Contents x
      Microsoft Defender 1.4.2
      • 03 Apr 2025
      • 3 Minutes to read
      • Dark
        Light
      • PDF
      Contents

      Microsoft Defender 1.4.2

      • Updated on 03 Apr 2025
      • 3 Minutes to read
      • Dark
        Light
      • PDF
      Article summary

      Microsoft Defender - 1.4.2

      tags: python | Microsoft Defender ATP | Enrichment

      Table of Contents

      Description

      Integration with Microsoft Defender ATP EDR is created to support CDC users by providing the enrichment consisting of details of host, user, hash, IP, Vulnerability; which enable CDC users to take an informed decision in incident response.

      Microsoft Defender ATP is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. It collects and visualizes comprehensive information about endpoint events, giving security professionals unparalleled visibility into IT environments.

      We use customized adaptive cards to display host, user, hash, IP, vulnerabilities related information in meaningful intuitive GUI, to facilitate easy understanding of data received from Microsoft Defender ATP.

      We have provided CLI commands to enrich basic host information, user information, hash, IP, Vulnerabilities information available on Microsoft Defender ATP. For complex queries - Investigation framework will be used.

      Integration Type:EPP/ EDR
      Information read:Host, User, File, IP, Vulnerability information
      API Supported:API V1.0
      Input:Device ID/ Device Name/ IP/ CVE ID/ Hash for enrichment.
      Output:Detailed enrichment consisting of host/user/IP/Hash/ Vulnerability information

      CDC Command Lines

      • block_indicator_cli
        CLI of the CDC to block an indicator entitiy.
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      indicator_valuestringIdentity of the Indicator entity.True
      • get_file_information_cli
        Command line interface of CDC to Retrieve a File by identifier Sha1, or Sha256. Note
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      file_hashstringSha1 or Sha256.True
      • get_ip_statistics_cli
        Command line interface of CDC for Retrieving the statistics for the given IP. Please Note
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      ipstringIp Address.True
      lookBackHoursintegerLook Back hours. Maximum Value for Look back hours is 720 Hours(30days).False
      • get_machine_by_id_cli
        Command line interface of CDC for retrieving specific Machine by its machine ID.
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      machine_idstringMachine id.True
      • get_machine_by_ip_cli
        Command line interface of CDC for finding Machines seen with the requested internal IP in the time range of 15 minutes prior and after a given timestamp. Please note
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      ipstringIp address to get machine details.True
      timestampstringTimestamp to get Machines within time range.True
      • get_user_related_machines_cli
        Command line interface of CDC for retrieving a collection of devices related to a given user ID. The input 'ID' is not the full UPN, but only the user name.
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      user_idstringUser id. The ID is not the full UPN, but only the user name.True
      • get_vulnerability_by_id_cli
        Command line interface of CDC for retrieving vulnerability information by its CVE ID.
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      cve_idstringCVE id.True
      • get_indicator_details_cli
        Retrieves indicator details.
      OptionTypeDescriptionRequired
      metadataobjectcommand metadataTrue
      indicator_valuestringIdentity of the Indicator entity.True

      Workflows

      • automate_alert_closing
        closing MS Defender alerts

      • block_indicator
        Block an indicator.

      • inject_ms_defender_alert_to_cdc
        Inject MS Defender ATP alert to cdc using cdc async api.

      • post_block_indicator
        Post update-indicator in CDC by ID of incident/message/chanel.

      • post_get_file_information
        Post get-file-information in CDC by ID of incident/message/chanel.

      • post_get_ip_statistics
        Post get-ip-statistics in CDC by ID of incident/message/chanel.

      • post_get_machine_by_id
        Post get-machine-by-id in CDC by ID of incident/message/chanel.

      • post_get_machine_by_ip
        Post get-machine-by-ip in CDC by ID of incident/message/chanel.

      • post_get_user_related_machines
        Post get-user-related-machines in CDC by ID of incident/message/chanel.

      • post_get_vulnerability_by_id
        Post get-vulnerability-by-id in CDC by ID of incident/message/chanel.

      • post_get_indicator_details
        Post get-indicator-details in CDC by ID of incident/message/chanel.

      Rules

      • close_cdc_alert_in_ms_defender
        Close Alerts in MS Defender

      • cdc_new_alert_from_ms_defender
        Triggers injections of a new alert to CDC workflow when created in Microsoft ATP Defender.

      Sensors

      • MsDefenderSensor
        Sensor to pull reported detections from Microsoft Defender ATP.

      Poll interval - 30s

      Triggers

      No triggers

      Known Issues

      No issues

      Was this article helpful?
      What's Next