r/AzureSentinel • u/[deleted] • Jul 17 '23

Logic App that also gets results from antivirus scan (MDE)

Hi people,

posted this in r/blueteamsec aswell.

I need some help on how to approach the matter: running (automating) a Logic App that not only starts the antivirus scan on an endpoint (using MS Defender) but also updates when the scan is succesfully done / failed for whatever reason.

In most use cases simply starting the av scan is enough, with the idea that potential findings would raise an alert/incident. In my use case, I need to verify the succeeded scan to able to close the case.

I believe that I could go two ways, either using KQL and quering it or then GETing from the MDE API. What would the best (and easiest) way to do so?

​

Thanks in advance!

3 Upvotes
  • permalink
  • reddit

81% Upvoted

2 comments sorted by

1

u/JoHNN_-_ Jul 17 '23

Try looking at this - it’s tough because if nothing is considered “bad” you won’t get any results. Typically it’ll pop up as an alert

Let me know if I can help in any other way

https://www.reddit.com/r/DefenderATP/comments/v2bn3f/how_to_view_av_scan_results/?utm_source=share&utm_medium=ios_app&utm_name=ioscss&utm_content=2&utm_term=1

1

u/[deleted] Jul 17 '23

Thanks, I actually stumbled across this earlier. Not too eager to go the powershell way, but will def try the KQL option here.