From 3cfecdbb66cac7703eb8f6db2ad35269c86d345e Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Sun, 26 Oct 2025 14:25:34 +0200 Subject: [PATCH 01/23] init --- .../Microsoft365Defender.yml | 30 ++++++++++++++----- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml index 58aea6faac69..3aea075f0f75 100644 --- a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml +++ b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml @@ -7,15 +7,31 @@ commonfields: version: -1 configuration: - additionalinfo: |- - The United States: api-us.security.microsoft.com - Europe: api-eu.security.microsoft.com - The United Kingdom: api-uk.security.microsoft.co - defaultvalue: https://api.security.microsoft.com - display: Endpoint URI - name: base_url - required: true + When selecting the Custom option, the Server URL parameter must be filled. More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender + defaultvalue: Worldwide + display: Endpoint Type + name: endpoint_type + required: false + type: 15 + section: Connect + options: + - Worldwide + - EU Geo Proximity + - UK Geo Proximity + - US Geo Proximity + - US GCC + - US GCC-High + - DoD + - Custom + advanced: true +- display: Server URL (e.g., https://api.security.microsoft.com) + name: url type: 0 section: Connect + advanced: true + additionalinfo: |- + More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender + required: false - name: creds_client_id type: 9 displaypassword: ID or Client ID From f88fa1dca5957cc60148f7e422c179ebce0b83f1 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Sun, 26 Oct 2025 15:47:19 +0200 Subject: [PATCH 02/23] init --- .../MicrosoftApiModule/MicrosoftApiModule.py | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index dc6e60650f5f..7062a484373c 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -88,12 +88,24 @@ class Resources: # https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide#api MICROSOFT_DEFENDER_FOR_ENDPOINT_API = { "com": "https://api.securitycenter.microsoft.com", - "geo-us": "https://api.securitycenter.microsoft.com", - "geo-eu": "https://api-eu.securitycenter.microsoft.com", - "geo-uk": "https://api-uk.securitycenter.microsoft.com", "gcc": "https://api-gcc.securitycenter.microsoft.us", "gcc-high": "https://api-gov.securitycenter.microsoft.us", "dod": "https://api-gov.securitycenter.microsoft.us", + "geo-us": "https://api.securitycenter.microsoft.com", + "geo-eu": "https://api-eu.securitycenter.microsoft.com", + "geo-uk": "https://api-uk.securitycenter.microsoft.com", +} + +# https://learn.microsoft.com/en-us/defender-xdr/usgov +# https://learn.microsoft.com/en-us/defender-xdr/api-supported?view=o365-worldwide#endpoint-uris +MICROSOFT_DEFENDER_XDR_API = { + "com": "https://api.security.microsoft.com", + "gcc": "https://api-gcc.security.microsoft.us", + "gcc-high": "https://api-gov.security.microsoft.us", + "dod": "https://api-gov.security.microsoft.us", + "geo-eu": "https://api-eu.security.microsoft.com", + "geo-uk": "https://api-uk.security.microsoft.com", + "geo-us": "https://api-us.security.microsoft.com", } # https://learn.microsoft.com/en-us/graph/deployments#app-registration-and-token-service-root-endpoints From 2407ebd6c37750bb108c73bced11e638a17806c1 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 27 Oct 2025 10:16:12 +0200 Subject: [PATCH 03/23] more --- .../Microsoft365Defender/Microsoft365Defender.py | 9 +++++++-- .../Microsoft365Defender/Microsoft365Defender.yml | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py index e5e4efbf7468..25277049224e 100644 --- a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py +++ b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py @@ -89,7 +89,7 @@ def __init__( auth_id=app_id, grant_type=CLIENT_CREDENTIALS if client_credentials else DEVICE_CODE, # used for device code flow - resource="https://api.security.microsoft.com" if not client_credentials else None, + resource=base_url if not client_credentials else None, token_retrieval_url="https://login.windows.net/organizations/oauth2/v2.0/token" if not client_credentials else None, # used for client credentials flow tenant_id=tenant_id, @@ -1126,7 +1126,12 @@ def main() -> None: # out of the box by it, just pass ``proxy`` to the Client constructor proxy = params.get("proxy", False) app_id = params.get("creds_client_id", {}).get("password", "") or params.get("app_id") or params.get("_app_id") - base_url = params.get("base_url") + + endpoint_type = MICROSOFT_DEFENDER_FOR_ENDPOINT_TYPE[params.get("endpoint_type", "Custom")] # TODO: check if this is BC + if endpoint_type == "Custom": + base_url = params.get("base_url") + else: + base_url = MICROSOFT_DEFENDER_XDR_API[endpoint_type] tenant_id = params.get("creds_tenant_id", {}).get("password", "") or params.get("tenant_id") or params.get("_tenant_id") client_credentials = params.get("client_credentials", False) diff --git a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml index 3aea075f0f75..62893896ecad 100644 --- a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml +++ b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml @@ -25,7 +25,7 @@ configuration: - Custom advanced: true - display: Server URL (e.g., https://api.security.microsoft.com) - name: url + name: base_url type: 0 section: Connect advanced: true From 81db19049c7aa3ed0ed384fec1191aee18f739f0 