Integrations
Microsoft Defender for Endpoint is the primary security data source. All other systems extend the platform.
Microsoft Defender for Endpoint
Demo
Demo mode - sample data
mde
Not configured
Microsoft Graph
Demo
Demo mode - sample data
graph
Not configured
Microsoft Entra ID
Demo
Demo mode - sample data
entra
Not configured
Microsoft Intune
Demo
Demo mode - sample data
intune
Not configured
Microsoft Purview
Demo
Demo mode - sample data
purview
Not configured
Microsoft Secure Score
Demo
Demo mode - sample data
secure_score
Not configured
Microsoft Sentinel
Demo
Demo mode - sample data
sentinel
Not configured
Defender Vulnerability Management
Demo
Demo mode - sample data
vulnerability
Not configured
Microsoft Teams
Demo
Demo mode - sample data
teams
Not configured
Slack
Demo
Demo mode - sample data
slack
Not configured
ServiceNow
Demo
Demo mode - sample data
servicenow
Not configured
Jira
Demo
Demo mode - sample data
jira
Not configured
VirusTotal
Demo
Demo mode - sample data
virustotal
Not configured
AbuseIPDB
Demo
Demo mode - sample data
abuseipdb
Not configured
AlienVault OTX
Demo
Demo mode - sample data
otx
Not configured
Compliance evidence
Demo
Demo mode - sample data
vanta
Not configured
Configuration
Credentials are configured via environment variables (see .env.example). Secrets are never stored in the database or frontend.
AZURE_TENANT_ID= Microsoft Entra tenant AZURE_CLIENT_ID= App registration (client) ID AZURE_CLIENT_SECRET= App registration secret (or certificate / managed identity) MDE_API_URL= https://api.security.microsoft.com GRAPH_API_URL= https://graph.microsoft.com SENTINEL_SUBSCRIPTION_ID= Sentinel subscription / resource group / workspace TEAMS_WEBHOOK_URL= Teams incoming webhook VIRUSTOTAL_API_KEY= Optional enrichment SERVICENOW_INSTANCE= Optional ticketing # Graph-scoped connectors (share the same Entra credential): # Intune - DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All # Purview - RecordsManagement.Read.All, DataLossPrevention.Read.All, AuditLog.Read.All
