Skip to main content

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is an enterprise endpoint security platform that provides comprehensive threat protection, detection, investigation, and response capabilities for devices and endpoints across an organization. Formerly known as Microsoft Defender Advanced Threat Protection (ATP) or Windows Defender ATP, this cloud-powered security solution protects Windows, macOS, Linux, Android, and iOS devices against cyber threats, malware, ransomware, and advanced persistent threats.

CategoryEDR
DirectionQuery source
Sign-inClient Secret (Azure AD App)
Query languagesSTIX, KQL
Query templates1
Websitemicrosoft.com

Before you start​

Huntbase signs in to Microsoft Defender for Endpoint with Client Secret (Azure AD App). Create the credential in Microsoft Defender for Endpoint first, then keep it to hand for the Connect step.

  1. In the Azure portal, go to App registrations, select New registration, name the app, and select Register.
  2. In the app, go to API permissions › Add permission › APIs my organization uses, then search for and select WindowsDefenderATP.
  3. Select Application permissions, choose Run advanced queries (AdvancedQuery.Read.All), and select Add permission.
  4. Go to Certificates & secrets › New client secret, add a description and expiry, and select Add. Copy the secret Value: you cannot retrieve it after you leave the page.
  5. From the app's Overview page, copy the Application (client) ID and Directory (tenant) ID.

Permissions:

  • AdvancedQuery.Read.All (Run advanced queries), application permission on WindowsDefenderATP
Watch out for
  • Microsoft began retiring the Defender for Endpoint advanced hunting API in January 2026 and recommends the Microsoft Graph security API instead. Once the retirement completes, this API no longer works.
  • Queries can only cover the last 30 days and return at most 100,000 rows. Each tenant can make up to 45 calls per minute and 1,500 per hour.

For the vendor's own instructions, see Microsoft guide to creating a Defender for Endpoint API app.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Microsoft Defender for Endpoint​

  1. Go to Connections and click New connection, or click New connection on the Microsoft Defender for Endpoint product page.
  2. On Product, pick Microsoft Defender for Endpoint and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Microsoft Defender for Endpoint lives:

FieldRequiredNotes
Server AddressYesapi.securitycenter.microsoft.com. Microsoft notes that tokens issued for a different resource fail with 403 Forbidden.
PortYes443. Defaults to 443.
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.

Advanced settings​

These settings are under Advanced. You can usually leave them alone.

FieldRequiredNotes
Include AlertsNoInclude matching Microsoft Defender alerts in results.
Include Host OSNoInclude host operating-system information in results.
Include Network InfoNoInclude network interface information in results.
Retain Original EventNoRetain the original (unmapped) source event alongside the STIX result.

Credentials​

The only Method is Client Secret (Azure AD App). Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
Tenant IDYesTenant ID of Azure Active directory Application with access to the data source. Secret — not shown again after you save it.
Client IDYesClient ID of Azure Active directory Application with access to the data source. Secret — not shown again after you save it.
Client SecretYesThe secret Value, not the secret ID. Secret — not shown again after you save it.

Query it​

Once connected, Microsoft Defender for Endpoint can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.
KQLNative Kusto queries against the workspace, sent as written.

Example: KQL​

Process events for a user — Raw KQL passthrough (advanced hunting) for a user's recent process events.

DeviceProcessEvents | where AccountName == "{{username}}" | take 100

Microsoft Defender for Endpoint ships with 1 query template. Find them in Library › Queries — see Query templates.

Next steps​