MSDefenderEndpoints is not working

Hello,

Plugin /opt/Cortex-Analyzers/responders/MSDefenderEndpoints/MSDefenderEndpoints.py is not working.

I used one Windows 10 Enterprise E5 for tests, set all API permissions: API Permissions > Add permission > APIs my organization uses > type WindowsDefenderATP and click on WindowsDefenderATP Choose Application permissions, select Alert.Read.All AND TI.ReadWrite.All AND Machine.ReadAll AND Machine.Isolate AND Machine.Scan > Click on Add permissions.

When I m trying to use MSDefender-FullVirusscan_1_0 I recive the following errors:

A. In /opt/cortex/logs/application.log or /var/log/cortex/application.log:

2023-02-05 01:38:06,244 [INFO] from org.thp.cortex.services.AccessLogFilter in application-akka.actor.default-dispatcher-5 - 10.0.0.5 POST /api/responder/c3bd92ef1f22df7e261ea0b032d7e2c6/run took 739ms and returned 200 2642 bytes
2023-02-05 01:38:06,992 [INFO] from org.thp.cortex.services.AccessLogFilter in application-akka.actor.default-dispatcher-5 - 127.0.0.1 GET /api/alert took 8ms and returned 200 2 bytes
2023-02-05 01:38:07,256 [INFO] from org.thp.cortex.services.AuditActor in application-akka.actor.default-dispatcher-9 - Job Wgk5H4YB5zoyAmziKrZL has be updated (JsDefined("InProgress"))
2023-02-05 01:38:07,257 [WARN] from org.thp.cortex.services.JobRunnerSrv in application-responder-29 - worker c3bd92ef1f22df7e261ea0b032d7e2c6 can't be run with docker (doesn't have image)
2023-02-05 01:38:07,257 [INFO] from org.thp.cortex.services.ProcessJobRunnerSrv in application-responder-29 - Execute /opt/Cortex-Analyzers/responders/MSDefenderEndpoints/MSDefenderEndpoints.py in /opt/Cortex-Analyzers/responders, timeout is 30 minutes
2023-02-05 01:38:08,268 [INFO] from org.thp.cortex.services.AuditActor in application-akka.actor.default-dispatcher-6 - Job Wgk5H4YB5zoyAmziKrZL has be updated (JsDefined("Failure"))
2023-02-05 01:38:08,268 [INFO] from org.thp.cortex.services.JobSrv in application-akka.actor.default-dispatcher-9 - Job Wgk5H4YB5zoyAmziKrZL has finished with status Failure
2023-02-05 01:38:11,854 [INFO] from org.thp.cortex.services.AccessLogFilter in application-akka.actor.default-dispatcher-12 - 10.0.0.5 GET /api/job/Wgk5H4YB5zoyAmziKrZL/waitreport?atMost=1%20second took 7ms and returned 200 7640 bytes

And the error from the Cortex:

[thehive:case_artifact] [filename] something.exe

{
"errorMessage": "",
"input": "{"data":{"_id":"~90112","id":"~90112","createdBy":"abc@abc.com","updatedBy":"TEST@TEST.COM","createdAt":1675078141604,"updatedAt":1675428834792,"_type":"case_artifact","dataType":"filename","data":"winpeasx64.exe","startDate":1675078141604,"tlp":2,"tags":[],"ioc":true,"sighted":false,"reports":{},"stats":{},"case":{"_id":"~86240","id":"~86240","createdBy":"abc@abc.com","updatedBy":"TEST@TEST.COM","createdAt":1675078141599,"updatedAt":1675252008636,"_type":"case","caseId":4,"title":"Antimalware Action Taken","description":"Microsoft Antimalware has taken an action to protect this machine from malware or other potentially unwanted software.\n\r\n\rLink: https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/REDACTED/resourceGroups/SREDACTED/providers/Microsoft.OperationalInsights/workspaces/REDACTED/providers/Microsoft.SecurityInsights/Incidents/REDACTED\\n\\rAlertLink: https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=VirTool:MSIL/Cajan.A!MTB\",\"severity\":1,\"startDate\":1675078141598,\"endDate\":null,\"impactStatus\":null,\"resolutionStatus\":null,\"tags\":[\"mail:abc@abc.com\",\"mail sent","mail:abc@abc.com","abc@abc.com","abc@com"],"flag":false,"tlp":2,"pap":2,"status":"Open","summary":null,"owner":"abc@redacted.com","customFields":{"sentinelIncidentNumber":{"integer":null,"order":0},"alertIds":{"string":"REDACTED","order":1},"incidentURL":{"string":"https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/REDACTED/resourceGroups/REDACTED/providers/Microsoft.OperationalInsights/workspaces/REDACTEDL/providers/Microsoft.SecurityInsights/Incidents/redacted\",\"order\":2}},\"stats\":{},\"permissions\":[]}},\"dataType\":\"thehive:case_artifact\",\"tlp\":2,\"pap\":2,\"message\":\"\",\"parameters\":{\"organisation\":\"xyz\",\"user\":\"abc@com\"},\"config\":{\"resourceAppIdUri\":\"https://api.securitycenter.windows.com\",\"proxy_https\":null,\"cacerts\":null,\"oAuthUri\":\"https://login.windows.net/\",\"check_tlp\":true,\"max_tlp\":2,\"check_pap\":true,\"max_pap\":2,\"jobTimeout\":30,\"service\":\"runFullVirusScan\",\"proxy_http\":null,\"appId\":\"83041dec-e870-4de9-aa61-416aa751faf7\",\"tenantId\":\"TENANT-ID-REDACTED\",\"appSecret\":\"REMOVED\"}}",
"success": false
}

I didn't achieve anything by modifying the script, I ran it locally, without success. I am indebted if you help me. Thank you

Start with /opt/Cortex-Analyzers/responders/MSDefenderEndpoints/MSDefenderEndpoints.py and the runFullVirusScan service configuration. Reproduce the failure using the logged Cortex job input and compare the script's local behavior with the application.log failure. Done means MSDefender-FullVirusscan_1_0 completes successfully with the configured Microsoft Defender permissions.