Splunk SOAR

How to block outgoing traffic with the SOAR app for Microsoft Defender for Endpoint

1var
Engager

We're looking to block outgoing traffic from a specific client or group, using the Microsoft Defender for Endpoint-app.

If we were to implement this ourselves using the MS api, it would be something like:

POST https://api.securitycenter.microsoft.com/api/machines/{machineId}/restrict
Authorization: Bearer {your_access_token}
Content-Type: application/json
{
"action": "Block",
"destination": "IP_ADDRESS_OR_DOMAIN",
"protocol": "TCP",
"port": "443"
}


However, I haven't been able to find a corresponding call in the app source code. Am I missing something, or isn't this currently supported?

Labels (1)
0 Karma
1 Solution

1var
Engager

It looks as if the app-functions "Submit indicator" will be able to solve this for us: 

{
  "indicatorValue": "9.9.9.9",
  "indicatorType": "IpAddress",
  "action": "Block",
  "title": "Block outbound traffic to 9.9.9.9",
  "description": "Referanse: JIRA-XYZ",
  "generateAlert": true
}

View solution in original post

0 Karma

1var
Engager

It looks as if the app-functions "Submit indicator" will be able to solve this for us: 

{
  "indicatorValue": "9.9.9.9",
  "indicatorType": "IpAddress",
  "action": "Block",
  "title": "Block outbound traffic to 9.9.9.9",
  "description": "Referanse: JIRA-XYZ",
  "generateAlert": true
}
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...