Microsoft Defender SOC (Preview)
Trigger automated workflows based on Microsoft Defender and Sentinel events. Provides separate triggers for security alerts and for case management (generic and incident cases), delivering normalized event data to downstream workflows.
This connector is available in the following products and regions:
| Service | Class | Regions |
|---|---|---|
| Copilot Studio | Premium | All Power Automate regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
| Power Apps | Premium | All Power Apps regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
| Power Automate | Premium | All Power Automate regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
| Contact | |
|---|---|
| Name | Microsoft |
| URL | https://support.microsoft.com |
| Connector Metadata | |
|---|---|
| Publisher | Microsoft |
| Website | https://security.microsoft.com |
| Privacy policy | https://privacy.microsoft.com |
| Categories | Security |
Microsoft Defender SOC Connector
Use this connector to start Logic Apps workflows from Microsoft Defender and Microsoft Sentinel automation.
Available triggers
- Microsoft Defender SOC alert receives a normalized Microsoft Graph security alert payload.
- Microsoft Defender SOC case receives a normalized Microsoft Graph security case payload, including generic and incident case types.
The connector registers the trigger with Logic Apps. Microsoft Defender automation resolves the Logic App callback and sends the alert or case payload when the automation rule runs.
Authentication
The connector uses Microsoft Entra ID authentication. The identity creating the connection must be authorized for the Microsoft Defender or Microsoft Sentinel automation scenario that invokes the workflow.
Known limitations
The Logic Apps Run trigger button does not provide a Microsoft Defender alert or case payload. Test the workflow through Microsoft Defender automation or by resubmitting an existing Logic Apps run.
Creating a connection
The connector supports the following authentication types:
| Default | Parameters for creating connection. | All regions | Not shareable |
Default
Applicable: All regions
Parameters for creating connection.
This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.
Triggers
| Microsoft Defender SOC alert |
Triggers when a Microsoft Defender or Sentinel alert is created after automation rule evaluation or manual trigger from the Defender portal, providing normalized alert data to downstream workflows. |
| Microsoft Defender SOC case |
Triggers when a Microsoft Defender or Sentinel case is created or updated, providing normalized case data to downstream workflows. The concrete case type (generic or incident) is indicated by the '@odata.type' discriminator. |
Microsoft Defender SOC alert
Triggers when a Microsoft Defender or Sentinel alert is created after automation rule evaluation or manual trigger from the Defender portal, providing normalized alert data to downstream workflows.
Returns
Microsoft Graph Security Alert (microsoft.graph.security.alert) payload.
- Body
- GraphSecurityAlert
Microsoft Defender SOC case
Triggers when a Microsoft Defender or Sentinel case is created or updated, providing normalized case data to downstream workflows. The concrete case type (generic or incident) is indicated by the '@odata.type' discriminator.
Returns
Microsoft Graph security case (microsoft.graph.security.caseManagement.case) payload. The concrete case type is indicated by the '@odata.type' discriminator: genericCase or incidentCase. Subtype-specific properties are only populated for the matching case type.
- Body
- GraphSecurityCase
Definitions
GraphSecurityAlert
Microsoft Graph Security Alert (microsoft.graph.security.alert) payload.
