Microsoft Defender APIInstall

Summary

Submit a new indicator to Microsoft Defender with specified attributes such as title, type, value, action, and optional parameters like severity and expiration date.

Inputs

• Title (required) — The title of the indicator to submit.
• Indicator Type (required) — The type of the indicator to submit, e.g., File Sha1, DomainName, IP Address.
• Indicator Value (required) — The value of the indicator to submit.
• Description (required) — An optional description for the indicator.
• Action (required) — The action to take for the indicator, such as Alert, Block, Allow, Warn, etc.
• Severity — Severity level for the indicator, with options Informational, Low, Medium, or High.
• Expiration Date — The expiration date of the indicator.

Output shape

a single record representing the created indicator

The API response includes the newly created indicator's details. Optional parameters are included in the request body if provided. The submission request uses OAuth2 authentication.

Links

• n8n community nodes installation guide