Recued
Get started
Menu
Publish Sign in GitHub
← Back to recipes

Microsoft Defender endpoint security digest

by recued-core v1 9 views

Use “Microsoft Defender endpoint security digest” in Recued. It provides a scheduled, read-only Microsoft Defender for Endpoint security digest.

How it works 27 steps

Inspect the data fetches, transforms, gates, and output this recipe runs.

Process (27 steps)
■ alerts_raw ?
■ machines_raw ?
■ actions_raw ?
■ recommendations_raw ?
■ vulnerabilities_raw ?
■ exposure_score ?
■ defaults defaults
Apply defaults
■ alert_count count
Count items in alerts
■ machine_count count
Count items in machines
■ action_count count
Count items in actions
■ recommendation_count count
Count items in recommendations
■ vulnerability_count count
Count items in vulnerabilities
■ has_alerts compare
Check if alert count is greater than 0
■ has_machines compare
Check if machine count is greater than 0
■ has_findings any
Check if any of the conditions are true
■ notify_enabled compare
Check if setting notify when findings equals true
■ should_notify all
Check if all conditions are true
■ notify ?
skip: step.should_notify not_equal true
■ alert_rows slice
Take a subset of
■ machine_rows slice
Take a subset of
■ recommendation_rows slice
Take a subset of
■ vulnerability_rows slice
Take a subset of
■ alert_table to_table
Format results as a data table
■ machine_table to_table
Format results as a data table
■ recommendation_table to_table
Format results as a data table
■ vulnerability_table to_table
Format results as a data table
■ card to_summary
Format results as a summary card
Settings 12 configurable

Configurable at install. Defaults shown — change them anytime in Recued.

channels setting = in_app
end hour setting = 10
weekdays setting = 1,2,3,4,5
row limit setting = 20
start hour setting = 8
alert filter setting = status ne 'Resolved' and severity ne 'Informational'
machine filter setting = riskScore ne 'None' or exposureLevel ne 'None'
microsoft defender setting =
notify when findings setting = true
vulnerability filter setting = severity eq 'Critical' or severity eq 'High'
machine action filter setting = status ne 'Succeeded'
recommendation filter setting = status eq 'Active'

Trust & control

What installing this recipe would let it do. Recued grants these permissions at install — review them there before approving.

Permissions it requires

Send notificationsRead your Microsoft-defender connection
Declared by the recipe — Recued grants these at install, where you review them before approving.

About

recued-core

Tags

microsoft-defender-endpoint microsoft-defender-endpointdefender-for-endpointendpoint-securityedralertsmachinesvulnerabilitiessecurity-recommendationsdigestnotificationpack:microsoft-defender-endpoint

Details

27 steps 12 configurable settings recipe_id: security-digest-microsoft-defender-endpoint