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 27 Oct 2025 11:35:43 +0200 Subject: [PATCH 04/23] code complete --- .../MicrosoftApiModule/MicrosoftApiModule.py | 22 +++++++++++++++++++ .../Microsoft365Defender.py | 17 ++++++++------ 2 files changed, 32 insertions(+), 7 deletions(-) diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index 7062a484373c..ab161fe02009 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -108,6 +108,28 @@ class Resources: "geo-us": "https://api-us.security.microsoft.com", } +# https://learn.microsoft.com/en-us/defender-xdr/usgov +MICROSOFT_DEFENDER_XDR_API_SERVICE_ENDPOINTS = { + "com": "https://security.microsoft.com", + "gcc": "https://security.microsoft.com", + "gcc-high": "https://security.microsoft.us", + "dod": "https://security.apps.mil", + "geo-eu": "https://security.microsoft.com", + "geo-uk": "https://security.microsoft.com", + "geo-us": "https://security.microsoft.com", +} + +# https://learn.microsoft.com/en-us/defender-xdr/usgov +MICROSOFT_DEFENDER_XDR_API_LOGIN = { + "com": "https://login.windows.net", + "gcc": "https://login.microsoftonline.com", + "gcc-high": "https://login.microsoftonline.us", + "dod": "https://login.microsoftonline.us", + "geo-eu": "https://login.windows.net", + "geo-uk": "https://login.windows.net", + "geo-us": "https://login.windows.net", +} + # https://learn.microsoft.com/en-us/graph/deployments#app-registration-and-token-service-root-endpoints MICROSOFT_DEFENDER_FOR_ENDPOINT_TOKEN_RETRIVAL_ENDPOINTS = { "com": "https://login.microsoftonline.com", diff --git a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py index 25277049224e..4fa6c6c0b6e9 100644 --- a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py +++ b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py @@ -1,10 +1,7 @@ import demistomock as demisto # noqa: F401 -import urllib3 from CommonServerPython import * # noqa: F401 from MicrosoftApiModule import * # noqa: E402 -# Disable insecure warnings -urllib3.disable_warnings() """ CONSTANTS """ @@ -63,6 +60,7 @@ def __init__( verify: bool, proxy: bool, base_url: str = BASE_URL, + endpoint_type: str = "com", tenant_id: str = None, enc_key: str = None, client_credentials: bool = False, @@ -82,7 +80,7 @@ def __init__( verify=verify, proxy=proxy, ok_codes=(200, 201, 202, 204), - scope="offline_access https://security.microsoft.com/mtp/.default", + scope=f"offline_access {MICROSOFT_DEFENDER_XDR_API_SERVICE_ENDPOINTS[endpoint_type]}/mtp/.default", self_deployed=True, # We always set the self_deployed key as True because when not using a self # deployed machine, the DEVICE_CODE flow should behave somewhat like a self deployed # flow and most of the same arguments should be set, as we're !not! using OProxy. @@ -90,7 +88,7 @@ def __init__( grant_type=CLIENT_CREDENTIALS if client_credentials else DEVICE_CODE, # used for device code flow resource=base_url if not client_credentials else None, - token_retrieval_url="https://login.windows.net/organizations/oauth2/v2.0/token" if not client_credentials else None, + token_retrieval_url=f"{MICROSOFT_DEFENDER_XDR_API_LOGIN[endpoint_type]}/organizations/oauth2/v2.0/token" if not client_credentials else None, # used for client credentials flow tenant_id=tenant_id, enc_key=enc_key, @@ -1127,10 +1125,14 @@ def main() -> None: proxy = params.get("proxy", False) app_id = params.get("creds_client_id", {}).get("password", "") or params.get("app_id") or params.get("_app_id") - endpoint_type = MICROSOFT_DEFENDER_FOR_ENDPOINT_TYPE[params.get("endpoint_type", "Custom")] # TODO: check if this is BC - if endpoint_type == "Custom": + params_endpoint_type = [params.get("endpoint_type", "Custom")] # TODO: check if this is BC + if params_endpoint_type == "Custom": + endpoint_type = "com" base_url = params.get("base_url") + if not base_url: + raise DemistoException("Base URL is required when endpoint type is set to 'Custom'") else: + endpoint_type = MICROSOFT_DEFENDER_FOR_ENDPOINT_TYPE[params_endpoint_type] base_url = MICROSOFT_DEFENDER_XDR_API[endpoint_type] tenant_id = params.get("creds_tenant_id", {}).get("password", "") or params.get("tenant_id") or params.get("_tenant_id") @@ -1168,6 +1170,7 @@ def main() -> None: app_id=app_id, verify=verify_certificate, base_url=base_url, + endpoint_type=endpoint_type, proxy=proxy, tenant_id=tenant_id, enc_key=enc_key, From fac63de99a91348a7d378040663390a0f4ccd7d7 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 27 Oct 2025 13:30:24 +0200 Subject: [PATCH 05/23] real code complete --- .../MicrosoftApiModule/MicrosoftApiModule.py | 7 ++++++ .../MicrosoftGraphSecurity.py | 6 +++-- .../MicrosoftGraphSecurity.yml | 22 +++++++++++++++---- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index ab161fe02009..124b601040b3 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -83,6 +83,13 @@ class Resources: MICROSOFT_DEFENDER_FOR_ENDPOINT_TYPE_CUSTOM = "Custom" MICROSOFT_DEFENDER_FOR_ENDPOINT_DEFAULT_ENDPOINT_TYPE = "com" +# https://learn.microsoft.com/en-us/graph/deployments +MICROSOFT_GRAPH_ENDPOINTS = { + "Worldwide": "https://graph.microsoft.com", + "US GCC-High": "https://graph.microsoft.us", + "DoD": "https://dod-graph.microsoft.us", + "China": "https://microsoftgraph.chinacloudapi.cn", +} # https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-supported?view=o365-worldwide#endpoint-uris # https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide#api diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index f70cddbe091c..04c8ab3b26c7 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -276,7 +276,7 @@ def create_mail_assessment_request(self, recipient_email, expected_assessment, c "recipientEmail": recipient_email, "expectedAssessment": expected_assessment, "category": category, - "messageUri": f"https://graph.microsoft.com/v1.0/users/{user_id}/messages/{message_id}", + "messageUri": f"{self.ms_client.ms_url}/v1.0/users/{user_id}/messages/{message_id}", } return self.ms_client.http_request(method="POST", url_suffix=THREAT_ASSESSMENT_URL_PREFIX, json_data=body) @@ -2026,7 +2026,6 @@ def list_threat_assessment_requests_command(client: MsGraphClient, args) -> list def main(): params: dict = demisto.params() args: dict = demisto.args() - url = params.get("host", "").rstrip("/") + "/v1.0/" tenant = params.get("creds_tenant_id", {}).get("password") or params.get("tenant_id") auth_and_token_url = params.get("creds_auth_id", {}).get("password") or params.get("auth_id", "") enc_key = params.get("creds_enc_key", {}).get("password") or params.get("enc_key") @@ -2037,6 +2036,9 @@ def main(): managed_identities_client_id = get_azure_managed_identities_client_id(params) self_deployed: bool = params.get("self_deployed", False) or managed_identities_client_id is not None api_version: str = params.get("api_version", API_V2) + + cloud_service = params.get("cloud_service", "Custom") # TODO: check if this works for BC + url = (params.get("host", "").rstrip("/") if cloud_service == "Custom" else MICROSOFT_GRAPH_ENDPOINTS[cloud_service]) + "/v1.0/" if not managed_identities_client_id: if not self_deployed and not enc_key: diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml index 9f3ddd2054f7..10e776c83622 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml @@ -6,12 +6,26 @@ commonfields: id: Microsoft Graph version: -1 configuration: -- defaultvalue: https://graph.microsoft.com - display: Host URL +- defaultvalue: Worldwide + display: Microsoft Graph National Cloud Endpoint + name: cloud_service + required: false + type: 15 + options: + - Worldwide + - US GCC-High + - DoD + - China + - Custom + additionalinfo: When selecting the Custom option, the Microsoft Graph Host URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud + section: Connect + advanced: true +- display: Microsoft Graph Host URL name: host - required: true + required: false type: 0 section: Connect + advanced: true - defaultvalue: Alerts v2 display: MS graph security alert API Version name: api_version @@ -1562,7 +1576,7 @@ script: type: String - contextPath: MsGraph.eDiscoverySearch.SearchId description: The ID for the eDiscovery search. - type: String + type: String - contextPath: MsGraph.eDiscoverySearch.LastModifiedDateTime description: The last date and time the eDiscovery search was modified. type: String From 56c19b650670819978242ff8ed3f5a198c550517 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 27 Oct 2025 15:22:23 +0200 Subject: [PATCH 06/23] real code complete --- .../Scripts/MicrosoftApiModule/MicrosoftApiModule.py | 1 - .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 5 ++++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index 124b601040b3..c7874997f116 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -50,7 +50,6 @@ class Resources: "cn": "https://login.chinacloudapi.cn", } -# Deprecated, prefer using AZURE_CLOUDS GRAPH_ENDPOINTS = { "com": "https://graph.microsoft.com", "gcc": "https://graph.microsoft.us", diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 04c8ab3b26c7..c9cfff2b7516 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -2013,6 +2013,7 @@ def list_threat_assessment_requests_command(client: MsGraphClient, args) -> list next_token: str = next_token_value[1] command_results.append( + CommandResults( readable_output=f"Next token is: {next_token}\n" if next_token else None, outputs={"next_token": next_token}, @@ -2037,8 +2038,10 @@ def main(): self_deployed: bool = params.get("self_deployed", False) or managed_identities_client_id is not None api_version: str = params.get("api_version", API_V2) - cloud_service = params.get("cloud_service", "Custom") # TODO: check if this works for BC + cloud_service = params.get("cloud_service") or "Custom" + demisto.debug(f'cloud_service: {params.get("cloud_service")}') url = (params.get("host", "").rstrip("/") if cloud_service == "Custom" else MICROSOFT_GRAPH_ENDPOINTS[cloud_service]) + "/v1.0/" + demisto.debug(f"url: {url}") if not managed_identities_client_id: if not self_deployed and not enc_key: From 92ad781e9b952b6fc1eb32c77292014a4a3c1a1c Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 27 Oct 2025 15:26:42 +0200 Subject: [PATCH 07/23] remove 365 --- .../MicrosoftApiModule/MicrosoftApiModule.py | 41 ++----------------- .../Microsoft365Defender.py | 22 ++++------ .../Microsoft365Defender.yml | 28 +++---------- 3 files changed, 17 insertions(+), 74 deletions(-) diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index c7874997f116..05f8899be0e0 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -50,6 +50,7 @@ class Resources: "cn": "https://login.chinacloudapi.cn", } +# Deprecated, prefer using AZURE_CLOUDS GRAPH_ENDPOINTS = { "com": "https://graph.microsoft.com", "gcc": "https://graph.microsoft.us", @@ -94,46 +95,12 @@ class Resources: # https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide#api MICROSOFT_DEFENDER_FOR_ENDPOINT_API = { "com": "https://api.securitycenter.microsoft.com", - "gcc": "https://api-gcc.securitycenter.microsoft.us", - "gcc-high": "https://api-gov.securitycenter.microsoft.us", - "dod": "https://api-gov.securitycenter.microsoft.us", "geo-us": "https://api.securitycenter.microsoft.com", "geo-eu": "https://api-eu.securitycenter.microsoft.com", "geo-uk": "https://api-uk.securitycenter.microsoft.com", -} - -# https://learn.microsoft.com/en-us/defender-xdr/usgov -# https://learn.microsoft.com/en-us/defender-xdr/api-supported?view=o365-worldwide#endpoint-uris -MICROSOFT_DEFENDER_XDR_API = { - "com": "https://api.security.microsoft.com", - "gcc": "https://api-gcc.security.microsoft.us", - "gcc-high": "https://api-gov.security.microsoft.us", - "dod": "https://api-gov.security.microsoft.us", - "geo-eu": "https://api-eu.security.microsoft.com", - "geo-uk": "https://api-uk.security.microsoft.com", - "geo-us": "https://api-us.security.microsoft.com", -} - -# https://learn.microsoft.com/en-us/defender-xdr/usgov -MICROSOFT_DEFENDER_XDR_API_SERVICE_ENDPOINTS = { - "com": "https://security.microsoft.com", - "gcc": "https://security.microsoft.com", - "gcc-high": "https://security.microsoft.us", - "dod": "https://security.apps.mil", - "geo-eu": "https://security.microsoft.com", - "geo-uk": "https://security.microsoft.com", - "geo-us": "https://security.microsoft.com", -} - -# https://learn.microsoft.com/en-us/defender-xdr/usgov -MICROSOFT_DEFENDER_XDR_API_LOGIN = { - "com": "https://login.windows.net", - "gcc": "https://login.microsoftonline.com", - "gcc-high": "https://login.microsoftonline.us", - "dod": "https://login.microsoftonline.us", - "geo-eu": "https://login.windows.net", - "geo-uk": "https://login.windows.net", - "geo-us": "https://login.windows.net", + "gcc": "https://api-gcc.securitycenter.microsoft.us", + "gcc-high": "https://api-gov.securitycenter.microsoft.us", + "dod": "https://api-gov.securitycenter.microsoft.us", } # https://learn.microsoft.com/en-us/graph/deployments#app-registration-and-token-service-root-endpoints diff --git a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py index 4fa6c6c0b6e9..e5e4efbf7468 100644 --- a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py +++ b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.py @@ -1,7 +1,10 @@ import demistomock as demisto # noqa: F401 +import urllib3 from CommonServerPython import * # noqa: F401 from MicrosoftApiModule import * # noqa: E402 +# Disable insecure warnings +urllib3.disable_warnings() """ CONSTANTS """ @@ -60,7 +63,6 @@ def __init__( verify: bool, proxy: bool, base_url: str = BASE_URL, - endpoint_type: str = "com", tenant_id: str = None, enc_key: str = None, client_credentials: bool = False, @@ -80,15 +82,15 @@ def __init__( verify=verify, proxy=proxy, ok_codes=(200, 201, 202, 204), - scope=f"offline_access {MICROSOFT_DEFENDER_XDR_API_SERVICE_ENDPOINTS[endpoint_type]}/mtp/.default", + scope="offline_access https://security.microsoft.com/mtp/.default", self_deployed=True, # We always set the self_deployed key as True because when not using a self # deployed machine, the DEVICE_CODE flow should behave somewhat like a self deployed # flow and most of the same arguments should be set, as we're !not! using OProxy. auth_id=app_id, grant_type=CLIENT_CREDENTIALS if client_credentials else DEVICE_CODE, # used for device code flow - resource=base_url if not client_credentials else None, - token_retrieval_url=f"{MICROSOFT_DEFENDER_XDR_API_LOGIN[endpoint_type]}/organizations/oauth2/v2.0/token" if not client_credentials else None, + resource="https://api.security.microsoft.com" if not client_credentials else None, + token_retrieval_url="https://login.windows.net/organizations/oauth2/v2.0/token" if not client_credentials else None, # used for client credentials flow tenant_id=tenant_id, enc_key=enc_key, @@ -1124,16 +1126,7 @@ def main() -> None: # out of the box by it, just pass ``proxy`` to the Client constructor proxy = params.get("proxy", False) app_id = params.get("creds_client_id", {}).get("password", "") or params.get("app_id") or params.get("_app_id") - - params_endpoint_type = [params.get("endpoint_type", "Custom")] # TODO: check if this is BC - if params_endpoint_type == "Custom": - endpoint_type = "com" - base_url = params.get("base_url") - if not base_url: - raise DemistoException("Base URL is required when endpoint type is set to 'Custom'") - else: - endpoint_type = MICROSOFT_DEFENDER_FOR_ENDPOINT_TYPE[params_endpoint_type] - base_url = MICROSOFT_DEFENDER_XDR_API[endpoint_type] + base_url = params.get("base_url") tenant_id = params.get("creds_tenant_id", {}).get("password", "") or params.get("tenant_id") or params.get("_tenant_id") client_credentials = params.get("client_credentials", False) @@ -1170,7 +1163,6 @@ def main() -> None: app_id=app_id, verify=verify_certificate, base_url=base_url, - endpoint_type=endpoint_type, proxy=proxy, tenant_id=tenant_id, enc_key=enc_key, diff --git a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml index 62893896ecad..58aea6faac69 100644 --- a/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml +++ b/Packs/Microsoft365Defender/Integrations/Microsoft365Defender/Microsoft365Defender.yml @@ -7,31 +7,15 @@ commonfields: