Description
n8n-nodes-msdefender
This is an n8n community node. It lets you use Microsoft Defender in your n8n workflows.
Microsoft Defender is a comprehensive security solution that helps protect your devices and data from threats.
This node allows you to interact with the Microsoft Defender API to perform various security operations, such as managing devices, retrieving threat intelligence, and more.
n8n is a fair-code licensed workflow automation platform.
Installation
Operations
Credentials
Compatibility
Usage
Resources
Version history
Installation
Follow the installation guide in the n8n community nodes documentation.
Operations
- Advanced Query: Run advanced queries against Microsoft Defender.
- Alert: Manage and retrieve information about security alerts.
- Machine: Manage and retrieve information about devices.
- Exposure
- Machine Actions
- Vulnerability
- Client ID: The Application (client) ID from your Azure AD application.
- Client Secret: The client secret generated for your Azure AD application.
- Access Token URL: https://login.microsoftonline.com/
/oauth2/v2.0/token - n8n community nodes documentation
- 0.1.0 Initial release with Advanced Query and Machine operations.
– Get Many: Retrieve many alerts.
– Add Or Remove Tag For Machine
– Find By Tag
– Get Many: Retrieve many machines.
– Get Security Recommendations For Machine
– List Installed Software For Machine
– Get Current Exposure Score
– Get Exposure Score By Machine Groups.
– Isolate Machine
– Release Machine from Isolation
– List Machine Actions
– Offboard Machine
– Cancel Machine Action
– Run Antivirus Scan
– Get All Vulnerabilities
– Get Machines By CVE
– Get By Machine And Software
Credentials
To use this node, you need to set up an Entra ID (Azure AD) application and obtain the necessary credentials to access the Microsoft Defender API.
1. Register an application in the Azure Portal.
2. Assign the required API permissions to the application for Microsoft Defender.
– Application permissions: AdvancedQuery.Read.All, Machine.ReadWrite.All, Score.Read.All, Machine.Isolate, Vulnerability.Read.All, SecurityRecommendation.Read.All, Machine.Scan, Machine.Offboard
3. Grant admin consent for the permissions.
4. Generate a client secret for the application.
5. Note down the Application (client) ID, Directory (tenant) ID, and client secret.
When configuring the Microsoft Defender node in n8n, use the following credentials:
Compatibility
This node is compatible with latest n8n versions.