topic Re: MS 365 Defender Integration Error in Cortex XSOAR Discussions

MS 365 Defender Integration Error

MTubia — Wed, 11 Jan 2023 00:18:33 GMT

Hi,

I'm installing MS 365 Defender Addon using the guide (https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender), and the "Self-Deployed Application - Client Credentials Flow" method.

I have registered the app in Azure, and configured the addon with the App data (App Id, Secret, Tenant Id...) as in the guide.

When I execute the "!microsoft-365-defender-auth-start" command, I get an error:

I have tested different values in the fields, but the command always returns this error.

How can I debug this error? Any clue?

Thanks for your help!!

Regards,

Re: MS 365 Defender Integration Error

sramesh-7 — Wed, 18 Jan 2023 03:15:47 GMT

Hi ,

If its still not resolved, May be best to create a support case.

For debugging, change the log level in the integration as well as application level to debug mode and try running this a few time.

You can check to see if there more info in the logs or attach the logs in support case.

Re: MS 365 Defender Integration Error

EnesOzdemir — Wed, 18 Jan 2023 08:29:03 GMT

For client credential flow you don't have to run that command, the integration should be ready to pull incidents. AFAIK auth-start starts the device code flow

Re: MS 365 Defender Integration Error

EnesOzdemir — Wed, 18 Jan 2023 08:30:34 GMT

Also don't forget to check the box where it says self deployed in the integration configuration

Re: MS 365 Defender Integration Error

MTubia — Wed, 18 Jan 2023 08:51:37 GMT

mmmm may be this is the point, I'm testing.

Anyway, when executing the "microsoft-365-defender-advanced-hunting" command i get an error:

Invalid URL 'api-eu.security.microsoft.com/api/advancedhunting/run': No scheme supplied. Perhaps you meant http://api-eu.security.microsoft.com/api/advancedhunting/run?

Reading the doc (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-advanced-query-api?view=o365-worldwide), it says that the endpoint URL is "../api/advancedqueries/run", so I'm going to do some tests.

Thanks.

Regards.

Re: MS 365 Defender Integration Error

EnesOzdemir — Wed, 18 Jan 2023 09:17:28 GMT

That's for defender for endpoint. see https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-advanced-hunting?view=o365-worldwide

Re: MS 365 Defender Integration Error

MTubia — Wed, 18 Jan 2023 09:21:10 GMT

Really, I'm getting crazy with O365 APIs...

Thanks for your help, I go on with testing 🙂