Skip to main content

Workflow Template: Create Process Tree from Microsoft Defender XDR Endpoint Alert

Run multiple Threat Hunting Queries to collect data around an alert and build an HTML report with a process tree and related events.

Quickly investigate Microsoft Defender XDR endpoint alerts by auto-building a full process lineage and correlating evidence. The workflow queries process, network, file, and device events around the alert window, generates a rich HTML report with related alerts, and can auto-attach it to a Torq case for streamlined triage.

Take Me to the Template

Use Cases

Function , Threat Hunting

Workflow Breakdown

  1. Compute time window (before/after alert).

  2. Query DeviceProcessEvents, Alert Evidence, Network Events, File Events, Device Events, and Related Alerts.

  3. Build and clean process lineage tree using MSTICPy.

  4. Generate an HTML process tree report.

  5. Optionally attach the HTML report to a Torq case (if torq_case_id is provided).

Vendors

Scripting, Utils, Microsoft 365, Torq Cases

Related Articles
Did this answer your question?