SOC Microsoft Defender for Endpoint Integration Enhancement — Overview¶
| Field | Value |
|---|---|
| ID | SocFrameworkMicrosoftDefender |
| Version | 1.2.17 |
| Category | Endpoint |
| Pack Path | Packs/SocFrameworkMicrosoftDefender |
| Manifest | Packs/SocFrameworkMicrosoftDefender/xsoar_config.json |
Schemas¶
Reference documentation for the schemas this pack defines.
⚠️ This pack requires manual post-install steps. See Manual Steps below.
Manual Steps¶
Documented post-install steps required to finish configuration.
Custom Packs Installed¶
Additional custom packs the installer pulls in alongside this pack.
| Pack | System | Source |
|---|---|---|
SocFrameworkMicrosoftDefender.zip |
yes |
release |
Marketplace Dependencies¶
Marketplace packs the installer ensures are present on the tenant.
| ID | Name | Version |
|---|---|---|
MicrosoftDefenderAdvancedThreatProtection |
Microsoft Defender Advanced Threat Protection | latest |
Integration Instances¶
Integration brand instances the installer configures. Credentials and propagation labels are always tenant-specific — only the scaffolding ships in the pack.
| Instance Name | Brand | Category | Enabled |
|---|---|---|---|
Microsoft_Graph_Security_Alerts |
Microsoft Graph |
Endpoint | false |
Microsoft_Defender_ATP_Commands |
Microsoft Defender Advanced Threat Protection |
Endpoint | false |