Microsoft Defender for Endpoint integration

Microsoft Defender for Endpoint API for security operations on onboarded devices. List and read alerts, triage them (status, owner, classification, determination, comments) one by one or in batches, and raise an alert from an existing event; list devices, find them by tag or internal IP, read their logged-on users, software, vulnerabilities, recommendations and alerts, and change their tags and value; run response actions on a device (isolate or release, restrict or unrestrict app execution, antivirus scan, stop and quarantine a file, offboard, start an automated investigation) and follow or cancel them; manage custom indicators (allow, warn, alert or block a hash, IP, domain, URL or certificate); look up alerts, devices and statistics by file, domain, IP or user; and read threat and vulnerability management data (software inventory, vulnerabilities, security recommendations, remediation activities, exposure score and Microsoft Secure Score for Devices). Every write and response action acts for real in the tenant. Answers carry personal data (user accounts, owners, requesters, IP addresses). Not exposed: advanced hunting queries (arbitrary tenant rows, and moving to the Microsoft Graph security API), live response and its library, investigation package collection and download links, the export assessment and device health exports, authenticated scan definitions, alert evidence, the browser extension permission catalogue and security baseline profiles (no permission is documented for a user sign-in), and the routes the reference grants only to applications (indicator deletion, missing updates per device). Limits: usually 100 calls per minute and 1,500 per hour per route (lower on batch update, import, create alert and start investigation); lists return at most 10,000 items (8,000 for vulnerabilities) per call. Each user sees only the device groups their role allows. Authentication: OAuth 2.0 with the Microsoft identity platform (work or school accounts), through your own app registration with delegated WindowsDefenderATP permissions; the user needs a Defender role that allows each call (View Data for reads; Alerts investigation, Active remediation actions or Manage security setting for writes, as each tool says).