Defender Endpoint
Integration Context Contract
- Canonical contract:
docs/integration-context.md
| Workflow | tenantId | subscriptionId | environmentCloud | principalType | scopesOrRoles |
|---|---|---|---|---|---|
| Defender Endpoint operations | required | optional | AzureCloud* |
service-principal or delegated-user | SecurityAlert.Read.All, SecurityIncident.Read.All, ThreatHunting.Read.All, Machine.Isolate |
- Use sovereign cloud values from the canonical contract when applicable.
Fail fast before API calls when required context is missing or malformed. Redact tenant, subscription, and object identifiers.
Command Surface
| Command | Purpose |
|---|---|
defender-endpoint-setup |
Deterministic workflow for defender endpoint setup. |
defender-endpoint-triage |
Deterministic workflow for defender endpoint triage. |
defender-endpoint-isolate-machine |
Deterministic workflow for defender endpoint isolate machine. |
defender-endpoint-live-response-metadata |
Deterministic workflow for defender endpoint live response metadata. |
defender-endpoint-evidence-summary |
Deterministic workflow for defender endpoint evidence summary. |
Guardrails
- Validate context schema and minimum grants before any API call.
- Run read-only discovery first whenever possible.
- Require explicit confirmation for destructive actions.
- Re-query and verify post-action state.
- Return structured, redacted output.
Progressive Disclosure - Reference Files
| Topic | File |
|---|---|
| Endpoint and permission reference | references/api-reference.md |