| Name | Path | Type | Description |
|---|---|---|---|
|
id
|
id | string |
Unique identifier to represent the alert resource. |
|
providerAlertId
|
providerAlertId | string |
The ID of the alert as it appears in the security provider product that generated the alert. |
|
incidentId
|
incidentId | string |
Unique identifier to represent the incident this alert resource is associated with. |
|
tenantId
|
tenantId | string |
The Microsoft Entra tenant the alert was created in. |
|
title
|
title | string |
Brief identifying string value describing the alert. |
|
description
|
description | string |
String value describing each alert. |
|
severity
|
severity | string |
Indicates the possible impact on assets. Possible values include: unknown, informational, low, medium, high, unknownFutureValue. |
|
status
|
status | string |
The status of the alert. Possible values include: unknown, new, inProgress, resolved, unknownFutureValue. |
|
classification
|
classification | string |
Specifies whether the alert represents a true threat. Possible values include: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue. |
|
determination
|
determination | string |
Specifies the result of the investigation. Possible values include: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue. |
|
serviceSource
|
serviceSource | string |
The service or product that created this alert. Possible values include: unknown, microsoftDefenderForEndpoint, microsoftDefenderForIdentity, microsoftDefenderForCloudApps, microsoftDefenderForOffice365, microsoft365Defender, azureAdIdentityProtection, microsoftAppGovernance, dataLossPrevention, microsoftDefenderForCloud, microsoftSentinel, microsoftInsiderRiskManagement, microsoftDefenderForIoT, microsoftDefenderForServers, microsoftDefenderForStorage, microsoftDefenderForDNS, microsoftDefenderForDatabases, microsoftDefenderForContainers, microsoftDefenderForNetwork, microsoftDefenderForAppService, microsoftDefenderForKeyVault, microsoftDefenderForResourceManager, microsoftDefenderForApiManagement, aadIdentityProtection, appGovernance, microsoftPurviewDataLossPrevention, unknownFutureValue. |
|
detectionSource
|
detectionSource | string |
Detection technology or sensor that identified the notable component or activity. Possible values include: unknown, microsoftDefenderForEndpoint, antivirus, smartScreen, customTi, microsoftDefenderForOffice365, automatedInvestigation, microsoftThreatExperts, customDetection, microsoftDefenderForIdentity, cloudAppSecurity, microsoft365Defender, azureAdIdentityProtection, manual, microsoftDataLossPrevention, appGovernancePolicy, appGovernanceDetection, microsoftDefenderForCloud, microsoftDefenderForIoT, microsoftDefenderForServers, microsoftDefenderForStorage, microsoftDefenderForDNS, microsoftDefenderForDatabases, microsoftDefenderForContainers, microsoftDefenderForNetwork, microsoftDefenderForAppService, microsoftDefenderForKeyVault, microsoftDefenderForResourceManager, microsoftDefenderForApiManagement, microsoftSentinel, nrtAlerts, scheduledAlerts, microsoftDefenderThreatIntelligenceAnalytics, builtInMl, microsoftInsiderRiskManagement, unknownFutureValue. |
|
productName
|
productName | string |
The name of the product which published this alert. |
|
detectorId
|
detectorId | string |
The ID of the detector that triggered the alert. |
|
recommendedActions
|
recommendedActions | string |
Recommended response and remediation actions to take in the event this alert was generated. |
|
category
|
category | string |
(Deprecated) The attack kill-chain category that the alert belongs to. Use categories instead. |
|
categories
|
categories | array of string |
The attack kill-chain categories that the alert belongs to (MITRE ATT&CK aligned). |
|
assignedTo
|
assignedTo | string |
Owner of the alert, or null if no owner is assigned. |
|
alertWebUrl
|
alertWebUrl | string |
URL for the Microsoft 365 Defender portal alert page. |
|
incidentWebUrl
|
incidentWebUrl | string |
URL for the incident page in the Microsoft 365 Defender portal. |
|
actorDisplayName
|
actorDisplayName | string |
The adversary or activity group that is associated with this alert. |
|
threatDisplayName
|
threatDisplayName | string |
The threat associated with this alert. |
|
threatFamilyName
|
threatFamilyName | string |
Threat family associated with this alert. |
|
mitreTechniques
|
mitreTechniques | array of string |
The attack techniques, as aligned with the MITRE ATT&CK framework. |
