Skip to main content
Microsoft Defender
Betav0.1.0
23 actions · 2 auth methods
Security

​
Getting Started

1

Create or Select a Project

Set up a new project or select an existing one. See Organizations & Projects.
2

Configure the Connector

Enable the connector and create a Connector Profile in your project. See Setup Connector Profile.

OAuth 2.0 · Connector Profile

Delegated access on behalf of a signed-in user, using an app registration in Microsoft Entra ID. The user also needs a M…

OAuth 2.0 (Client Credentials) · Connector Profile

App-only access without a signed-in user, using application permissions granted by an admin in Microsoft Entra ID. Canno…
3

Link an Account

Link an account from the dashboard (or via StackOne Hub).See the guide for the authentication type chosen in the Connector Profile:

OAuth 2.0 · Link Account

OAuth 2.0 (Client Credentials) · Link Account

4

Use Actions

Connect an AI platform to the linked account’s actions. See AI Platforms.Other ways to call actions are listed in Protocols & SDKs.

​
Actions

|
|
23 actions
Action
Description
Required scopes
List Alerts
List security alerts raised by Microsoft Defender and integrated providers.
Get Alert
Get a single security alert by its ID, including evidence and the policy that generated it.
Update Alert
Update an alert’s status, classification, determination, assignee or custom details.
Create Alert Comment
Add a comment to an existing security alert.
List Analyzed Emails
List emails analyzed by Microsoft Defender for Office 365 (Threat Explorer data) within a time window.
Get Analyzed Email
Get one email analyzed by Microsoft Defender for Office 365, including verdicts, policy actions, URLs and attachments.
Remediate Analyzed Emails
Remove a threat from users’ mailboxes by moving or deleting analyzed emails, or move false positives back to the inbox.
List Audit Log Queries
List unified audit log queries created in the tenant and their status.
Create Audit Log Query
Start an asynchronous search of the Microsoft 365 unified audit log.
Get Audit Log Query
Get an audit log query and its current status.
List Audit Log Records
List the audit log records returned by a completed audit log query.
List Email Threat Submissions
List emails reported to Microsoft Defender for Office 365 as spam, phishing, malware or false positives.
Get Email Threat Submission
Get a single email threat submission and its rescan result.
Create Email Threat Submission
Submit a suspected spam, phishing or malware email, or a false positive, to Microsoft Defender for Office 365.
Review Email Threat Submission
Record an administrator’s review verdict on a user-reported email threat submission.
Run Hunting Query
Run a Kusto (KQL) advanced hunting query over up to 30 days of Microsoft Defender data, including email events.
List Incidents
List Microsoft Defender incidents that correlate related alerts into a single attack story.
Get Incident
Get a single Microsoft Defender incident by its ID.
Update Incident
Update an incident’s status, assignee, classification, determination, severity or tags.
Create Incident Comment
Add a comment to an existing Microsoft Defender incident.
List Threat Assessment Requests
List threat assessment requests submitted to check how Microsoft’s scanning judges mail, files or URLs.
Get Threat Assessment Request
Get a threat assessment request, optionally expanding its policy check and rescan results.
Create Threat Assessment Request
Submit a mail message, email file, file or URL for Microsoft to assess and report the policy result.