Imports security alerts, incidents, monitored machines, vulnerabilities, installed software, recommendations, and security scores from your Microsoft 365 Defender tenant.
For the general flow of adding a source, see Connect Data Sources.
Before you start
Active Microsoft Defender for Endpoint Plan 1 or Plan 2 license
Access to the Azure portal with Global Administrator or Application Administrator role
Step 1 — Create an App Registration
Sign in to portal.azure.com
Search for App registrations → New registration
Fill in:
Name: HARVEN-Defender
Supported account types: Accounts in this organizational directory only
Redirect URI: leave blank
Click Register, then note the Application (client) ID and Directory (tenant) ID.
Step 2 — Configure API permissions
Collected data comes from three distinct APIs, each requiring its own permissions.
2a — WindowsDefenderATP API — API permissions → Add a permission → APIs my organization uses → WindowsDefenderATP → Application permissions
Alert.Read.All — alerts, investigations
Machine.Read.All — machines, machine_actions
Vulnerability.Read.All — vulnerabilities
Software.Read.All — software
SecurityRecommendation.Read.All — recommendations
File.Read.All — files
Ti.Read.All — indicators
2b — Microsoft Threat Protection API — Add a permission → APIs my organization uses → Microsoft Threat Protection → Application permissions
Incident.Read.All — incidents
2c — Microsoft Graph API — Add a permission → Microsoft Graph → Application permissions
SecurityEvents.Read.All — secure_scores
⚠️ Click Grant admin consent to validate all permissions.
Step 3 — Create a Client Secret
Left menu: Certificates & secrets
Client secrets tab → New client secret
Enter a description and choose an expiration period
Click Add
Copy the value immediately — it is only shown once
Step 4 — Configure the connector in HARVEN
HARVEN → Workspace → Data Sources → Add → Microsoft Defender, then fill in the Tenant ID, Client ID, and Client Secret.
What to enter in HARVEN
Tenant ID — Your Azure AD tenant identifier (App Registration → Directory (tenant) ID)
Client ID — Application identifier (App Registration → Application (client) ID)
Client Secret — Secret created in Step 3 (Certificates & secrets → Value)
What HARVEN reads
alerts — Security alerts: identification (alert_id, title, severity, status, classification), context (description, category, threat_family_name, machine_id, mitre_techniques), tracking (created_datetime, last_update_datetime, assigned_to, detection_source), analysis (evidence_count, determination)
incidents — Security incidents: identification (incident_id, display_name, severity, classification), tracking (status, created_datetime, last_update_datetime, assigned_to), detail (alert_count, tags)
machines — Monitored machines: identification (machine_id, computer_dns_name, os_platform, os_version), posture (health_status, risk_score, exposure_level, onboarding_status), detail (ip_addresses, is_aad_joined, agent_version, defender_av_status, tags), activity (last_seen, first_seen)
vulnerabilities — CVE vulnerabilities: identification (vulnerability_id, cve_id, name, severity, cvss_v3), exposure (exposed_machines, public_exploit, exploit_in_kit, published_on)
software — Installed software: inventory (software_id, software_name, software_vendor, software_version), risk (weaknesses_count, exposed_machines, end_of_support_status)
recommendations — Security recommendations: identification (recommendation_id, recommendation_name, recommendation_category), priority (severity, exposed_machines, impact_score, status, remediation_type)
secure_scores — Security score: score (current_score, max_score, enabled_services), context (created_datetime, licensed_user_count, active_user_count)
investigations — Automated investigations
machine_actions — Remediation actions
users — Defender user accounts
device_health — Detailed agent health
files — File hash reputation
indicators — Threat indicators (IOC)
Official documentation
Need help? Contact [email protected].
