category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft 365 Defender Event Collector
  version: -1
configuration:
- additionalinfo: |-
    When selecting the Custom option, the Server URL parameter must be filled. More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender-event-collector
  defaultvalue: Worldwide
  display: Endpoint Type
  name: endpoint_type
  type: 15
  section: Connect
  options:
  - Worldwide
  - EU Geo Proximity
  - UK Geo Proximity
  - US Geo Proximity
  - US GCC
  - US GCC-High
  - DoD
  - Custom
  advanced: true
  required: false
- display: Tenant ID
  name: tenant_id
  required: true
  type: 0
  section: Connect
  advanced: false
- name: client_id
  required: true
  type: 0
  section: Connect
  additionalinfo: The Client (Application) ID to use to connect.
  display: Client (Application) ID
- name: credentials
  required: true
  type: 9
  section: Connect
  displaypassword: Client Secret
  hiddenusername: true
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: '30'
  additionalinfo: The time limit in seconds for fetch alerts to run. Leave this empty to cancel the timeout limit.
  display: Fetch alerts timeout
  name: fetch_timeout
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: '1000'
  display: Number of alerts for each fetch.
  name: limit
  type: 0
  additionalinfo: Due to API limitations, the maximum is 10,000.
  section: Collect
  required: false
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Server URL (e.g., https://api.securitycenter.microsoft.com)
  name: url
  type: 0
  section: Connect
  advanced: true
  additionalinfo: |-
    More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender-event-collector
  required: false
- display: Verify SSL Certificate
  name: verify
  type: 8
  section: Connect
  advanced: true
  defaultvalue: 'true'
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Deprecated. Use 'Office 365' in the XSIAM Data Sources instead.
display: Microsoft Defender for Endpoint Alerts (Deprecated)
name: Microsoft 365 Defender Event Collector
script:
  commands:
  - description: Returns a list of alerts.
    name: microsoft-365-defender-get-events
    arguments:
    - description: The maximum number of alerts per fetch.
      defaultValue: '1000'
      isArray: true
      name: limit
    - description: The first fetch time (<number> <time unit>, for example 12 hours, 1 day, 3 months).
      defaultValue: 3 days
      isArray: true
      name: first_fetch
    - auto: PREDEFINED
      default: true
      defaultValue: 'false'
      description: Whether to push the fetched event to XSIAM or not.
      name: push_to_xsiam
      predefined:
      - 'false'
      - 'true'
    deprecated: true
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: microsoft-365-defender-auth-reset
    arguments: []
    deprecated: true
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/auth-utils:1.0.0.116752
fromversion: 6.8.0
marketplaces:
- marketplacev2
tests:
- No tests (deprecated)
deprecated: true
supportedModules:
- xsiam