The Microsoft Defender XDR Incidents Input retrieves incidents formed based on the alerts generated by the services
and applications that comes under Microsoft's unified Extended Detection and Response (XDR) platform.
Sync Type: Incremental
Overview
Services and apps within the Microsoft Defender XDR suite create alerts when they detect a suspicious or malicious event or activity.
Because piecing the individual alerts together to gain insight into an attack can be challenging and time-consuming,
Microsoft Defender XDR automatically aggregates the alerts and their associated information into an incident.
This input connects to the Microsoft Graph Security API to fetch a list of incidents.
Supported Security Services
The input retrieves incidents formed based on the alerts generated from the following Microsoft Defender services:
Microsoft Defender for Endpoint - Endpoint detection and response alerts from workstations, servers, and mobile devices
Microsoft Defender for Cloud - Cloud security posture management and threat protection alerts from Azure, AWS, and GCP resources
Microsoft Defender for Identity - Identity-based threats and suspicious activities targeting Active Directory environments
Microsoft Defender for Office 365 - Email and collaboration threats including phishing, malware, and safe attachments/links
Microsoft Defender for Cloud Apps - Cloud application security alerts and anomalous user behavior detection
Associated Alerts
Each incident record has an array of alerts associated with it.
Prerequisites
Have a Microsoft Account with an active Azure Subscription.
Register a new Application in App Registrations in Azure Entra ID portal.
Make sure this new application has the following permissions -
Microsoft Graph -
SecurityIncident.Read.All
SecurityIncident.ReadWrite.All
Minimum role assignment: Reader role on the subscription or resource group scope.
