Microsoft Defender for Endpoint Integration

Forward AI interaction events to Microsoft Defender for Endpoint to gain endpoint-level visibility of AI platform usage and policy violations.

Overview

This integration enables:

• Endpoint visibility of AI platform activity
• Correlation of AI events with endpoint events
• Automated response through Defender playbooks
• Risk scoring based on AI interaction patterns
• Compliance reporting combining endpoint and AI data

Data Flow:

AI Interaction → Noxys API → Defender API → Incident correlation → Response

Prerequisites

• Microsoft Defender for Endpoint (E5 or standalone license)
• Azure AD / Entra ID tenant
• Admin role in Noxys
• Security Admin role in Microsoft Defender
• HTTPS endpoint connectivity

Step 1: Create API Client in Azure

Register Noxys in Entra ID to access Defender APIs.

1. Azure Portal → App registrations → New registration
2. Configure:
   • Name: Noxys Defender Integration
   • Supported account types: Single tenant
3. Register
4. Note Client ID

Step 2: Generate Client Secret

1. Certificates & secrets → New client secret
2. Configure:
   • Description: Defender API
   • Expires: 24 months
3. Copy secret value

Step 3: Configure API Permissions

Grant Defender API permissions.

1. API permissions → Add a permission
2. Select APIs my organization uses
3. Search for WindowsDefenderATP (Microsoft Defender for Endpoint)
4. Choose Application permissions:
   • Alert.ReadWrite.All
   • Incident.ReadWrite.All
   • Machine.Read.All
5. Grant admin consent

Step 4: Get Defender Tenant Info

Find your Defender for Endpoint tenant ID.

1. Microsoft Defender Portal → Settings → API
2. Note:
   • Tenant ID (displayed at top)
   • API URL (e.g., https://api.securitycenter.windows.com)

Step 5: Enable in Noxys

Configure Defender integration in Noxys.

1. Noxys Admin Panel → Integrations → Microsoft Defender
2. Click Enable Integration
3. Configure:

Field	Value
Tenant ID	Your Azure tenant ID
Client ID	App registration Client ID
Client Secret	Client secret from step 2
Defender API URL	From step 4

4. Click Test Connection
   • Should show: "✓ Successfully connected to Defender for Endpoint"
5. Click Save

Step 6: Configure Event Forwarding

Select which events to send to Defender.

1. Settings → Event Forwarding
2. Enable:
   • ✓ interaction.policy_violated — Policy violations
   • ✓ interaction.high_risk — High-risk interactions
   • ✓ alert.severity_critical — Critical alerts
   • ✓ alert.severity_high — High severity alerts
3. Click Save

Step 7: Create Defender Alerts

Noxys interactions automatically create incidents in Defender.

1. Microsoft Defender Portal → Incidents
2. Filter by Noxys
3. Should see incidents like:
   • "High-risk AI interaction detected"
   • "Policy violation on user machine"

Example incident details:

Title: Policy violation - Block PII on ChatGPT
Severity: High
Category: AI Firewall
Details:
  Platform: ChatGPT
  Risk Score: 0.95
  Risk Signal Detected: Email address
  User: alice@acme.fr
  Device: ALICE-LAPTOP
  Timestamp: 2026-03-20 14:32:00

Step 8: Create Response Rules

Automatically respond to AI-related incidents.

1. Settings → Automated investigation and response
2. Click Create rule
3. Configure:

Setting	Value
Name	"Block user on critical AI violation"
Condition	Threat type = "AI Firewall" AND Severity = "High"
Action	Isolate device / Alert user / Create ticket

4. Save

Advanced: Machine Learning Integration

Use Defender's machine learning to score AI interaction risk.

1. Enable: Settings → Advanced features → Automated investigation
2. Noxys interaction data feeds ML models
3. Defender correlates with endpoint events
4. Combined risk score affects incident severity

Incident Correlation

Defender automatically correlates AI events with endpoint events:

Timeline:
14:30 - ChatGPT access from ALICE-LAPTOP
14:31 - Risk Signal classified as Restricted
14:32 - Policy violation: Block triggered
14:35 - Suspicious network activity from ALICE-LAPTOP
→ Correlated incident created

Defender Advanced Hunting

Query Noxys data using Defender's advanced hunting.

1. Hunting → Advanced hunting → Create query
2. Query Noxys custom table:

NoxysInteractions
| where RiskScore > 0.8
| join (DeviceNetworkInfo) on DeviceId
| summarize HighRiskCount=count() by DeviceId, DeviceName
| where HighRiskCount > 5

3. Create detection rule from query

Integration with Threat Analytics

Monitor AI-related threats in Threat Analytics.

1. Threat analytics → Create dashboard
2. Add cards for:
   • "AI platform usage trends"
   • "High-risk interaction rate"
   • "Policy violations by platform"

Troubleshooting

Events Not Appearing in Defender

1. Verify integration is Enabled
   • Settings → Integrations → Microsoft Defender
2. Check event forwarding is configured
   • Settings → Event Forwarding
3. Test connection again
4. Check Defender API URL is correct
5. Verify permissions granted:
   • Alert.ReadWrite.All
   • Incident.ReadWrite.All

Incidents Not Created

1. Verify events match forwarding criteria
2. Check Defender is receiving API calls
   • Defender Portal → Settings → API → Audit log
3. Verify client secret hasn't expired
4. Check network connectivity between Noxys and Defender

Correlation Not Working

1. Ensure both Noxys and Defender have endpoint data
2. Verify device names match between systems
3. Check incident timeline overlap
4. Wait 5-10 minutes for ML model update