version: -1 configuration: - additionalinfo: |- - When selecting the Custom option, the Server URL parameter must be filled. More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender - defaultvalue: Worldwide - display: Endpoint Type - name: endpoint_type - required: false - type: 15 - section: Connect - options: - - Worldwide - - EU Geo Proximity - - UK Geo Proximity - - US Geo Proximity - - US GCC - - US GCC-High - - DoD - - Custom - advanced: true -- display: Server URL (e.g., https://api.security.microsoft.com) + The United States: api-us.security.microsoft.com + Europe: api-eu.security.microsoft.com + The United Kingdom: api-uk.security.microsoft.co + defaultvalue: https://api.security.microsoft.com + display: Endpoint URI name: base_url + required: true type: 0 section: Connect - advanced: true - additionalinfo: |- - More information can be found on the integration page - https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender - required: false - name: creds_client_id type: 9 displaypassword: ID or Client ID From 8f1c344515c03859053dd0cab8b13ecf3c71446e Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 27 Oct 2025 15:28:21 +0200 Subject: [PATCH 08/23] real code complete --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index c9cfff2b7516..7e5e5cbb53e6 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -2038,10 +2038,8 @@ def main(): self_deployed: bool = params.get("self_deployed", False) or managed_identities_client_id is not None api_version: str = params.get("api_version", API_V2) - cloud_service = params.get("cloud_service") or "Custom" - demisto.debug(f'cloud_service: {params.get("cloud_service")}') + cloud_service = params.get("cloud_service") or "Custom" # "Custom" is the default here to support backward compatibility url = (params.get("host", "").rstrip("/") if cloud_service == "Custom" else MICROSOFT_GRAPH_ENDPOINTS[cloud_service]) + "/v1.0/" - demisto.debug(f"url: {url}") if not managed_identities_client_id: if not self_deployed and not enc_key: From 694697b8e36215f6cebcff0cb7295eeff13bcdfc Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 27 Oct 2025 15:31:19 +0200 Subject: [PATCH 09/23] real code complete --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 1 - .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 7e5e5cbb53e6..9fc46151e629 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -2013,7 +2013,6 @@ def list_threat_assessment_requests_command(client: MsGraphClient, args) -> list next_token: str = next_token_value[1] command_results.append( - CommandResults( readable_output=f"Next token is: {next_token}\n" if next_token else None, outputs={"next_token": next_token}, diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml index 10e776c83622..033ac1eb36ff 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml @@ -1576,7 +1576,7 @@ script: type: String - contextPath: MsGraph.eDiscoverySearch.SearchId description: The ID for the eDiscovery search. - type: String + type: String - contextPath: MsGraph.eDiscoverySearch.LastModifiedDateTime description: The last date and time the eDiscovery search was modified. type: String From 638df6ebbb61d920835c9bca0bb261d283823e8a Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Tue, 28 Oct 2025 17:12:16 +0200 Subject: [PATCH 10/23] minor changes --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml index 033ac1eb36ff..15db77b17cda 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml @@ -7,17 +7,19 @@ commonfields: version: -1 configuration: - defaultvalue: Worldwide - display: Microsoft Graph National Cloud Endpoint - name: cloud_service + display: Azure Cloud + name: azure_cloud required: false type: 15 options: - Worldwide + - US GCC - US GCC-High - DoD + - Germany - China - Custom - additionalinfo: When selecting the Custom option, the Microsoft Graph Host URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud + additionalinfo: When selecting the Custom option, the Azure AD endpoint parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true - display: Microsoft Graph Host URL From 737f62decf3f564ac9e767471215aef9ab40adde Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Wed, 29 Oct 2025 13:41:54 +0200 Subject: [PATCH 11/23] minor changes --- .../MicrosoftApiModule/MicrosoftApiModule.py | 8 -------- .../MicrosoftGraphSecurity.py | 15 ++++++++------- .../MicrosoftGraphSecurity.yml | 7 ++++--- 3 files changed, 12 insertions(+), 18 deletions(-) diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index 05f8899be0e0..8bf0073ab005 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -83,14 +83,6 @@ class Resources: MICROSOFT_DEFENDER_FOR_ENDPOINT_TYPE_CUSTOM = "Custom" MICROSOFT_DEFENDER_FOR_ENDPOINT_DEFAULT_ENDPOINT_TYPE = "com" -# https://learn.microsoft.com/en-us/graph/deployments -MICROSOFT_GRAPH_ENDPOINTS = { - "Worldwide": "https://graph.microsoft.com", - "US GCC-High": "https://graph.microsoft.us", - "DoD": "https://dod-graph.microsoft.us", - "China": "https://microsoftgraph.chinacloudapi.cn", -} - # https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-supported?view=o365-worldwide#endpoint-uris # https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide#api MICROSOFT_DEFENDER_FOR_ENDPOINT_API = { diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 9fc46151e629..1a9406928ad6 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -3,7 +3,6 @@ from typing import Any import demistomock as demisto # noqa: F401 -import urllib3 from CommonServerPython import * # noqa: F401 from MicrosoftApiModule import * # noqa: E402 from requests import Response @@ -12,7 +11,6 @@ # disable insecure warnings DEFAULT_KEYS_TO_REPLACE = {"createdDateTime": "CreatedDate"} -urllib3.disable_warnings() APP_NAME = "ms-graph-security" API_V2 = "Alerts v2" @@ -89,7 +87,12 @@ class MsGraphClient: Microsoft Graph Mail Client enables authorized access to a user's Office 365 mail data in a personal account. """ - def __init__(self, tenant_id, proxy, certificate_thumbprint: str | None = None, api_version: str = "", **kwargs): + def __init__( + self, tenant_id, proxy, + certificate_thumbprint: str | None = None, + api_version: str = "", + **kwargs + ): self.ms_client = MicrosoftClient( tenant_id=tenant_id, proxy=proxy, @@ -2036,9 +2039,7 @@ def main(): managed_identities_client_id = get_azure_managed_identities_client_id(params) self_deployed: bool = params.get("self_deployed", False) or managed_identities_client_id is not None api_version: str = params.get("api_version", API_V2) - - cloud_service = params.get("cloud_service") or "Custom" # "Custom" is the default here to support backward compatibility - url = (params.get("host", "").rstrip("/") if cloud_service == "Custom" else MICROSOFT_GRAPH_ENDPOINTS[cloud_service]) + "/v1.0/" + azure_cloud = get_azure_cloud(params, 'MicrosoftGraphSecurity') if not managed_identities_client_id: if not self_deployed and not enc_key: @@ -2100,7 +2101,7 @@ def main(): enc_key=enc_key, redirect_uri=redirect_uri, app_name=APP_NAME, - base_url=url, + azure_cloud=azure_cloud, verify=use_ssl, proxy=proxy, self_deployed=self_deployed, diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml index 15db77b17cda..65d0b31c8635 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml @@ -19,12 +19,13 @@ configuration: - Germany - China - Custom - additionalinfo: When selecting the Custom option, the Azure AD endpoint parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud + additionalinfo: When selecting the Custom option, the Host URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true -- display: Microsoft Graph Host URL +- defaultvalue: https://graph.microsoft.com + display: Host URL name: host - required: false + required: true type: 0 section: Connect advanced: true From 066b86c07ca64726d872c8e92211d6720b3f3987 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Wed, 29 Oct 2025 13:48:42 +0200 Subject: [PATCH 12/23] minor changes --- .../Scripts/MicrosoftApiModule/MicrosoftApiModule.py | 1 + .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 7 +------ .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml | 2 +- 3 files changed, 3 insertions(+), 7 deletions(-) diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index 8bf0073ab005..dc6e60650f5f 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -83,6 +83,7 @@ class Resources: MICROSOFT_DEFENDER_FOR_ENDPOINT_TYPE_CUSTOM = "Custom" MICROSOFT_DEFENDER_FOR_ENDPOINT_DEFAULT_ENDPOINT_TYPE = "com" + # https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-supported?view=o365-worldwide#endpoint-uris # https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide#api MICROSOFT_DEFENDER_FOR_ENDPOINT_API = { diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 1a9406928ad6..029468763480 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -87,12 +87,7 @@ class MsGraphClient: Microsoft Graph Mail Client enables authorized access to a user's Office 365 mail data in a personal account. """ - def __init__( - self, tenant_id, proxy, - certificate_thumbprint: str | None = None, - api_version: str = "", - **kwargs - ): + def __init__(self, tenant_id, proxy, certificate_thumbprint: str | None = None, api_version: str = "", **kwargs): self.ms_client = MicrosoftClient( tenant_id=tenant_id, proxy=proxy, diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml index 65d0b31c8635..77af08d55a0d 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml @@ -25,7 +25,7 @@ configuration: - defaultvalue: https://graph.microsoft.com display: Host URL name: host - required: true + required: false type: 0 section: Connect advanced: true From 8215f559221321fe1eabda83b27b8e462d64d608 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Wed, 29 Oct 2025 16:10:36 +0200 Subject: [PATCH 13/23] minor changes --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 029468763480..89b706a1d72c 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -2097,6 +2097,8 @@ def main(): redirect_uri=redirect_uri, app_name=APP_NAME, azure_cloud=azure_cloud, + azure_ad_endpoint=azure_cloud.endpoints.active_directory, + token_retrieval_url=urljoin(azure_cloud.endpoints.active_directory, f'/{tenant}/oauth2/v2.0/token'), verify=use_ssl, proxy=proxy, self_deployed=self_deployed, From 4b3f42f1ceb24602d1a804cc4a2f02be5c446eea Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Wed, 29 Oct 2025 16:21:17 +0200 Subject: [PATCH 14/23] works --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 1 + 1 file changed, 1 insertion(+) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 89b706a1d72c..3ee05d816278 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -2099,6 +2099,7 @@ def