Skip to content

Microsoft Defender XDR Incidents (Graph API)

Overview

  • Vendor: Microsoft
  • Supported environment: SaaS
  • Version compatibility:
  • Detection based on: Alert
  • Supported application or feature: Incident

Microsoft Defender XDR (formerly Microsoft 365 Defender) is a unified pre- and post-breach enterprise defense suite that coordinates detection, prevention, investigation, and response across endpoints, identities, email, and cloud applications.

This setup guide describes how to forward events produced by Microsoft Defender XDR Incidents (Graph API) to Sekoia.io XDR.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Microsoft Defender XDR event types supported

Here is a list of all the Microsoft Defender XDR event types supported by this integration:

  • Incident

Warning

This integration will only collect incidents. If you need to collect Alert and Alert Evidence, please use Microsoft Defender XDR (Graph API). If you need to collect additional Defender XDR event types, please use Microsoft Defender XDR (Microsoft 365 Defender).

Configure

Collect your Tenant ID from your Azure Portal (for more information read How to find your Microsoft Entra ID (Azure AD) tenant ID).

Create an Azure application

  1. On the Azure Portal, in the search bar, go to App registrations
  2. Click + New registration
  3. Type a name
  4. Select Accounts in this organizational directory only option as account type
  5. Click Register
  6. From the Overview page, copy Application (client) ID and Directory (tenant) ID

Create a client secret

  1. Go to Manage > Certificates & secrets
  2. Click + New client secret
  3. Type a description and select the desired expiration period
  4. Click Add
  5. Copy the Value of the client secret

Add permissions

  1. Go to Manage > API permissions
  2. Click Add a permission
  3. On the right panel, select Microsoft APIs tab
  4. Click Microsoft Graph
  5. Click Application permissions
  6. Select the permission: SecurityIncident.Read.All
  7. Click Add permissions
  8. In the API permissions page, click Grant admin consent for TENANT_NAME
  9. Click Yes in the Grant admin consent confirmation modal

Note

If you also plan to collect Microsoft Defender XDR alerts with the Microsoft Defender XDR (Graph API) intake, you can add SecurityAlert.Read.All to the same application.

Create an intake

Go to your Sekoia.io Intakes page, and follow these steps:

  1. Click + Intake button to create a new one
  2. Choose Microsoft Defender XDR Incidents (Graph API) [BETA], give it a name and choose the relevant Entity
  3. Edit the intake configuration:
    • Type the Application (client) ID in the client id field
    • Type the Directory (tenant) ID in the tenant id field
    • Type the Value of the client secret in the client secret field

Enjoy your events on the Events page

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

{
    "id": "29",
    "tenantId": "11111111-1111-1111-1111-111111111111",
    "status": "active",
    "incidentWebUrl": "https://security.microsoft.com/incident2/29/overview?tid=11111111-1111-1111-1111-111111111111",
    "redirectIncidentId": null,
    "displayName": "Multi-stage incident involving Execution & Command and control on one endpoint",
    "createdDateTime": "2026-01-22T12:09:23.1433333Z",
    "lastUpdateDateTime": "2026-02-25T16:29:33.1Z",
    "assignedTo": "admin@example.com",
    "classification": "truePositive",
    "determination": "multiStagedAttack",
    "severity": "high",
    "customTags": [
        "Demo"
    ],
    "systemTags": [],
    "description": "Microsoft observed Raspberry Robin worm activity spreading through infected USB devices on multiple endpoints in your environment.",
    "lastModifiedBy": "API-App:admin@example.com",
    "resolvingComment": null,
    "summary": "Defender Experts has identified malicious activity.",
    "priorityScore": 100,
    "comments": [],
    "alerts": [
        {
            "id": "da00000000-0000-0000-0000-000000000020_1",
            "providerAlertId": "00000000-0000-0000-0000-000000000020_1",
            "incidentId": "29",
            "status": "new",
            "severity": "medium",
            "serviceSource": "microsoftDefenderForEndpoint",
            "detectionSource": "microsoftDefenderForEndpoint",
            "tenantId": "11111111-1111-1111-1111-111111111111",
            "title": "A WMI event filter was bound to a suspicious event consumer",
            "createdDateTime": "2026-01-22T12:09:22.8566667Z",
            "lastUpdateDateTime": "2026-02-25T16:29:33.1Z",
            "category": "Persistence"
        }
    ]
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