|
createdDateTime
|
createdDateTime | date-time |
Time when Microsoft 365 Defender created the alert. |
|
lastUpdateDateTime
|
lastUpdateDateTime | date-time |
Time when the alert was last updated at Microsoft 365 Defender. |
|
resolvedDateTime
|
resolvedDateTime | date-time |
Time when the alert was resolved. |
|
firstActivityDateTime
|
firstActivityDateTime | date-time |
The earliest activity associated with the alert. |
|
lastActivityDateTime
|
lastActivityDateTime | date-time |
The oldest activity associated with the alert. |
|
comments
|
comments | array of GraphAlertComment |
Array of comments created by the SecOps team during the alert management process. |
|
customDetails
|
customDetails | GraphDictionary |
Key/value bag for dynamic fields (Graph security dictionary; also used for tenant-defined case custom fields keyed by identifier). |
|
evidence
|
evidence | array of GraphAlertEvidence |
Collection of evidence related to the alert. |
|
systemTags
|
systemTags | array of string |
The system tags associated with the alert. |
|
alertPolicyId
|
alertPolicyId | string |
The ID of the policy that generated the alert, and populated when there is a specific policy that generated the alert (customer configured or built-in). |
|
additionalData
|
additionalData | GraphDictionary |
Key/value bag for dynamic fields (Graph security dictionary; also used for tenant-defined case custom fields keyed by identifier). |
|
investigationState
|
investigationState | string |
Information on the current status of the investigation. Possible values include: unknown, terminated, successfullyRemediated, benign, failed, partiallyRemediated, running, pendingApproval, pendingResource, queued, innerFailure, preexistingAlert, unsupportedOs, unsupportedAlertType, suppressedAlert, partiallyInvestigated, terminatedByUser, terminatedBySystem, unknownFutureValue. |
GraphDictionary
Key/value bag for dynamic fields (Graph security dictionary; also used for tenant-defined case custom fields keyed by identifier).
| Name | Path | Type | Description |
|---|---|---|---|
|
|
object |
Key/value bag for dynamic fields (Graph security dictionary; also used for tenant-defined case custom fields keyed by identifier). |
GraphAlertComment
A comment created by the SecOps team during the alert management process.
| Name | Path | Type | Description |
|---|---|---|---|
|
comment
|
comment | string |
The comment text. |
|
createdByDisplayName
|
createdByDisplayName | string |
The display name of the user who created the comment. |
|
createdDateTime
|
createdDateTime | date-time |
Time when the comment was created. |
GraphAlertEvidence
An evidence item associated with the alert. The concrete evidence type is indicated by the "@odata.type" discriminator (e.g. #microsoft.graph.security.deviceEvidence, #microsoft.graph.security.userEvidence, etc.).
| Name | Path | Type | Description |
|---|---|---|---|
|
@odata.type
|
@odata.type | string |
The concrete evidence type discriminator (e.g. "#microsoft.graph.security.deviceEvidence"). |
|
createdDateTime
|
createdDateTime | date-time |
The time the evidence was created and added to the alert. |
|
verdict
|
verdict | string |
The decision reached by automated investigation. Possible values include: unknown, suspicious, malicious, noThreatsFound, unknownFutureValue. |
|
remediationStatus
|
remediationStatus | string |
Status of the remediation action taken. Possible values include: none, remediated, prevented, blocked, notFound, active, pendingApproval, declined, notRemediated, running, partiallyRemediated, unknownFutureValue. |
|
remediationStatusDetails
|
remediationStatusDetails | string |
Details about the remediation status. |
|
roles
|
roles | array of string |
The role(s) that the evidence plays in the alert. Possible item values include: unknown, contextual, scanned, source, destination, created, added, compromised, edited, attacked, attacker, loaded, suspicious, policyViolator, unknownFutureValue. |
|
detailedRoles
|
detailedRoles | array of string |
Detailed roles played by the evidence in the alert. |
|
tags
|
tags | array of string |
Tags associated with the evidence. |
GraphSecurityCase
Microsoft Graph security case (microsoft.graph.security.caseManagement.case) payload. The concrete case type is indicated by the '@odata.type' discriminator: genericCase or incidentCase. Subtype-specific properties are only populated for the matching case type.
