  display: Number of incidents for each fetch.
  name: max_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: Microsoft 365 Defender Incident
  display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Application ID (Deprecated)
  hidden: true
  name: app_id
  type: 4
  section: Connect
  advanced: true
  required: false
- display: Tenant ID (for Client Credentials mode) (Deprecated)
  hidden: true
  name: tenant_id
  type: 4
  section: Connect
  advanced: true
  required: false
- display: Client Secret (for Client Credentials mode) (Deprecated)
  hidden: true
  name: enc_key
  type: 4
  section: Connect
  advanced: true
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Connect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: 'Choose the direction to mirror the incident: Incoming (from Microsoft 365 Defender to Cortex XSOAR), Outgoing (from Cortex XSOAR to  Microsoft 365 Defender), or Incoming and Outgoing (from/to Cortex XSOAR and  Microsoft 365 Defender).'
  defaultvalue: None
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  section: Collect
  hidden:
  - marketplacev2
  - platform
  required: false
- additionalinfo: Incoming Mirroring - when selected, closing the Microsoft 365 Defender incident is mirrored in Cortex XSOAR.
  defaultvalue: 'false'
  display: Close Mirrored Cortex XSOAR Incidents
  name: close_incident
  type: 8
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
- display: Enable custom XSOAR to Defender Close Reason
  name: custom_xsoar_to_defender_close_reason
  defaultvalue: "false"
  type: 8
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
- display: Enable custom Defender to XSOAR Close Reason
  name: custom_defender_to_xsoar_close_reason
  defaultvalue: "false"
  type: 8
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
- additionalinfo: Outgoing Mirroring - when selected, closing the Cortex XSOAR incident is mirrored in Microsoft 365 Defender.
  defaultvalue: 'false'
  display: Close Mirrored Microsoft 365 Defender Incidents
  name: close_out
  type: 8
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
- additionalinfo: Choose a tag to add to an entry to mirror it as a comment into Microsoft 365 Defender.
  defaultvalue: CommentToMicrosoft365Defender
  display: Comment Entry Tag To Microsoft 365 Defender
  name: comment_tag
  type: 0
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
- additionalinfo: Choose a tag to add to an entry to mirror it as a comment from Microsoft 365 Defender.
  defaultvalue: CommentFromMicrosoft365Defender
  display: Comment Entry Tag From Microsoft 365 Defender
  name: comment_tag_from_microsoft365defender
  type: 0
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
- additionalinfo: 'Define how to close the mirrored incidents from Cortex XSOAR into Defender with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XSOAR close reason}={Defender close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Defender. Not following this format will result in closing the incident with a default close reason. Example: "True Positive=TruePositive-Other,False Positive=FalsePositive-Other". Refer to ../README.md for possible close-reasons - `Defender Incident Mirroring`.'
  name: custom_xsoar_to_defender_close_reason_mapping
  type: 0
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
  display: Custom close-reason mapping (XSOAR -> Defender mirrored incident)
- additionalinfo: 'Define how to close the mirrored incidents from Defender into Cortex XSOAR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Defender close reason}={Cortex XSOAR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Defender. Not following this format will result in closing the incident with a default close reason. Example: “Known Issue=Resolved, Duplicate Incident=Other". Refer to ../README.md for possible close-reasons - `Defender Incident Mirroring`.'
  name: custom_defender_to_xsoar_close_reason_mapping
  type: 0
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
  display: Custom close-reason mapping (Defender -> XSOAR mirrored incident)
description: Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.
display: Microsoft 365 Defender
name: Microsoft 365 Defender
script:
  commands:
  - arguments: []
    description: Run this command to start the authorization process and follow the instructions in the command results. (for device-code mode).
    name: microsoft-365-defender-auth-start
  - arguments: []
    description: Run this command to complete the authorization process. Should be used after running the microsoft-365-defender-auth-start command. (for device-code mode).
    name: microsoft-365-defender-auth-complete
  - arguments: []
    description: Run this command if for some reason you need to rerun the authentication process.
    name: microsoft-365-defender-auth-reset
  - arguments: []
    description: Tests the connectivity to the Microsoft 365 Defender.
    name: microsoft-365-defender-auth-test
  - arguments:
    - auto: PREDEFINED
      description: Categorize incidents (as Active, Resolved, or Redirected).
      name: status
      predefined:
      - Active
      - Resolved
      - Redirected
    - description: Owner of the incident.
      name: assigned_to
    - defaultValue: '100'
      description: Number of incidents in the list. Maximum is 100.
      name: limit
    - description: Number of entries to skip.
      name: offset
    - defaultValue: '30'
      description: The time limit in seconds for the http request to run.