main(): azure_cloud=azure_cloud, azure_ad_endpoint=azure_cloud.endpoints.active_directory, token_retrieval_url=urljoin(azure_cloud.endpoints.active_directory, f'/{tenant}/oauth2/v2.0/token'), + base_url=urljoin(azure_cloud.endpoints.microsoft_graph_resource_id, "/v1.0/"), verify=use_ssl, proxy=proxy, self_deployed=self_deployed, From 784244ecc87eb78f09ff1400c801aed237ccf38e Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Wed, 29 Oct 2025 17:00:33 +0200 Subject: [PATCH 15/23] works --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 3ee05d816278..188f8c637e15 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -274,7 +274,7 @@ def create_mail_assessment_request(self, recipient_email, expected_assessment, c "recipientEmail": recipient_email, "expectedAssessment": expected_assessment, "category": category, - "messageUri": f"{self.ms_client.ms_url}/v1.0/users/{user_id}/messages/{message_id}", + "messageUri": urljoin(self.ms_client._base_url, "users/{user_id}/messages/{message_id}"), } return self.ms_client.http_request(method="POST", url_suffix=THREAT_ASSESSMENT_URL_PREFIX, json_data=body) From 99d49efbf509a82f1956f410faf3790d403e467e Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Thu, 30 Oct 2025 11:26:29 +0200 Subject: [PATCH 16/23] docs --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml | 1 + .../Integrations/MicrosoftGraphSecurity/README.md | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml index 77af08d55a0d..57e514f6731e 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml @@ -29,6 +29,7 @@ configuration: type: 0 section: Connect advanced: true + additionalinfo: The host URL. When using this parameter, select the Custom option for the Azure Cloud. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud - defaultvalue: Alerts v2 display: MS graph security alert API Version name: api_version diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/README.md b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/README.md index 9c5dfb75bf55..40940cabfcbb 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/README.md +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/README.md @@ -58,7 +58,8 @@ For more information, see: https://github.com/microsoftgraph/security-api-soluti | **Parameter** | **Description** | **Required** | | --- | --- | --- | - | Host URL | The host URL. | True | + | Azure Cloud | When selecting the Custom option, the Host URL parameter must be filled. More information about National clouds can be found [here](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud). | False | + | Host URL | The host URL. When using this parameter, select the Custom option for the Azure Cloud. More information about National clouds can be found [here](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud). | False | | MS graph security version | MS graph security API version. | True | | Application ID or Client ID | The app registration ID. | True | | Token or Tenant ID | The tenant ID. | True | From 490a0cbf162a60e042605d9928926b15fd1d8ce8 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Thu, 30 Oct 2025 14:02:18 +0200 Subject: [PATCH 17/23] RE --- Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_39.md | 6 ++++++ Packs/MicrosoftGraphSecurity/pack_metadata.json | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_39.md diff --git a/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_39.md b/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_39.md new file mode 100644 index 000000000000..f8c8d58731f6 --- /dev/null +++ b/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_39.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### Microsoft Graph Security + +- Added support for All Azure Cloud environments: Public, GCC, GCC-High, DoD, Germany, China. diff --git a/Packs/MicrosoftGraphSecurity/pack_metadata.json b/Packs/MicrosoftGraphSecurity/pack_metadata.json index 9a127677a453..3a40cbb6574b 100644 --- a/Packs/MicrosoftGraphSecurity/pack_metadata.json +++ b/Packs/MicrosoftGraphSecurity/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Microsoft Graph Security", "description": "Unified gateway to security insights - all from a unified Microsoft Graph\n Security API.", "support": "xsoar", - "currentVersion": "2.2.36", + "currentVersion": "2.2.39", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", From a385c623e115ce15a26d3f17bc9018439522a01c Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Thu, 30 Oct 2025 14:55:26 +0200 Subject: [PATCH 18/23] pre-commit --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py index 188f8c637e15..17f62acb4d37 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.py @@ -2034,7 +2034,7 @@ def main(): managed_identities_client_id = get_azure_managed_identities_client_id(params) self_deployed: bool = params.get("self_deployed", False) or managed_identities_client_id is not None api_version: str = params.get("api_version", API_V2) - azure_cloud = get_azure_cloud(params, 'MicrosoftGraphSecurity') + azure_cloud = get_azure_cloud(params, "MicrosoftGraphSecurity") if not managed_identities_client_id: if not self_deployed and not enc_key: @@ -2098,7 +2098,7 @@ def main(): app_name=APP_NAME, azure_cloud=azure_cloud, azure_ad_endpoint=azure_cloud.endpoints.active_directory, - token_retrieval_url=urljoin(azure_cloud.endpoints.active_directory, f'/{tenant}/oauth2/v2.0/token'), + token_retrieval_url=urljoin(azure_cloud.endpoints.active_directory, f"/{tenant}/oauth2/v2.0/token"), base_url=urljoin(azure_cloud.endpoints.microsoft_graph_resource_id, "/v1.0/"), verify=use_ssl, proxy=proxy, From 