{
  "Name": "MicrosoftDefenderForEndpoint",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [Microsoft Defender for Endpoint](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) solution for Microsoft Sentinel enables you to ingest security alerts from the Defender for Endpoint platform, integrating them into your Microsoft Sentinel Incidents queue. \r \n \r \n **Underlying Microsoft Technologies used:** \r \n \r \n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Codeless Connector Platform/Native Microsoft Sentinel Polling](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)",
  "Data Connectors": [
    "Data Connectors/template_MicrosoftDefenderAdvancedThreatProtection.JSON"
  ],
  "Analytic Rules": [
    "Analytic Rules/AquaBlizzardAVHits.yaml"
  ],
  "Parsers": [
    "Parsers/AssignedIPAddress.yaml",
    "Parsers/Devicefromip.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/MDE_Usage.yaml",
    "Hunting Queries/MDE_Process-IOCs.yaml"
  ],
  "Playbooks": [
    "Playbooks/Isolate-MDEMachine/Isolate-MDEMachine-alert-trigger/azuredeploy.json",
    "Playbooks/Isolate-MDEMachine/Isolate-MDEMachine-incident-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEAppExecution/Restrict-MDEAppExecution-alert-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEAppExecution/Restrict-MDEAppExecution-incident-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEDomain/Restrict-MDEDomain-alert-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEDomain/Restrict-MDEDomain-incident-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEFileHash/Restrict-MDEFileHash-alert-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEFileHash/Restrict-MDEFileHash-incident-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEIPAddress/Restrict-MDEIPAddress-alert-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEIPAddress/Restrict-MDEIPAddress-incident-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEUrl/Restrict-MDEUrl-alert-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEUrl/Restrict-MDEUrl-incident-trigger/azuredeploy.json",
    "Playbooks/Run-MDEAntivirus/Run-MDEAntivirus-alert-trigger/azuredeploy.json",
    "Playbooks/Run-MDEAntivirus/Run-MDEAntivirus-incident-trigger/azuredeploy.json",
    "Playbooks/Unisolate-MDEMachine/Unisolate-MDEMachine-alert-trigger/azuredeploy.json",
    "Playbooks/Unisolate-MDEMachine/Unisolate-MDEMachine-incident-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEDomain/Restrict-MDEDomain-entity-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEFileHash/Restrict-MDEFileHash-entity-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEIPAddress/Restrict-MDEIPAddress-entity-trigger/azuredeploy.json",
    "Playbooks/Restrict-MDEUrl/Restrict-MDEUrl-entity-trigger/azuredeploy.json",
    "Playbooks/Isolate-MDEMachine/Isolate-MDE-Machine-entity-trigger/azuredeploy.json",
    "Playbooks/Unisolate-MDEMachine/Unisolate-MDE-Machine-entity-trigger/azuredeploy.json"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\MicrosoftDefenderForEndpoint",
  "Version": "3.0.7",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "StaticDataConnectorIds": [
    "MicrosoftDefenderAdvancedThreatProtection"
  ]
}