Microsoft Defender XDR Trigger icon

Microsoft Defender XDR Trigger

Triggers workflows on Microsoft Defender XDR events

Microsoft Defender XDR Trigger

AI-generated

Summary

Poll Microsoft Defender XDR for new or updated incidents at configured intervals, triggering the workflow when matching events are found.

Inputs

  • Poll Times — Specify one or more schedules to regularly poll Microsoft Defender XDR for events, using presets like every minute, hour, day, week, month, or custom cron expressions.
  • Authentication (required) — Use OAuth2 credentials to authenticate the requests to Microsoft Defender XDR API.
  • Event Type (required) — Select whether to trigger on newly created incidents or updated incidents within Microsoft Defender XDR.
  • Lookup Data From Last ... (required) — Define the time window (e.g., 5 minutes, 15 minutes, 1 hour, or custom number of minutes) to look back for new or updated incidents in Microsoft Defender XDR.

Output shape

a list of incident objects from Microsoft Defender XDR matching the specified event type and time window

Polling returns an array of incident JSON objects under the main output when new data is found; if no new or updated incidents are present in the polling interval, the trigger returns null and does not activate the workflow.

Links

Discussion