The "Poll for New Microsoft Defender for Endpoint Events for Cases" workflow template is designed to streamline case management by automatically retrieving new alerts from Microsoft Defender for Endpoint on a scheduled basis. This workflow establishes a checkpoint to ensure accurate tracking of alert times, maps alert fields to a predefined case layout, and creates a case for each new alert. It is ideal for businesses focused on Endpoint Detection and Response (EDR) and threat hunting, enhancing efficiency in incident response and case management.
Use Cases
Case Management , Endpoint Detection and Response (EDR) , Threat Hunting
Workflow Breakdown
Establish a checkpoint to mark accurate beginning and end times.
Pull new alerts from Microsoft Defender API.
Map alert fields to a predefined case layout.
Create a case for each new alert.
Vendors
Utils, Microsoft Defender for Endpoint, Torq, Torq Cases
Workflow Output
A case is created for each new alert.
Tips