Connect your own Microsoft Defender for Endpoint tenant (Azure AD App Registration) to manage Machines, Alerts, Incidents, custom Indicators, Machine Actions (isolate/scan), Advanced Hunting queries, and Threat & Vulnerability Management.
Every capability exposed by Microsoft Defender for Endpoint, metered per action and guarded by the two-step safety protocol.
connect_defenderwriteConnect your own Microsoft Defender for Endpoint tenant by saving its Azure AD tenant/client credentials, after checking they actually work.
disconnect_defenderwriteDisconnect a Microsoft Defender for Endpoint tenant: deletes the saved Azure AD credentials. Nothing in Defender itself is changed.
list_connectionsreadList the connected Microsoft Defender for Endpoint tenants (tenant id + masked Client ID).
list_machinesreadList endpoints (machines) in the connected Defender for Endpoint tenant, optionally filtered by an OData $filter.
get_machinereadRead one endpoint (machine) in full by its Defender machine id.
isolate_machinewriteNetwork-isolate a machine -- cuts it off from the network except Defender cloud traffic (and optionally Outlook/Skype/Teams for 'Selective'). The core incident-response 'stop the bleeding' action.
unisolate_machinewriteRelease a machine from network isolation, restoring normal network access.
run_av_scanwriteTrigger a Windows Defender antivirus scan (Quick or Full) on a machine.
stop_and_quarantine_filewriteStop a running process and quarantine its file on a machine, by SHA1 hash. A destructive containment action for confirmed malicious files.
list_alertsreadList Alerts in the connected Defender for Endpoint tenant, optionally filtered by an OData $filter (e.g. "severity eq 'High'").
get_alertreadRead one Alert in full by its Defender alert id.
update_alertwriteUpdate an Alert's status, classification, determination, and/or assignment.
list_indicatorsreadList custom Indicators (IOCs) configured on the connected Defender for Endpoint tenant.
create_indicatorwriteCreate a custom Indicator (IOC) on the connected Defender for Endpoint tenant to flag or block a hash, IP, domain, or URL fleet-wide.
delete_indicatordestructiveDelete a custom Indicator (IOC) from the connected Defender for Endpoint tenant.
run_hunting_queryreadRun an Advanced Hunting KQL query against the connected Defender for Endpoint tenant (e.g. "DeviceProcessEvents | take 10"). Read-only investigation.
list_vulnerabilitiesreadList CVEs (Threat & Vulnerability Management) exposed across the fleet or on one machine.
audit_estatereadBuild one aggregated health report across the connected Defender for Endpoint tenant: machine counts by health/isolation state, open/high-severity alerts, and critical CVE exposure.
More extensions in Security ready to enable in one click.
Enable Microsoft Defender for Endpoint in your Imperal workspace in one click - 10,000 free starter credits included.