Microsoft Defender for Endpoint is an enterprise endpoint detection and response (EDR) platform that provides threat prevention, detection, investigation, and automated response across Windows, macOS, Linux, iOS, and Android.
Vendors building a Microsoft Defender for Endpoint integration can access normalized endpoint detections, vulnerabilities, and device health data through Synqly's connector. Integrate Defender for Endpoint to power security workflows with Microsoft endpoint telemetry without per-customer API configuration.
Configuration for Microsoft Defender for Endpoint.
[Configuration guide](https://docs.synqly.com/guides/provider-configuration/defender-setup)
Integration Use Cases
Create IOCs
Creates a list of iocs that match the stix input for the EDR source.
Delete IOCs
Deletes a list of iocs that match the input of ids in the query param
Get Endpoint
Gets a single endpoint assets matching the UID from the token-linked EDR source.
Quarantine Endpoints
Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.
Query Alerts
Returns a list of alerts that match the query from the token-linked EDR source.
Query Applications
Returns a list of applications matching the query from the token-linked EDR source.
Query Endpoints
Returns a list of endpoint assets matching the query from the token-linked EDR source.
Query IOCs
Returns a list of iocs that match the query from the token-linked EDR source.
Query Posture Score
Returns the posture score of the endpoint assets that match the query from the token-linked EDR source.
Query Threat Events
Returns a list of threats that match the query from the token-linked EDR source.