---
title: "Microsoft Defender for Endpoint"
description: "Reference for the Tracecat Microsoft Defender for Endpoint integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Create machine action

Action ID: `tools.microsoft_defender_endpoint.create_machine_action`

Submit a machine action (for example, isolate or run an antivirus scan) in Microsoft Defender for Endpoint.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/machineaction](https://learn.microsoft.com/en-us/defender-endpoint/api/machineaction)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="action_type" type="string" required>

Type of machine action to perform.

Allowed values: `Isolate`, `Unisolate`, `CollectInvestigationPackage`, `RunAntivirusScan`, `RestrictCodeExecution`, `UnrestrictCodeExecution`, `StopAndQuarantineFile`, `LiveResponse`, `Offboard`, `RequestSample`.

</ParamField>

<ParamField path="comment" type="string" required>

Comment describing why the action is being taken.

</ParamField>

<ParamField path="machine_id" type="string" required>

Machine ID to target with the action.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="parameters" type="object | null">

Optional action parameters payload (for example, &#123;"scanType": "Quick"&#125; for RunAntivirusScan).

Default: `null`.

</ParamField>

## Create or update indicator

Action ID: `tools.microsoft_defender_endpoint.create_or_update_indicator`

Create or update a Microsoft Defender for Endpoint custom indicator of compromise.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/post-ti-indicator](https://learn.microsoft.com/en-us/defender-endpoint/api/post-ti-indicator)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="action" type="string" required>

Enforcement action for the indicator.

Allowed values: `Alert`, `Warn`, `Block`, `Audit`, `BlockAndRemediate`, `AlertAndBlock`, `Allowed`.

</ParamField>

<ParamField path="description" type="string" required>

Indicator description.

</ParamField>

<ParamField path="indicator_type" type="string" required>

Indicator type.

Allowed values: `FileSha1`, `FileSha256`, `FileMd5`, `CertificateThumbprint`, `IpAddress`, `DomainName`, `Url`.

</ParamField>

<ParamField path="indicator_value" type="string" required>

Indicator value (for example, SHA1 hash, domain, URL, or IP address).

</ParamField>

<ParamField path="title" type="string" required>

Indicator alert title.

</ParamField>

<ParamField path="application" type="string | null">

Friendly application name to display in end-user notifications.

Default: `null`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="expiration_time" type="string | null">

Optional ISO 8601 timestamp when the indicator expires (for example, 2025-12-31T00:00:00Z).

Default: `null`.

</ParamField>

<ParamField path="generate_alert" type="boolean | null">

Whether Defender should generate an alert when the indicator matches.

Default: `null`.

</ParamField>

<ParamField path="rbac_group_names" type="array[string] | null">

Optional list of RBAC device group names that the indicator applies to.

Default: `null`.

</ParamField>

<ParamField path="recommended_actions" type="string | null">

Recommended remediation steps to include with the indicator.

Default: `null`.

</ParamField>

<ParamField path="severity" type="string | null">

Optional severity to associate with the indicator.

Default: `null`.

</ParamField>

## Get alert

Action ID: `tools.microsoft_defender_endpoint.get_alert`

Retrieve a Microsoft Defender for Endpoint alert by ID.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/get-alert-info-by-id](https://learn.microsoft.com/en-us/defender-endpoint/api/get-alert-info-by-id)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="alert_id" type="string" required>

Alert ID to retrieve.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

## Get file from machine

Action ID: `tools.microsoft_defender_endpoint.get_file_from_machine`

Request a file from a device using Microsoft Defender Live Response.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response](https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="file_path" type="string" required>

Absolute file path on the device (escape backslashes, for example C:\\\\Windows\\\\Temp\\\\sample.txt).

</ParamField>

<ParamField path="machine_id" type="string" required>

Machine ID to collect the file from.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="comment" type="string | null">

Comment describing the Live Response action.

Default: `null`.

</ParamField>

## Get incident

Action ID: `tools.microsoft_defender_endpoint.get_incident`

Retrieve a Microsoft Defender for Endpoint incident by ID.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID to retrieve.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

## Get machine

Action ID: `tools.microsoft_defender_endpoint.get_machine`

Retrieve detailed information about a device from Microsoft Defender for Endpoint.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/get-machine-by-id](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machine-by-id)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="machine_id" type="string" required>

Machine ID to retrieve, as returned by the alerts or incidents APIs.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

## Isolate machine

Action ID: `tools.microsoft_defender_endpoint.isolate_machine`

Isolate a device from the network using Microsoft Defender for Endpoint.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/isolate-machine](https://learn.microsoft.com/en-us/defender-endpoint/api/isolate-machine)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="comment" type="string" required>

Comment describing why the device is being isolated.

</ParamField>

<ParamField path="machine_id" type="string" required>

Machine ID to isolate.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="isolation_type" type="string">

Isolation scope to apply.

