feat(microsoft-defender-endpoint): new Defender for Endpoint integration

22 commands (Security Center API): alert ingestion + triage, machine
isolate/unisolate, restrict/unrestrict app execution, AV scan, stop &
quarantine file, collect investigation package, offboard, tag, list
machine actions, advanced hunting (KQL), and custom indicators. Azure
AD OAuth 2.0 client-credentials, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

integrations/microsoft-defender-endpoint/scripts/advanced_hunting.py

@@ -0,0 +1,62 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    query = inputs.get("query")
+    if not query:
+        raise Exception("query is required")
+    body = {"Query": query}
+    result = request("POST", "/advancedqueries/run", body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/collect_investigation_package.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Collect package via Riposte"}
+    path = "/machines/" + urllib.parse.quote(str(machine_id), safe="") + "/collectInvestigationPackage"
+    result = request("POST", path, body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/create_indicator.py

@@ -0,0 +1,81 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    indicator_value = inputs.get("indicator_value")
+    if not indicator_value:
+        raise Exception("indicator_value is required")
+    indicator_type = inputs.get("indicator_type")
+    if not indicator_type:
+        raise Exception("indicator_type is required")
+    action = inputs.get("action")
+    title = inputs.get("title")
+    description = inputs.get("description")
+    severity = inputs.get("severity")
+    expiration_time = inputs.get("expiration_time")
+
+    body = {}
+    body["indicatorValue"] = indicator_value
+    body["indicatorType"] = indicator_type
+    body["action"] = action or "Alert"
+    body["title"] = title or "Riposte indicator"
+    body["description"] = description or "Created via Riposte"
+    if severity not in (None, ""):
+        body["severity"] = severity
+    if expiration_time not in (None, ""):
+        body["expirationTime"] = expiration_time
+
+    result = request("POST", "/indicators", body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/delete_indicator.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    indicator_id = inputs.get("indicator_id")
+    if not indicator_id:
+        raise Exception("indicator_id is required")
+    path = "/indicators/" + urllib.parse.quote(str(indicator_id), safe="")
+    result = request("DELETE", path)
+    if not result:
+        result = {"ok": True, "indicator_id": indicator_id}
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_alert.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    alert_id = inputs.get("alert_id")
+    if not alert_id:
+        raise Exception("alert_id is required")
+    res = request("GET", "/alerts/" + quote(alert_id))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_incidents.py

@@ -0,0 +1,89 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+from datetime import datetime, timezone
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def _iso(s):
+    s = str(s)
+    if s.isdigit():
+        ts = int(s)
+        if ts > 10 ** 12:
+            ts = ts / 1000.0
+        return datetime.fromtimestamp(ts, tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    try:
+        return datetime.fromisoformat(s.replace("Z", "+00:00")).astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    except Exception:
+        return s
+
+
+def main():
+    status = inputs.get("status")
+    severity = inputs.get("severity")
+    created_after = inputs.get("created_after")
+    limit = inputs.get("limit") or 50
+
+    parts = []
+    if status:
+        parts.append("status eq '" + str(status) + "'")
+    if severity:
+        parts.append("severity eq '" + str(severity) + "'")
+    if created_after:
+        parts.append("alertCreationTime ge " + _iso(created_after))
+    filt = " and ".join(parts)
+
+    res = request("GET", "/alerts", params={"$filter": filt or None, "$top": limit, "$orderby": "alertCreationTime asc"})
+    print(json.dumps({"result": res.get("value", [])}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_machine.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    res = request("GET", "/machines/" + quote(machine_id))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_machine_by_ip.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+from datetime import datetime, timezone
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    ip = inputs.get("ip")
+    if not ip:
+        raise Exception("ip is required")
+    ts = inputs.get("timestamp") or datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    url = API + "/machines/findbyip(ip='" + str(ip) + "',timestamp=" + str(ts) + ")"
+    res = request("GET", "", full_url=url)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/isolate_machine.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    isolation_type = inputs.get("isolation_type")
+    body = {"Comment": comment or "Isolated via Riposte", "IsolationType": isolation_type or "Full"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/isolate", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_alerts.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    filt = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/alerts", params={"$filter": filt or None, "$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_indicators.py

@@ -0,0 +1,61 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filter_ = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    params = {"$filter": filter_ or None, "$top": limit}
+    result = request("GET", "/indicators", params=params)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_machine_actions.py

@@ -0,0 +1,61 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filter_ = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    params = {"$filter": filter_ or None, "$top": limit}
+    result = request("GET", "/machineactions", params=params)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_machines.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    filt = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/machines", params={"$filter": filt or None, "$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/offboard_machine.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Offboard via Riposte"}
+    path = "/machines/" + urllib.parse.quote(str(machine_id), safe="") + "/offboard"
+    result = request("POST", path, body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/remove_app_restriction.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Unrestricted via Riposte"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/unrestrictCodeExecution", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/restrict_app_execution.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Restricted via Riposte"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/restrictCodeExecution", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/run_antivirus_scan.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    scan_type = inputs.get("scan_type")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "AV scan via Riposte", "ScanType": scan_type or "Quick"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/runAntiVirusScan", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/stop_and_quarantine_file.py

@@ -0,0 +1,69 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    sha1 = inputs.get("sha1")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    if not sha1:
+        raise Exception("sha1 is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Quarantine via Riposte", "Sha1": sha1}
+    res = request("POST", "/machines/" + quote(machine_id) + "/StopAndQuarantineFile", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/tag_machine.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    tag = inputs.get("tag")
+    if not tag:
+        raise Exception("tag is required")
+    action = inputs.get("action")
+    body = {"Value": tag, "Action": action or "Add"}
+    path = "/machines/" + urllib.parse.quote(str(machine_id), safe="") + "/tags"
+    result = request("POST", path, body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/test_connection.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    res = request("GET", "/alerts", params={"$top": 1})
+    if "value" not in res:
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/unisolate_machine.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Released via Riposte"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/unisolate", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/update_alert.py

@@ -0,0 +1,79 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    alert_id = inputs.get("alert_id")
+    if not alert_id:
+        raise Exception("alert_id is required")
+
+    body = {}
+    if inputs.get("status"):
+        body["status"] = inputs.get("status")
+    if inputs.get("classification"):
+        body["classification"] = inputs.get("classification")
+    if inputs.get("determination"):
+        body["determination"] = inputs.get("determination")
+    if inputs.get("assigned_to"):
+        body["assignedTo"] = inputs.get("assigned_to")
+    if inputs.get("comment"):
+        body["comment"] = inputs.get("comment")
+    if not body:
+        raise Exception("nothing to update")
+
+    res = request("PATCH", "/alerts/" + quote(alert_id), body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)