Cost Considerations

• Defender for Endpoint: E5 license required (~$15/user/month)
• Noxys Defender integration: Included, no additional cost
• API calls: Included in Defender subscription

Best Practices

1. Forward only critical events

   • Reduces noise in Defender incidents
   • Focus on policy_violated and severity_high+

2. Use descriptive incident details

   • Include platform, risk score, Risk Signals type
   • Helps SOC team investigation

3. Set up automated playbooks

   • Auto-isolate devices with repeated violations
   • Create tickets for incident response team

4. Monitor correlation quality

   • Review incidents weekly
   • Adjust rules if too many false positives

5. Leverage ML scoring

   • Let Defender ML correlate patterns
   • Don't override automatically-determined severity

Compliance & Audit

Defender audit log tracks all API calls:

1. Defender Portal → Settings → API → Audit log
2. Export for compliance:
   • GDPR requests
   • SOC 2 audits
   • Security reviews

Disabling Integration

If you need to disable Defender integration:

1. Integrations → Microsoft Defender → Disable
2. No more incidents are created
3. Existing incidents remain in Defender
4. Data is not deleted

To re-enable:

1. Follow configuration steps again
2. Events resume flowing to Defender

Integration with Other Microsoft Services

Defender integrations also enable:

• Microsoft Sentinel: Export incidents to Sentinel
• Microsoft 365 Defender: Unified threat dashboard
• Intune: Device compliance enforcement

Support

• Defender Docs: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/
• Advanced Hunting: https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview
• Noxys Support: support@noxys.eu

PII alert mapping (Noxys signal -> Defender alert)

Noxys signals map to Microsoft Defender alert severity at the connector layer. Default mapping is editable in Noxys Console -> Integrations -> Microsoft Defender -> Severity mapping. Alerts ship via the Microsoft Graph Security API (https://graph.microsoft.com/v1.0/security/alerts_v2).

Noxys classification	Noxys severity	Defender alert severity	Defender category
CREDIT_CARD, IBAN, SSN	CRITICAL	High	Exfiltration
SECRET (API key, token)	CRITICAL	High	CredentialAccess
EMAIL (bulk)	HIGH	Medium	Collection
IP (confidential)	HIGH	Medium	Collection
CODE (proprietary)	MEDIUM	Low	Collection
SHADOW_AI (unvetted platform)	MEDIUM	Low	CommandAndControl

The Noxys event body is preserved in additionalData (Graph Security schema) under the noxys key — Defender XDR custom detection KQL can read it directly.

Host isolation via Defender for Endpoint API

Defender supports two isolation modes: Full (no network) and Selective (allows Defender agent traffic only). Noxys recommends Full for CRITICAL alerts and never isolates on MEDIUM or LOW.

Path A: Defender automated investigation (recommended)

1. Microsoft 365 Defender portal -> Settings -> Endpoints -> Advanced features
2. Enable Automated Investigation and Live Response
3. Hunting -> Custom detection rules -> Create new rule:

AlertEvidence
| where Title startswith "Noxys:"
| where Severity == "High"
| extend Classification = tostring(parse_json(AdditionalFields).noxys.classification)
| where Classification in ("CREDIT_CARD", "IBAN", "SSN", "SECRET")
| project Timestamp, AlertId, DeviceId, Classification

4. Set Response action -> Isolate device with isolation type Full
5. Save, run in test mode for 7 days, then enable

Path B: Noxys-driven push (advanced)

Enable only after 30 days of manual operation and an approved runbook.

1. Noxys Console -> Integrations -> Microsoft Defender -> Advanced
2. Toggle Push host isolation on CRITICAL alerts
3. Confirm the Azure AD app has the Machine.Isolate application permission (WindowsDefenderATP API), admin-consented

Noxys then calls:

POST https://api.securitycenter.microsoft.com/api/machines/{machineId}/isolate
Authorization: Bearer <azure-ad-token>
Content-Type: application/json

{
  "Comment": "Noxys: CRITICAL PII exfiltration to unvetted AI platform",
  "IsolationType": "Full"
}

A 201 Created response flips the Noxys alert state to contained and writes an audit row. The Defender agent on the host shows the isolation banner within 5-15 seconds.

Prerequisites checklist for isolation

• Azure AD App registration with the following Application permissions (admin-consented):
  • WindowsDefenderATP / Machine.Isolate
  • WindowsDefenderATP / Machine.Read.All
  • Microsoft Graph / SecurityAlert.ReadWrite.All
• Defender for Endpoint Plan 2 (P2) license on every device you want to isolate
• Tenant has accepted the Defender API end-user license terms

Test it

# Inject a synthetic CRITICAL alert into Noxys (staging tenant)
curl -X POST https://api-staging.noxys.cloud/v1/alerts/test \
  -H "Authorization: Bearer $NOXYS_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "severity": "CRITICAL",
    "classification": "SECRET",
    "platform_id": "deepseek",
    "user_sub": "test-user@corp.eu",
    "host_id": "<defender-machine-id>"
  }'

Expected within 90 seconds:

• Alert appears in Microsoft 365 Defender -> Incidents & alerts, source = "Noxys AI Firewall"
• Custom detection rule fires, Defender isolates the test device
• Noxys alert state moves to contained

Related Integrations

• EDR Overview — Story-level view of the EDR integration family
• Microsoft Sentinel — SIEM integration
• CrowdStrike Falcon — Alternative EDR
• Microsoft Entra ID — Identity integration