      name: timeout
    - description: 'Filter incidents using odata query: https://docs.microsoft.com/en-us/microsoft-365/security/defender/api-list-incidents?view=o365-worldwide. Example: `{"$filter":"lastUpdateTime gt 2022-08-29T06:00:00.29Z"}`.'
      name: odata
    description: Get the most recent incidents.
    name: microsoft-365-defender-incidents-list
    outputs:
    - contextPath: Microsoft365Defender.Incident.incidentId
      description: Incident's ID.
      type: Number
    - contextPath: Microsoft365Defender.Incident.redirectIncidentId
      description: Only populated in case an incident is grouped together with another incident, as part of the incident processing logic.
      type: Unknown
    - contextPath: Microsoft365Defender.Incident.incidentName
      description: The name of the incident.
      type: String
    - contextPath: Microsoft365Defender.Incident.createdTime
      description: The date and time (in UTC) the incident was created.
      type: Date
    - contextPath: Microsoft365Defender.Incident.lastUpdateTime
      description: The date and time (in UTC) the incident was last updated.
      type: Date
    - contextPath: Microsoft365Defender.Incident.assignedTo
      description: Owner of the incident.
      type: String
    - contextPath: Microsoft365Defender.Incident.classification
      description: 'Specification of the incident. Possible values are: Unknown, FalsePositive, and TruePositive.'
      type: String
    - contextPath: Microsoft365Defender.Incident.determination
      description: 'The determination of the incident. Possible values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, and Other.'
      type: String
    - contextPath: Microsoft365Defender.Incident.status
      description: 'The current status of the incident. Possible values are: Active, Resolved, and Redirected.'
      type: String
    - contextPath: Microsoft365Defender.Incident.severity
      description: 'Severity of the incident. Possible values are: UnSpecified, Informational, Low, Medium, and High.'
      type: String
    - contextPath: Microsoft365Defender.Incident.alerts
      description: List of alerts relevant for the incidents.
      type: Unknown
    - contextPath: Microsoft365Defender.Incident.tags
      description: List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
    - contextPath: Microsoft365Defender.Incident.comments
      description: List of comments created by secops when managing the incident, for example additional information about the classification selection.
  - arguments:
    - auto: PREDEFINED
      description: Categorize incidents (as Active, Resolved, or Redirected).
      name: status
      predefined:
      - Active
      - Resolved
      - Redirected
      - InProgress
    - description: Owner of the incident.
      name: assigned_to
    - description: Incident's ID.
      name: id
      required: true
    - auto: PREDEFINED
      description: The specification for the incident.
      name: classification
      predefined:
      - Unknown
      - FalsePositive
      - TruePositive
      - InformationalExpectedActivity
    - description: 'Determination of the incident. Must be used with the classification field. Possible values depend on the classification field: TruePositive - MultiStagedAttack, MaliciousUserActivity, Malware, Phishing, CompromisedAccount, UnwantedSoftware, Other (default), InformationalExpectedActivity- SecurityTesting, LineOfBusinessApplication, ConfirmedActivity, Other (default), FalsePositive - NotMalicious, NoEnoughDataToValidate, Other (default), Unknown - NotAvailable.'
      name: determination
      auto: PREDEFINED
      predefined:
      - MultiStagedAttack
      - MaliciousUserActivity
      - Malware
      - Phishing
      - CompromisedAccount
      - UnwantedSoftware
      - Other
      - SecurityTesting
      - LineOfBusinessApplication
      - ConfirmedActivity
      - NotMalicious
      - NoEnoughDataToValidate
      - NotAvailable
    - description: Comment to be added to the incident.
      name: comment
    - description: 'A comma-separated list of custom tags associated with an incident. For example: tag1,tag2,tag3.'
      isArray: true
      name: tags
    - defaultValue: '30'
      description: The time limit in seconds for the http request to run.
      name: timeout
    description: Update the incident with the given ID.
    name: microsoft-365-defender-incident-update
    outputs:
    - contextPath: Microsoft365Defender.Incident.incidentId
      description: Incident's ID.
      type: Number
    - contextPath: Microsoft365Defender.Incident.redirectIncidentId
      description: Only populated in case an incident is grouped together with another incident, as part of the incident processing logic.
      type: Unknown
    - contextPath: Microsoft365Defender.Incident.incidentName
      description: The name of the incident.
      type: String
    - contextPath: Microsoft365Defender.Incident.createdTime
      description: The date and time (in UTC) the incident was created.
      type: Date
    - contextPath: Microsoft365Defender.Incident.lastUpdateTime
      description: The date and time (in UTC) the incident was last updated.
      type: Date
    - contextPath: Microsoft365Defender.Incident.assignedTo
      description: Owner of the incident.
      type: String
    - contextPath: Microsoft365Defender.Incident.classification
      description: 'Specification of the incident. Possible values are: Unknown, FalsePositive, and TruePositive.'
