Microsoft Defender Integration

I use Microsoft Defender for Business and Microsoft Defender XDR for various clients in the Microsoft environment.

There, I also see an overview of various CVEs affecting the devices.

It would be particularly helpful to see this kind of information at the device level.

It’s difficult to assess just how extensive an Octoja integration for Microsoft Defender needs to be.

Ideas

• A check template that verifies whether a device has, for example, at least one security recommendation with a “High” severity level (number and severity level configurable)

• Check template for device integrity status (e.g., when the last security check took place, etc.)

• Tagging template for a “microsoft-defender” tag if a device is enrolled in MS Defender.

• A view of the security score for the entire tenant at the customer level

Further Thoughts / Implementation Notes

Generally speaking, you probably won’t get very far using the Win32 APIs that can be called from the agent.

At the customer level, you could use App Registration to retrieve the data via the Microsoft Graph interface: Overview of Microsoft Defender XDR APIs - Microsoft Defender XDR | Microsoft Learn.

In principle, it’s also possible to subscribe to an event stream via Event Grid → though I don’t currently have any idea why an RMM would need that.