Connect Microsoft Defender for Endpoint

Imports security alerts, incidents, monitored machines, vulnerabilities, installed software, recommendations, and security scores from your Microsoft 365 Defender tenant.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• Active Microsoft Defender for Endpoint Plan 1 or Plan 2 license

• Access to the Azure portal with Global Administrator or Application Administrator role

Step 1 — Create an App Registration

1. Sign in to portal.azure.com

2. Search for App registrations → New registration

3. Fill in:

   • Name: HARVEN-Defender

   • Supported account types: Accounts in this organizational directory only

   • Redirect URI: leave blank

Click Register, then note the Application (client) ID and Directory (tenant) ID.

Step 2 — Configure API permissions

Collected data comes from three distinct APIs, each requiring its own permissions.

2a — WindowsDefenderATP API — API permissions → Add a permission → APIs my organization uses → WindowsDefenderATP → Application permissions

• Alert.Read.All — alerts, investigations

• Machine.Read.All — machines, machine_actions

• Vulnerability.Read.All — vulnerabilities

• Software.Read.All — software

• SecurityRecommendation.Read.All — recommendations

• File.Read.All — files

• Ti.Read.All — indicators

2b — Microsoft Threat Protection API — Add a permission → APIs my organization uses → Microsoft Threat Protection → Application permissions

• Incident.Read.All — incidents

2c — Microsoft Graph API — Add a permission → Microsoft Graph → Application permissions

• SecurityEvents.Read.All — secure_scores

⚠️ Click Grant admin consent to validate all permissions.

Step 3 — Create a Client Secret

1. Left menu: Certificates & secrets

2. Client secrets tab → New client secret

3. Enter a description and choose an expiration period

4. Click Add

5. Copy the value immediately — it is only shown once

Step 4 — Configure the connector in HARVEN

HARVEN → Workspace → Data Sources → Add → Microsoft Defender, then fill in the Tenant ID, Client ID, and Client Secret.

What to enter in HARVEN

• Tenant ID — Your Azure AD tenant identifier (App Registration → Directory (tenant) ID)

• Client ID — Application identifier (App Registration → Application (client) ID)

• Client Secret — Secret created in Step 3 (Certificates & secrets → Value)

What HARVEN reads

• alerts — Security alerts: identification (alert_id, title, severity, status, classification), context (description, category, threat_family_name, machine_id, mitre_techniques), tracking (created_datetime, last_update_datetime, assigned_to, detection_source), analysis (evidence_count, determination)

• incidents — Security incidents: identification (incident_id, display_name, severity, classification), tracking (status, created_datetime, last_update_datetime, assigned_to), detail (alert_count, tags)

• machines — Monitored machines: identification (machine_id, computer_dns_name, os_platform, os_version), posture (health_status, risk_score, exposure_level, onboarding_status), detail (ip_addresses, is_aad_joined, agent_version, defender_av_status, tags), activity (last_seen, first_seen)

• vulnerabilities — CVE vulnerabilities: identification (vulnerability_id, cve_id, name, severity, cvss_v3), exposure (exposed_machines, public_exploit, exploit_in_kit, published_on)

• software — Installed software: inventory (software_id, software_name, software_vendor, software_version), risk (weaknesses_count, exposed_machines, end_of_support_status)

• recommendations — Security recommendations: identification (recommendation_id, recommendation_name, recommendation_category), priority (severity, exposed_machines, impact_score, status, remediation_type)

• secure_scores — Security score: score (current_score, max_score, enabled_services), context (created_datetime, licensed_user_count, active_user_count)

• investigations — Automated investigations

• machine_actions — Remediation actions

• users — Defender user accounts

• device_health — Detailed agent health

• files — File hash reputation

• indicators — Threat indicators (IOC)

Official documentation

• Defender for Endpoint API

• App Registration for Defender

Need help? Contact [email protected].