      type: String
    - contextPath: Microsoft365Defender.Incident.determination
      description: 'The determination of the incident. Possible values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, and Other.'
      type: String
    - contextPath: Microsoft365Defender.Incident.severity
      description: 'Severity of the incident. Possible values are: UnSpecified, Informational, Low, Medium, and High.'
      type: String
    - contextPath: Microsoft365Defender.Incident.status
      description: 'The current status of the incident. Possible values are: Active, Resolved, and Redirected.'
      type: String
    - contextPath: Microsoft365Defender.Incident.alerts
      description: List of alerts relevant for the incidents.
      type: Unknown
    - contextPath: Microsoft365Defender.Incident.tags
      description: List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
    - contextPath: Microsoft365Defender.Incident.comments
      description: List of comments created by secops when managing the incident, for example additional information about the classification selection.
  - arguments:
    - description: Advanced hunting query.
      name: query
      required: true
    - defaultValue: '30'
      description: The time limit in seconds for the http request to run.
      name: timeout
    - defaultValue: '50'
      description: Number of entries.  Enter -1 for unlimited query.
      name: limit
      required: true
    description: 'Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft 365 Defender. Details on how to write queries: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-language?view=o365-worldwide.'
    name: microsoft-365-defender-advanced-hunting
    outputs:
    - contextPath: Microsoft365Defender.Hunt.query
      description: The query used, also acted as a key.
      type: String
    - contextPath: Microsoft365Defender.Hunt.results
      description: The results of the query.
      type: Unknown
  - arguments:
    - description: Incident's ID.
      name: id
      required: true
    - defaultValue: '30'
      description: The time limit in seconds for the http request to run.
      name: timeout
    description: Gets the incident with the given ID.
    name: microsoft-365-defender-incident-get
    outputs:
    - contextPath: Microsoft365Defender.Incident.incidentId
      description: Incident's ID.
      type: number
    - contextPath: Microsoft365Defender.Incident.redirectIncidentId
      description: Only populated in case an incident is grouped together with another incident, as part of the incident processing logic.
    - contextPath: Microsoft365Defender.Incident.incidentName
      description: The name of the incident.
      type: string
    - contextPath: Microsoft365Defender.Incident.createdTime
      description: The date and time (in UTC) the incident was created.
      type: date
    - contextPath: Microsoft365Defender.Incident.tags
      description: List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
    - contextPath: Microsoft365Defender.Incident.lastUpdateTime
      description: The date and time (in UTC) the incident was last updated.
      type: date
    - contextPath: Microsoft365Defender.Incident.assignedTo
      description: 'Owner of the incident.'
      type: string
    - contextPath: Microsoft365Defender.Incident.classification
      description: 'Specification of the incident. Possible values are: Unknown, FalsePositive, and TruePositive.'
      type: string
    - contextPath: Microsoft365Defender.Incident.determination
      description: 'The determination of the incident. Possible values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, and Other.'
      type: string
    - contextPath: Microsoft365Defender.Incident.severity
      description: 'Severity of the incident. Possible values are: UnSpecified, Informational, Low, Medium, and High.'
      type: string
    - contextPath: Microsoft365Defender.Incident.status
      description: 'The current status of the incident. Possible values are: Active, Resolved, and Redirected.'
      type: string
    - contextPath: Microsoft365Defender.Incident.alerts
      description: List of alerts relevant for the incidents.
    - contextPath: Microsoft365Defender.Incident.tags
      description: List of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
    - contextPath: Microsoft365Defender.Incident.comments
      description: List of comments created by secops when managing the incident, for example additional information about the classification selection.
  - arguments:
    - default: false
      description: Date string representing the local time. The incident is only returned if it was modified after the last update time.
      isArray: false
      name: lastUpdate
      required: false
      secret: false
    deprecated: false
    description: Get the list of incidents that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.
    execution: false
    name: get-modified-remote-data
  - arguments:
    - default: false
      description: The remote incident ID.
      isArray: false
      name: id
      required: true
      secret: false
    - default: false
      defaultValue: '0'
      description: The UTC timestamp in seconds of the last update. The incident is only updated if it was modified after the last update time.
      isArray: false
      name: lastUpdate
      required: false
      secret: false
    deprecated: false
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
    execution: false
    name: get-remote-data
  - arguments: []
    deprecated: false
    description: Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
    execution: false
    name: get-mapping-fields
  - arguments: []
    deprecated: false
    description: Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.
    execution: false
    name: update-remote-system
  dockerimage: demisto/crypto:1.0.0.10120494
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: ''
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- No tests
defaultmapperin: Microsoft 365 Defender - Incoming Mapper
defaultmapperout: Microsoft 365 Defender - Outgoing Mapper