| Name | Path | Type | Description |
|---|---|---|---|
|
@odata.type
|
@odata.type | string |
The concrete case type discriminator (e.g. '#microsoft.graph.security.caseManagement.incidentCase'). |
|
id
|
id | string |
Unique identifier of the case. |
|
displayName
|
displayName | string |
Case title. |
|
status
|
status | string |
Current lifecycle status of the case. |
|
createdDateTime
|
createdDateTime | date-time |
Time when the case was created. |
|
createdBy
|
createdBy | string |
Identity that created the case. |
|
lastModifiedDateTime
|
lastModifiedDateTime | date-time |
Time when the case was last modified. |
|
lastModifiedBy
|
lastModifiedBy | string |
Identity that last modified the case. |
|
customFields
|
customFields | GraphDictionary |
Key/value bag for dynamic fields (Graph security dictionary; also used for tenant-defined case custom fields keyed by identifier). |
|
description
|
description | string |
Case description (genericCase). |
|
assignedTo
|
assignedTo | string |
Owner of the case. |
|
priority
|
priority | string |
Case priority classification (genericCase). |
|
dueDateTime
|
dueDateTime | date-time |
Target completion date. |
|
closingNotes
|
closingNotes | string |
Notes recorded upon closure (genericCase). |
|
emailNotificationRecipients
|
emailNotificationRecipients | array of string |
Email notification recipients (incidentCase). |
|
incidentId
|
incidentId | integer |
Microsoft Security incident identifier (incidentCase). |
|
classification
|
classification | string |
Incident classification (incidentCase). |
|
determination
|
determination | string |
Incident determination (incidentCase). |
|
severity
|
severity | string |
Incident severity (incidentCase). |
|
summary
|
summary | string |
Incident summary (incidentCase). |
|
priorityScore
|
priorityScore | integer |
Incident priority score (incidentCase). |
|
firstEventTime
|
firstEventTime | date-time |
First event timestamp (incidentCase). |
|
lastEventTime
|
lastEventTime | date-time |
Last event timestamp (incidentCase). |
|
alertCounts
|
alertCounts | CaseAlertCounts |
Aggregated alert counts for an incident case. |
|
impactedAssets
|
impactedAssets | CaseImpactedAssetsCounts |
Aggregated impacted asset counts for an incident case. |
|
investigation
|
investigation | CaseInvestigation |
Investigation summary for an incident case. |
|
topRiskScore
|
topRiskScore | integer |
Top risk score (incidentCase). |
|
detectionSources
|
detectionSources | array of string |
Detection sources (incidentCase). |
|
serviceSources
|
serviceSources | array of string |
Service sources (incidentCase). |
|
productNames
|
productNames | array of string |
Product names (incidentCase). |
|
categories
|
categories | array of string |
Incident categories (incidentCase). |
|
workspaceIds
|
workspaceIds | array of string |
Workspace identifiers (incidentCase). |
|
policyNames
|
policyNames | array of string |
Policy names (incidentCase). |
|
alertPolicyIds
|
alertPolicyIds | array of string |
Alert policy identifiers (incidentCase). |
|
dataSensitivityLabels
|
dataSensitivityLabels | array of string |
Data sensitivity labels (incidentCase). |
|
cloudScopes
|
cloudScopes | array of string |
Cloud scopes (incidentCase). |
|
dataStreams
|
dataStreams | array of string |
Data streams (incidentCase). |
|
aiAgentIds
|
aiAgentIds | array of string |
AI agent identifiers (incidentCase). |
|
redirectIncidentId
|
redirectIncidentId | integer |
Redirect incident identifier when merged (incidentCase). |
|
redirectCaseId
|
redirectCaseId | integer |
Redirect case identifier when merged (incidentCase). |
|
investigationIds
|
investigationIds | array of string |
Investigation identifiers (incidentCase). |
|
investigationStates
|
investigationStates | array of string |
Investigation states (incidentCase). |
|
associatedThreatIds
|
associatedThreatIds | array of string |
Associated threat identifiers (incidentCase). |
|
osPlatforms
|
osPlatforms | array of string |
Operating system platforms (incidentCase). |
|
machineGroupIds
|
machineGroupIds | array of string |
Machine group identifiers (incidentCase). |
|
incidentWebUrl
|
incidentWebUrl | string |
Incident web URL (incidentCase). |
|
systemTags
|
systemTags | array of string |
System tags (incidentCase). |
|
relations
|
relations | array of CaseRelation |
Collection of related resources linked to the case. |
|
tasks
|
tasks | array of CaseTask |
Collection of tasks contained in the case. |
|
activities
|
activities | array of CaseActivity |
Collection of timeline activities (comments and audit logs) contained in the case. |
|
attachments
|
attachments | array of CaseAttachment |
Collection of attachments contained in the case. |
CaseActivity
A case timeline activity. The concrete activity type is indicated by the '@odata.type' discriminator: comment (user-authored free text with a 'message') or auditLog (system-generated state change).
