The "Poll for New Microsoft Defender for Endpoint Events for Cases" workflow template is designed to enhance security operations by automating the process of case creation from Microsoft Defender alerts. It regularly retrieves new alerts from the Microsoft Defender API, maps alert fields to a predefined case layout, and generates a case for each alert. This workflow is ideal for businesses focused on efficient case management, endpoint detection and response (EDR), and threat hunting, ensuring timely and organized incident response.
Use Cases
Case Management , Endpoint Detection and Response (EDR) , Threat Hunting
Workflow Breakdown
Establish a checkpoint to mark accurate beginning and end times.
Pull new alerts from Microsoft Defender API.
Map alert fields to a predefined case layout.
Create a case for each new alert.
Vendors
Utils, Microsoft Defender for Endpoint, Torq, Torq Cases
Workflow Output
A case is created for each new alert.
Tips