ms:defender:vulnerability API input add

alexcybrill12 — Wed, 03 Apr 2024 16:35:15 GMT

Is it possible for the next version of the add-on to add MS defender vulnerabilty API calls to this add-on? Currently there is only "Microsoft defender for incident" and "Microsoft defender endpoint alert". We need another one add for "Microsoft Defender for Vulnerabilities" ---- Here's the API's below ---

Permissions needed
Collected data API call Permission needed

Machine info GET https://api.securitycenter.microsoft.com/api/machines Machine.Read.All
Full export of vulnerabilities GET https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilitiesExport Vulnerability.Read.All
Delta export of vulnerabilities GET https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilityChangesByMachine Vulnerability.Read.All
Description of vulnerabilities POST https://api.security.microsoft.com/api/advancedhunting/run AdvancedHunting.Read.All

https://github.com/thilles/TA-microsoft-365-defender-threat-vulnerability-add-on?tab=readme-ov-file#resources

Re: ms:defender:vulnerability API input add

richgalloway — Wed, 03 Apr 2024 16:40:19 GMT

Since that is a Splunk-supported add-on, you can request enhancements at https://ideas.splunk.com.

topic Re: ms:defender:vulnerability API input add in Getting Data In

ms:defender:vulnerability API input add

Re: ms:defender:vulnerability API input add