Microsoft Defender for Endpoint Trigger icon

Microsoft Defender for Endpoint Trigger

Triggers workflows on Microsoft Defender for Endpoint events

Microsoft Defender for Endpoint Trigger

AI-generated

Summary

Poll Microsoft Defender for Endpoint for alerts created or updated since a specified lookback period, triggering the workflow when such events exist.

Inputs

  • Poll Times — Optional schedule settings to define when polling occurs. Choose from preset intervals (e.g., every minute, hour, day) or set a custom cron expression.
  • Authentication (required) — Choose the authentication method; currently only OAuth2 is supported.
  • Event Type (required) — Select which Microsoft Defender for Endpoint event type to trigger on: 'Alert Created' or 'Alert Updated'.
  • Lookup Data From Last ... (required) — Define how far back to look for new or updated alert data. Options include predefined intervals (e.g., 5, 15, 30 minutes, 1 hour) or a custom number of minutes when 'Custom' is selected.
  • Minutes — Specify the custom number of minutes to look back when 'Custom' is chosen for 'Lookup Data From Last ...'.

Output shape

a JSON array of alert objects retrieved from Microsoft Defender for Endpoint matching the selected event type and time filter

The operation polls Microsoft Defender for Endpoint's alerts API endpoint, filtering alerts by alertCreationTime or lastUpdateTime based on the chosen event type, returning all new or updated alerts found since the specified lookback interval. If no new alerts are found, it returns no data (null). Polling schedule is customizable but not required.

Links

Discussion