f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(microsoft-defender-endpoint): new Defender for Endpoint integration

Browse Source 
22 commands (Security Center API): alert ingestion + triage, machine
isolate/unisolate, restrict/unrestrict app execution, AV scan, stop &
quarantine file, collect investigation package, offboard, tag, list
machine actions, advanced hunting (KQL), and custom indicators. Azure
AD OAuth 2.0 client-credentials, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-07-11 22:22:45 +02:00
parent 306581e70b
commit 811a85424b
25 changed files with 1763 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/microsoft-defender-endpoint/mappers/get_incidents.yaml
+21
View File
@@ -0,0 +1,21 @@
name: "Microsoft Defender Alerts → OCSF"
description: "Maps a Defender for Endpoint alert (get_incidents, results_path = result) to OCSF finding fields. Uses the first evidence entry for host/user/file where present."
field_mappings:
title: "title"
severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
description: "description"
ocsf:
- { source_path: "id", ocsf_field: "finding_info.uid" }
- { source_path: "title", ocsf_field: "finding_info.title" }
- { source_path: "description", ocsf_field: "finding_info.desc" }
- { source_path: "category", ocsf_field: "finding_info.analytic.category" }
- { source_path: "alertCreationTime", ocsf_field: "finding_info.created_time" }
- { source_path: "lastUpdateTime", ocsf_field: "finding_info.modified_time" }
- { source_path: "status", ocsf_field: "status" }
- { source_path: "determination", ocsf_field: "disposition" }
- { source_path: "detectionSource", ocsf_field: "finding_info.analytic.name" }
- { source_path: "threatFamilyName", ocsf_field: "malware.name" }
- { source_path: "computerDnsName", ocsf_field: "device.hostname" }
- { source_path: "machineId", ocsf_field: "device.uid" }
- { source_path: "assignedTo", ocsf_field: "assignee.name" }
- { source_path: "mitreTechniques[0]", ocsf_field: "attacks.technique.uid" }