Default: `"Full"`.

Allowed values: `Full`, `Selective`, `UnManagedDevice`.

</ParamField>

## List alerts

Action ID: `tools.microsoft_defender_endpoint.list_alerts`

List Microsoft Defender for Endpoint alerts with optional filtering and time range.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/get-alerts](https://learn.microsoft.com/en-us/defender-endpoint/api/get-alerts)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="filter" type="string | null">

OData filter expression to apply (for example, status eq 'Active' and severity eq 'High').

Default: `null`.

</ParamField>

<ParamField path="order_by" type="string | null">

OData order by clause (for example, lastUpdateTime desc).

Default: `null`.

</ParamField>

<ParamField path="since_time" type="string | null">

ISO 8601 timestamp to restrict alerts updated after this time (convenience filter applied as lastUpdateTime ge).

Default: `null`.

</ParamField>

<ParamField path="top" type="integer | null">

Maximum number of alerts to return (maps to $top OData query option).

Default: `null`.

</ParamField>

## List incidents

Action ID: `tools.microsoft_defender_endpoint.list_incidents`

List Microsoft Defender for Endpoint incidents with optional OData filtering.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="filter" type="string | null">

OData filter expression to apply (for example, status eq 'Active' and severity eq 'High').

Default: `null`.

</ParamField>

<ParamField path="order_by" type="string | null">

OData order by clause (for example, lastUpdateTime desc).

Default: `null`.

</ParamField>

<ParamField path="top" type="integer | null">

Maximum number of incidents to return (maps to $top OData query option).

Default: `null`.

</ParamField>

## List indicators

Action ID: `tools.microsoft_defender_endpoint.list_indicators`

Retrieve Microsoft Defender for Endpoint indicators with optional OData filters.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/get-ti-indicators-collection](https://learn.microsoft.com/en-us/defender-endpoint/api/get-ti-indicators-collection)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="filter" type="string | null">

OData filter expression to apply (for example, action eq 'AlertAndBlock').

Default: `null`.

</ParamField>

<ParamField path="order_by" type="string | null">

OData order by clause (for example, creationTimeDateTimeUtc desc).

Default: `null`.

</ParamField>

<ParamField path="skip_token" type="string | null">

OData skip token to continue pagination.

Default: `null`.

</ParamField>

<ParamField path="top" type="integer | null">

Maximum number of indicators to return (maps to $top).

Default: `null`.

</ParamField>

## List machine actions

Action ID: `tools.microsoft_defender_endpoint.list_machine_actions`

List Microsoft Defender for Endpoint machine actions with optional filters.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/get-machineactions-collection](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machineactions-collection)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="filter" type="string | null">

OData filter expression to apply (for example, machineId eq 'deviceId').

Default: `null`.

</ParamField>

<ParamField path="order_by" type="string | null">

OData order by clause (for example, creationDateTimeUtc desc).

Default: `null`.

</ParamField>

<ParamField path="skip_token" type="string | null">

OData skip token to continue pagination.

Default: `null`.

</ParamField>

<ParamField path="top" type="integer | null">

Maximum number of machine actions to return (maps to $top).

Default: `null`.

</ParamField>

## List machines

Action ID: `tools.microsoft_defender_endpoint.list_machines`

List Microsoft Defender for Endpoint machines with optional filters.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="filter" type="string | null">

OData filter expression to apply (for example, healthStatus eq 'Active').

Default: `null`.

</ParamField>

<ParamField path="order_by" type="string | null">

OData order by clause (for example, lastSeen desc).

Default: `null`.

</ParamField>

<ParamField path="skip_token" type="string | null">

OData skip token to continue pagination.

Default: `null`.

</ParamField>

<ParamField path="top" type="integer | null">

Maximum number of machines to return (maps to $top).

Default: `null`.

</ParamField>

## Put file on machine

Action ID: `tools.microsoft_defender_endpoint.put_file_on_machine`

Copy a file from the Live Response library onto a device.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response](https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="file_name" type="string" required>

Name of the file in the Live Response library to push to the device.

</ParamField>

<ParamField path="machine_id" type="string" required>

Machine ID to receive the file.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="comment" type="string | null">

Comment describing why the file was delivered.

Default: `null`.

</ParamField>

## Release machine from isolation

Action ID: `tools.microsoft_defender_endpoint.unisolate_machine`

Release a device from network isolation in Microsoft Defender for Endpoint.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/unisolate-machine](https://learn.microsoft.com/en-us/defender-endpoint/api/unisolate-machine)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="comment" type="string" required>

Comment describing why the device is being released.