9ef2fb3dfb72a94e3fb11186df3ab52b475d35d5 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Sun, 9 Nov 2025 10:19:56 +0200 Subject: [PATCH 19/23] RN --- .../ReleaseNotes/{2_2_39.md => 2_2_41.md} | 0 Packs/MicrosoftGraphSecurity/pack_metadata.json | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename Packs/MicrosoftGraphSecurity/ReleaseNotes/{2_2_39.md => 2_2_41.md} (100%) diff --git a/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_39.md b/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md similarity index 100% rename from Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_39.md rename to Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md diff --git a/Packs/MicrosoftGraphSecurity/pack_metadata.json b/Packs/MicrosoftGraphSecurity/pack_metadata.json index 3a40cbb6574b..cf493662a47d 100644 --- a/Packs/MicrosoftGraphSecurity/pack_metadata.json +++ b/Packs/MicrosoftGraphSecurity/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Microsoft Graph Security", "description": "Unified gateway to security insights - all from a unified Microsoft Graph\n Security API.", "support": "xsoar", - "currentVersion": "2.2.39", + "currentVersion": "2.2.41", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", From 3a32740e5d9871894304d31c7082a551ee655120 Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Sun, 9 Nov 2025 12:07:53 +0200 Subject: [PATCH 20/23] docs --- .../MicrosoftGraphSecurity_description.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md index a03f1d6df36d..1b96cb95d787 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md @@ -34,3 +34,16 @@ Follow one of these steps for authentication based on Azure Managed Identities: 3. Select the **Use Azure Managed Identities** checkbox. For more information, see [Managed identities for Azure resources](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview). + +### Using National Cloud + +Using a national cloud endpoint is supported by setting the **Azure Cloud** parameter to one of the following options: + +* Worldwide: `https://graph.microsoft.com` +* US GCC: `https://graph.microsoft.us` +* US GCC-High: `https://graph.microsoft.us` +* DoD: `https://dod-graph.microsoft.us` +* Germany: `https://graph.microsoft.de` +* China: `https://microsoftgraph.chinacloudapi.cn` + +See [Microsoft Integrations - Using National Cloud](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud) for more information. From 146489771dd63c3c3136d44ed4ec6b357968517f Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Sun, 9 Nov 2025 13:59:38 +0200 Subject: [PATCH 21/23] revert RN chnages --- .../MicrosoftGraphSecurity_description.md | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md index 1b96cb95d787..a03f1d6df36d 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity_description.md @@ -34,16 +34,3 @@ Follow one of these steps for authentication based on Azure Managed Identities: 3. Select the **Use Azure Managed Identities** checkbox. For more information, see [Managed identities for Azure resources](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview). - -### Using National Cloud - -Using a national cloud endpoint is supported by setting the **Azure Cloud** parameter to one of the following options: - -* Worldwide: `https://graph.microsoft.com` -* US GCC: `https://graph.microsoft.us` -* US GCC-High: `https://graph.microsoft.us` -* DoD: `https://dod-graph.microsoft.us` -* Germany: `https://graph.microsoft.de` -* China: `https://microsoftgraph.chinacloudapi.cn` - -See [Microsoft Integrations - Using National Cloud](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud) for more information. From e59a78c86d3fe2f610d953235345507a96539fc2 Mon Sep 17 00:00:00 2001 From: Jacob Levy <129657918+jlevypaloalto@users.noreply.github.com> Date: Sun, 9 Nov 2025 14:38:21 +0200 Subject: [PATCH 22/23] Update Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md Co-authored-by: Arad Carmi <62752352+AradCarmi@users.noreply.github.com> --- Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md b/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md index f8c8d58731f6..755339c257e8 100644 --- a/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md +++ b/Packs/MicrosoftGraphSecurity/ReleaseNotes/2_2_41.md @@ -3,4 +3,4 @@ ##### Microsoft Graph Security -- Added support for All Azure Cloud environments: Public, GCC, GCC-High, DoD, Germany, China. +- Added a new parameter **Azure Cloud** to support all of the following environments: Public, GCC, GCC-High, DoD, Germany, and China. From 380cd1cdb9f50038f697fa7999a1804dc84505bc Mon Sep 17 00:00:00 2001 From: jlevypaloalto Date: Mon, 10 Nov 2025 10:39:05 +0200 Subject: [PATCH 23/23] remove default --- .../MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml index 7ac8c4e80143..d0ad85e505a6 100644 --- a/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml +++ b/Packs/MicrosoftGraphSecurity/Integrations/MicrosoftGraphSecurity/MicrosoftGraphSecurity.yml @@ -22,8 +22,7 @@ configuration: additionalinfo: When selecting the Custom option, the Host URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud section: Connect advanced: true -- defaultvalue: https://graph.microsoft.com - display: Host URL +- display: Host URL name: host required: false type: 0