Microsoft Defender endpoint security digest
Use “Microsoft Defender endpoint security digest” in Recued. It provides a scheduled, read-only Microsoft Defender for Endpoint security digest.
How it works
Inspect the data fetches, transforms, gates, and output this recipe runs.
Process (27 steps)
alerts_raw
recued-core.microsoft-defender-endpoint.alert.search
Search alert on microsoft defender endpoint
machines_raw
recued-core.microsoft-defender-endpoint.machine.search
Search machine on microsoft defender endpoint
actions_raw
recued-core.microsoft-defender-endpoint.machine_action.search
Search machine action on microsoft defender endpoint
recommendations_raw
recued-core.microsoft-defender-endpoint.recommendation.search
Search recommendation on microsoft defender endpoint
vulnerabilities_raw
recued-core.microsoft-defender-endpoint.vulnerability.search
Search vulnerability on microsoft defender endpoint
exposure_score
recued-core.microsoft-defender-endpoint.exposure_score.read
Read exposure score on microsoft defender endpoint
defaults
defaults
Apply defaults
alert_count
count
Count items in alerts
machine_count
count
Count items in machines
action_count
count
Count items in actions
recommendation_count
count
Count items in recommendations
vulnerability_count
count
Count items in vulnerabilities
has_alerts
compare
Check if alert count is greater than 0
has_machines
compare
Check if machine count is greater than 0
has_findings
any
Check if any of the conditions are true
notify_enabled
compare
Check if setting notify when findings equals true
should_notify
all
Check if all conditions are true
notify
core.notification.send
Send notification
skip: step.should_notify not_equal true
alert_rows
slice
Take a subset of
machine_rows
slice
Take a subset of
recommendation_rows
slice
Take a subset of
vulnerability_rows
slice
Take a subset of
alert_table
to_table
Format results as a data table
machine_table
to_table
Format results as a data table
recommendation_table
to_table
Format results as a data table
vulnerability_table
to_table
Format results as a data table
card
to_summary
Format results as a summary card
▼
Output
summary
card
table
alert_table
table
machine_table
table
recommendation_table
table
vulnerability_table
Settings
Configurable at install. Defaults shown — change them anytime in Recued.
channels
setting
=
[object Object]
end hour
setting
=
10
weekdays
setting
=
1,2,3,4,5
row limit
setting
=
20
start hour
setting
=
8
alert filter
setting
=
status ne 'Resolved' and severity ne 'Informational'
machine filter
setting
=
riskScore ne 'None' or exposureLevel ne 'None'
notify when findings
setting
=
true
vulnerability filter
setting
=
severity eq 'Critical' or severity eq 'High'
machine action filter
setting
=
status ne 'Succeeded'
recommendation filter
setting
=
status eq 'Active'
Uses (8 operations)
Triggers
Time watch
core.watch.time
Pack operation
Search alert on microsoft defender endpoint
recued-core.microsoft-defender-endpoint.alert.search
Pack operation
Search machine on microsoft defender endpoint
recued-core.microsoft-defender-endpoint.machine.search
Pack operation
Search machine action on microsoft defender endpoint
recued-core.microsoft-defender-endpoint.machine_action.search
Pack operation
Search recommendation on microsoft defender endpoint
recued-core.microsoft-defender-endpoint.recommendation.search
Pack operation
Search vulnerability on microsoft defender endpoint
recued-core.microsoft-defender-endpoint.vulnerability.search
Pack operation
Read exposure score on microsoft defender endpoint
recued-core.microsoft-defender-endpoint.exposure_score.read
Notifications
Send notification
core.notification.send
Trust & control
What installing this recipe would let it do. Recued grants these permissions at install — review them there before approving.
Permissions it requires
Declared by the recipe — Recued grants these at install, where you review them before approving.What it's allowed to do
Read
Triggers
core.watch.time
read-only
Read
Notifications
core.notification.send
external change
6 more aren't listed here. You'll see them at install.