</ParamField>

<ParamField path="machine_id" type="string" required>

Machine ID to release from isolation.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

## Run advanced hunting query

Action ID: `tools.microsoft_defender_endpoint.run_advanced_hunting_query`

Execute a Microsoft Defender advanced hunting query across Defender for Endpoint data.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api](https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="query" type="string" required>

Kusto Query Language (KQL) query to run (for example, "DeviceNetworkEvents | take 25").

</ParamField>

<ParamField path="advanced_query_run_settings" type="object | null">

Optional AdvancedQueryRunSettings object (for example, &#123;"TimeoutInSeconds": 120&#125;).

Default: `null`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

## Run antivirus scan

Action ID: `tools.microsoft_defender_endpoint.run_antivirus_scan`

Trigger a Microsoft Defender Antivirus scan on a device.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/run-av-scan](https://learn.microsoft.com/en-us/defender-endpoint/api/run-av-scan)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="comment" type="string" required>

Comment describing why the scan was requested.

</ParamField>

<ParamField path="machine_id" type="string" required>

Machine ID to scan.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="scan_type" type="string">

Type of antivirus scan to perform.

Default: `"Quick"`.

Allowed values: `Quick`, `Full`.

</ParamField>

## Run live response

Action ID: `tools.microsoft_defender_endpoint.run_live_response`

Run a sequence of Live Response commands on a device in Microsoft Defender for Endpoint.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response](https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="commands" type="array[object]" required>

Ordered list of Live Response commands (each object requires at least a 'type' key and optional 'params' list of key/value objects).

</ParamField>

<ParamField path="machine_id" type="string" required>

Machine ID to target with Live Response commands.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="comment" type="string | null">

Comment describing the purpose of the Live Response session.

Default: `null`.

</ParamField>

## Run script on machine

Action ID: `tools.microsoft_defender_endpoint.run_script_on_machine`

Execute a script from the Live Response library on a device.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response](https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="machine_id" type="string" required>

Machine ID to target with the script.

</ParamField>

<ParamField path="script_name" type="string" required>

Name of the uploaded Live Response script to run.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="comment" type="string | null">

Comment describing the Live Response action.

Default: `null`.

</ParamField>

<ParamField path="script_arguments" type="string | null">

Optional arguments passed to the script (quoted as a single string).

Default: `null`.

</ParamField>

## Update alert

Action ID: `tools.microsoft_defender_endpoint.update_alert`

Update status, ownership, or classification details for a Microsoft Defender for Endpoint alert.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/update-alert](https://learn.microsoft.com/en-us/defender-endpoint/api/update-alert)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="alert_id" type="string" required>

Alert ID to update.

</ParamField>

<ParamField path="assigned_to" type="string | null">

User principal name (UPN) or email address to assign the alert to.

Default: `null`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="classification" type="string | null">

Updated alert classification.

Default: `null`.

</ParamField>

<ParamField path="comment" type="string | null">

Comment to append to the alert.

Default: `null`.

</ParamField>

<ParamField path="determination" type="string | null">

Determination that provides additional context for the classification (for example, Malware, SecurityTesting, NotMalicious).

Default: `null`.

</ParamField>

<ParamField path="status" type="string | null">

Updated alert status.

Default: `null`.

</ParamField>

## Update incident

Action ID: `tools.microsoft_defender_endpoint.update_incident`

Update classification, determination, or assignment details for a Microsoft Defender for Endpoint incident.

Reference: [https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list)

### Secrets

Optional secrets:

- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_USER_TOKEN`.
- `microsoft_defender_endpoint_oauth`: OAuth token `MICROSOFT_DEFENDER_ENDPOINT_SERVICE_TOKEN`.

### Input fields

<ParamField path="incident_id" type="string" required>

Incident ID to update.

</ParamField>

<ParamField path="assigned_to" type="string | null">

User principal name (UPN) or email to assign the incident to.

Default: `null`.

</ParamField>

<ParamField path="base_url" type="string">

Base URL for the Microsoft Defender for Endpoint API.

Default: `"https://api.securitycenter.microsoft.com"`.

Allowed values: `https://api.securitycenter.microsoft.com`, `https://api-gcc.securitycenter.microsoft.us`, `https://api-gov.securitycenter.microsoft.us`.

</ParamField>

<ParamField path="classification" type="string | null">

Classification to apply to the incident (for example, Unknown, TruePositive, FalsePositive, InformationalExpectedActivity).

Default: `null`.

</ParamField>

<ParamField path="comment" type="string | null">

Comment to add to the incident history.

Default: `null`.

</ParamField>

<ParamField path="determination" type="string | null">

Determination that provides additional context for the classification (for example, Unknown, Malware, SecurityTesting).

Default: `null`.

</ParamField>

<ParamField path="status" type="string | null">

Incident status (for example, Active, Resolved, InProgress, Redirected).

Default: `null`.

</ParamField>

<ParamField path="tags" type="array[string] | null">

Tags to associate with the incident.

Default: `null`.

</ParamField>