| Name | Path | Type | Description |
|---|---|---|---|
|
@odata.type
|
@odata.type | string |
The concrete activity type discriminator (e.g. '#microsoft.graph.security.caseManagement.comment'). |
|
id
|
id | string |
Unique identifier of the activity. |
|
createdDateTime
|
createdDateTime | date-time |
Time when the activity was created. |
|
createdBy
|
createdBy | string |
Identity that created the activity. |
|
lastModifiedDateTime
|
lastModifiedDateTime | date-time |
Time when the activity was last modified. |
|
lastModifiedBy
|
lastModifiedBy | string |
Identity that last modified the activity. |
|
message
|
message | string |
Comment body (comment activities only). |
|
action
|
action | string |
Type of action performed (auditLog activities only). |
|
details
|
details | CaseActivityResourceDetails |
Target resource details for an audit activity. |
|
modifiedProperties
|
modifiedProperties | array of CaseModifiedProperty |
Collection of property deltas (auditLog activities only). |
CaseActivityResourceDetails
Target resource details for an audit activity.
| Name | Path | Type | Description |
|---|---|---|---|
|
resourceId
|
resourceId | string |
Identifier of the target resource. |
|
kind
|
kind | string |
Resource kind (e.g. task, relation). |
CaseModifiedProperty
A value delta recorded in an audit log.
| Name | Path | Type | Description |
|---|---|---|---|
|
propertyName
|
propertyName | string |
Name of the property changed. |
|
oldValue
|
oldValue | CaseValueProperty |
A typed property value wrapper. The concrete value type is indicated by the '@odata.type' discriminator (stringValueProperty or booleanValueProperty). |
|
newValue
|
newValue | CaseValueProperty |
A typed property value wrapper. The concrete value type is indicated by the '@odata.type' discriminator (stringValueProperty or booleanValueProperty). |
CaseValueProperty
A typed property value wrapper. The concrete value type is indicated by the '@odata.type' discriminator (stringValueProperty or booleanValueProperty).
| Name | Path | Type | Description |
|---|---|---|---|
|
@odata.type
|
@odata.type | string |
The concrete value type discriminator. |
|
value
|
value | string |
The wrapped value, serialized as text. |
CaseRelation
A link from the case to an external resource. The concrete relation type is indicated by the '@odata.type' discriminator: incidentRelation, recommendationRelation, or workspaceIndicatorRelation.
| Name | Path | Type | Description |
|---|---|---|---|
|
@odata.type
|
@odata.type | string |
The concrete relation type discriminator. |
|
id
|
id | string |
Unique identifier of the relation. |
|
createdDateTime
|
createdDateTime | date-time |
Time when the relation was created. |
|
createdBy
|
createdBy | string |
Identity that created the relation. |
|
relatedResourceId
|
relatedResourceId | string |
External resource identifier. |
|
recommendationType
|
recommendationType | string |
Recommendation type (recommendationRelation only). |
|
subscriptionId
|
subscriptionId | string |
Subscription identifier (recommendationRelation and workspaceIndicatorRelation). |
|
resourceGroupName
|
resourceGroupName | string |
Resource group name (recommendationRelation and workspaceIndicatorRelation). |
|
workspaceName
|
workspaceName | string |
Workspace name (workspaceIndicatorRelation only). |
CaseTask
An actionable unit of work within a case.