No related built-in rules was found. This message is automatically generated.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Windows event logs Microsoft Defender for Endpoint watch events logs
Email gateway Microsoft Defender for O365 monitors emails
OAuth audit logs Microsoft Defender for Cloud App monitors users, entity behavior and activities
Authentication logs Microsoft Defender for Identity monitors users, entity behavior and activities

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind alert
Category threat
Type indicator

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "{\"id\": \"29\", \"tenantId\": \"11111111-1111-1111-1111-111111111111\", \"status\": \"active\", \"incidentWebUrl\": \"https://security.microsoft.com/incident2/29/overview?tid=11111111-1111-1111-1111-111111111111\", \"redirectIncidentId\": null, \"displayName\": \"Multi-stage incident involving Execution & Command and control on one endpoint\", \"createdDateTime\": \"2026-01-22T12:09:23.1433333Z\", \"lastUpdateDateTime\": \"2026-02-25T16:29:33.1Z\", \"assignedTo\": \"admin@example.com\", \"classification\": \"truePositive\", \"determination\": \"multiStagedAttack\", \"severity\": \"high\", \"customTags\": [\"Demo\"], \"systemTags\": [], \"description\": \"Microsoft observed Raspberry Robin worm activity spreading through infected USB devices on multiple endpoints in your environment.\", \"lastModifiedBy\": \"API-App:admin@example.com\", \"resolvingComment\": null, \"summary\": \"Defender Experts has identified malicious activity.\", \"priorityScore\": 100, \"comments\": [], \"alerts\": [{\"id\": \"da00000000-0000-0000-0000-000000000020_1\", \"providerAlertId\": \"00000000-0000-0000-0000-000000000020_1\", \"incidentId\": \"29\", \"status\": \"new\", \"severity\": \"medium\", \"serviceSource\": \"microsoftDefenderForEndpoint\", \"detectionSource\": \"microsoftDefenderForEndpoint\", \"tenantId\": \"11111111-1111-1111-1111-111111111111\", \"title\": \"A WMI event filter was bound to a suspicious event consumer\", \"createdDateTime\": \"2026-01-22T12:09:22.8566667Z\", \"lastUpdateDateTime\": \"2026-02-25T16:29:33.1Z\", \"category\": \"Persistence\"}]}",
    "event": {
        "category": [
            "threat"
        ],
        "dataset": "incident",
        "kind": "alert",
        "reason": "Multi-stage incident involving Execution & Command and control on one endpoint",
        "reference": "https://security.microsoft.com/incident2/29/overview?tid=11111111-1111-1111-1111-111111111111",
        "type": [
            "indicator"
        ]
    },
    "@timestamp": "2026-01-22T12:09:23.143333Z",
    "microsoft": {
        "defender": {
            "alert": {
                "classification": "truePositive",
                "determination": "multiStagedAttack",
                "severity": "high",
                "status": "active"
            },
            "incident": {
                "assignee": "admin@example.com",
                "id": "29",
                "name": "Multi-stage incident involving Execution & Command and control on one endpoint",
                "reference": "https://security.microsoft.com/incident2/29/overview?tid=11111111-1111-1111-1111-111111111111",
                "tags": [
                    "Demo"
                ]
            }
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
event.category keyword Event category. The second categorization field in the hierarchy.
event.dataset keyword Name of the dataset.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.reference keyword Event reference URL
event.type keyword Event type. The third categorization field in the hierarchy.
microsoft.defender.alert.classification keyword Specifies whether the alert represents a true threat
microsoft.defender.alert.determination keyword Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack
microsoft.defender.alert.severity keyword The severity of the alert
microsoft.defender.alert.status keyword The status of the alert
microsoft.defender.incident.assignee keyword User the incident is assigned to
microsoft.defender.incident.id keyword Unique identifier to represent the incident this alert resource is associated with
microsoft.defender.incident.name keyword Human-readable name of the incident
microsoft.defender.incident.redirect_incident_id keyword When the incident was merged into another one, the target incident id
microsoft.defender.incident.reference keyword URL for the incident page in the Microsoft 365 Defender portal
microsoft.defender.incident.tags array Tags attached to the incident

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.