MS 365 Defender Integration Error

[MTubia]

Hi,

I'm installing MS 365 Defender Addon using the guide (https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender), and the "Self-Deployed Application - Client Credentials Flow" method.

I have registered the app in Azure, and configured the addon with the App data (App Id, Secret, Tenant Id...) as in the guide.

When I execute the "!microsoft-365-defender-auth-start" command, I get an error:

I have tested different values in the fields, but the command always returns this error.

How can I debug this error? Any clue?

Thanks for your help!!

Regards,

M.

[sramesh-7]

Hi , 

If its still not resolved, May be best to create a support case. 

For debugging, change the log level in the integration as well as application level to debug mode and try running this a few time.

You can check to see if there more info in the logs or attach the logs in support case.

[EnesOzdemir]

For client credential flow you don't have to run that command, the integration should be ready to pull incidents. AFAIK auth-start starts the device code flow

[EnesOzdemir]

Also don't forget to check the box where it says self deployed in the integration configuration

[MTubia]

mmmm may be this is the point, I'm testing.

Anyway, when executing the "microsoft-365-defender-advanced-hunting" command i get an error:

Invalid URL 'api-eu.security.microsoft.com/api/advancedhunting/run': No scheme supplied. Perhaps you meant http://api-eu.security.microsoft.com/api/advancedhunting/run?

Reading the doc (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-advanced-query-api?vi...), it says that the endpoint URL is "../api/advancedqueries/run", so I'm going to do some tests.

Thanks.

Regards.

M.

[EnesOzdemir · Accepted solution]

That's for defender for endpoint. see https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-advanced-hunting?view=o365-wor...

[MTubia]

Really, I'm getting crazy with O365 APIs...

Thanks for your help, I go on with testing 🙂