| Name | Path | Type | Description |
|---|---|---|---|
|
id
|
id | string |
Unique identifier of the task. |
|
createdDateTime
|
createdDateTime | date-time |
Time when the task was created. |
|
createdBy
|
createdBy | string |
Identity that created the task. |
|
lastModifiedDateTime
|
lastModifiedDateTime | date-time |
Time when the task was last modified. |
|
lastModifiedBy
|
lastModifiedBy | string |
Identity that last modified the task. |
|
displayName
|
displayName | string |
Task title. |
|
status
|
status | string |
Current task status. |
|
description
|
description | string |
Task description. |
|
assignedTo
|
assignedTo | string |
Task owner. |
|
closingNotes
|
closingNotes | string |
Notes recorded upon completion. |
|
dueDateTime
|
dueDateTime | date-time |
Target completion date. |
|
priority
|
priority | string |
Task priority classification. |
|
category
|
category | string |
Task functional category. |
CaseAttachment
Metadata for a binary evidence item stored under a case. Binary content is retrieved separately via the attachment content stream.
| Name | Path | Type | Description |
|---|---|---|---|
|
id
|
id | string |
Unique identifier of the attachment. |
|
createdDateTime
|
createdDateTime | date-time |
Time when the attachment was created. |
|
createdBy
|
createdBy | string |
Identity that created the attachment. |
|
displayName
|
displayName | string |
Attachment title. |
|
description
|
description | string |
Attachment description. |
|
fileSize
|
fileSize | integer |
Size in bytes. |
|
fileExtension
|
fileExtension | string |
File extension. |
|
scanResult
|
scanResult | string |
Malware scan result. |
|
origin
|
origin | CaseAttachmentOrigin |
Origin reference for an attachment. |
CaseAttachmentOrigin
Origin reference for an attachment.
| Name | Path | Type | Description |
|---|---|---|---|
|
resourceId
|
resourceId | string |
Identifier of the origin resource. |
|
resourceType
|
resourceType | string |
Origin resource kind. |
CaseAlertCounts
Aggregated alert counts for an incident case.
| Name | Path | Type | Description |
|---|---|---|---|
|
total
|
total | integer |
Total alert count. |
|
active
|
active | integer |
Active alert count. |
|
bySeverity
|
bySeverity | CaseIncidentSeverityCounts |
Alert counts grouped by incident severity. |
|
byStatus
|
byStatus | CaseAlertStatusCounts |
Alert counts grouped by status. |
CaseIncidentSeverityCounts
Alert counts grouped by incident severity.
| Name | Path | Type | Description |
|---|---|---|---|
|
unknown
|
unknown | integer |
Alerts with unknown severity. |
|
informational
|
informational | integer |
Alerts with informational severity. |
|
low
|
low | integer |
Alerts with low severity. |
|
medium
|
medium | integer |
Alerts with medium severity. |
|
high
|
high | integer |
Alerts with high severity. |
CaseAlertStatusCounts
Alert counts grouped by status.
| Name | Path | Type | Description |
|---|---|---|---|
|
new
|
new | integer |
Alerts in new status. |
|
inProgress
|
inProgress | integer |
Alerts in progress. |
|
resolved
|
resolved | integer |
Alerts in resolved status. |
CaseImpactedAssetsCounts
Aggregated impacted asset counts for an incident case.
| Name | Path | Type | Description |
|---|---|---|---|
|
machines
|
machines | integer |
Machine count. |
|
users
|
users | integer |
User count. |
|
mailboxes
|
mailboxes | integer |
Mailbox count. |
|
apps
|
apps | integer |
App count. |
|
cloudResources
|
cloudResources | integer |
Cloud resource count. |
|
aiAgents
|
aiAgents | integer |
AI agent count. |
|
ips
|
ips | integer |
IP address count. |
|
urls
|
urls | integer |
URL count. |
|
files
|
files | integer |
File count. |
|
processes
|
processes | integer |
Process count. |
|
registryKeys
|
registryKeys | integer |
Registry key count. |
|
securityGroups
|
securityGroups | integer |
Security group count. |
|
oauthApps
|
oauthApps | integer |
OAuth app count. |
|
total
|
total | integer |
Total impacted asset count. |
CaseInvestigation
Investigation summary for an incident case.
| Name | Path | Type | Description |
|---|---|---|---|
|
ids
|
ids | array of string |
Investigation identifiers. |
|
count
|
count | integer |
Investigation count. |
|
state
|
state | string |
Investigation state. |