API Workflows

Auth and Permission Split

Threat Intelligence API Selector

Sentinel and Defender both handle indicators, but the API choice depends on whether the goal is Sentinel investigation context, TAXII feed import/export, or endpoint enforcement.

flowchart TD
  A[Threat intel source] --> B{Native STIX TAXII feed}
  B -->|Yes| C[TAXII connector]
  B -->|No| D{Custom app or TIP}
  D -->|STIX objects| E[Sentinel TI Upload API]
  D -->|MDE prevention action| F[MDE Indicators API]
  D -->|Legacy Graph tiIndicators| G[Plan migration]
  E --> H[ThreatIntelIndicators and ThreatIntelObjects]
  F --> I[Endpoint allow block alert audit]

Data-Plane Query API Comparison

Set Up Sentinel

Create or manage the Log Analytics workspace, enable Sentinel onboarding state, and configure Sentinel resources.

Auth

Azure RBAC on the subscription, resource group, workspace, and Sentinel workspace scope.

Endpoints

• PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}?api-version=2023-09-01
• PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/onboardingStates/default?api-version=2025-09-01

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/onboardingStates/default?api-version=2025-09-01
Authorization: Bearer <arm-token>
Content-Type: application/json

{
  "properties": {
    "customerManagedKey": false
  }
}

Create Analytics Rules

Create scheduled, Microsoft security, NRT, Fusion, ML behavior analytics, or threat intelligence analytics rules.

Auth

Azure RBAC with write access to Microsoft.SecurityInsights alert rules.

Endpoints

• PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}?api-version=2025-09-01

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}?api-version=2025-09-01
Authorization: Bearer <arm-token>
Content-Type: application/json

{
  "kind": "Scheduled",
  "properties": {
    "displayName": "Multiple failed sign-ins",
    "enabled": true,
    "query": "SigninLogs | where ResultType != 0 | summarize count() by UserPrincipalName, bin(TimeGenerated, 15m)",
    "queryFrequency": "PT15M",
    "queryPeriod": "PT15M",
    "severity": "Medium",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 5
  }
}

Create Playbooks and Automation

Deploy the Logic App playbook, then attach it to incidents through an automation rule or alert rule action.

Auth

Azure RBAC for Logic Apps workflows and Sentinel automation rules.

Endpoints

• PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{workflowName}?api-version=2019-05-01
• PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/automationRules/{automationRuleId}?api-version=2025-09-01

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/automationRules/{automationRuleId}?api-version=2025-09-01
Authorization: Bearer <arm-token>
Content-Type: application/json

{
  "properties": {
    "displayName": "Run phishing triage playbook",
    "order": 1,
    "triggeringLogic": {
      "isEnabled": true,
      "triggersOn": "Incidents",
      "triggersWhen": "Created"
    },
    "actions": [
      {
        "order": 1,
        "actionType": "RunPlaybook",
        "actionConfiguration": {
          "logicAppResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{workflowName}"
        }
      }
    ]
  }
}

Run KQL Against Sentinel

Run KQL against Sentinel workspace tables such as SecurityIncident, SecurityAlert, ThreatIntelIndicators, and connected data.

Auth

Microsoft Entra token for Azure Monitor plus Log Analytics workspace read permissions.

Endpoints

• POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query
• POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/query?api-version=2022-10-27

POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query
Authorization: Bearer <logs-token>
Content-Type: application/json

{
  "query": "SecurityIncident | summarize count() by Severity, Status | order by count_ desc",
  "timespan": "P7D"
}

Run Cross-Workspace Sentinel KQL

Query multiple Sentinel or Log Analytics workspaces in one KQL request for multi-tenant, regional, or split-retention designs.

Auth

Microsoft Entra token for Azure Monitor plus query/read permissions on every workspace in scope.

Endpoints

• POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query
• POST https://api.loganalytics.azure.com/v1/workspaces/{workspaceId}/query

POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query
Authorization: Bearer <logs-token>
Content-Type: application/json

{
  "query": "union SecurityIncident, workspace('00000000-0000-0000-0000-000000000001').SecurityIncident | where TimeGenerated > ago(7d) | summarize count() by Severity, Status",
  "timespan": "P7D",
  "workspaces": [
    "00000000-0000-0000-0000-000000000002"
  ]
}

Run Defender XDR Hunting

Run KQL over Defender XDR tables such as DeviceEvents, EmailEvents, UrlClickEvents, MessageEvents, and Identity tables.

Auth

Microsoft Graph ThreatHunting.Read.All for Graph, or legacy Microsoft Threat Protection permissions for older Defender XDR API paths.

Endpoints

• POST https://graph.microsoft.com/v1.0/security/runHuntingQuery
• POST https://api.security.microsoft.com/api/advancedhunting/run

POST https://graph.microsoft.com/v1.0/security/runHuntingQuery
Authorization: Bearer <graph-token>
Content-Type: application/json

{
  "query": "EmailEvents | where Timestamp > ago(1d) | summarize count() by ThreatTypes, DeliveryAction"
}

Create Watchlists

Create watchlist containers and upload or manage watchlist items for enrichment and detection logic.

Auth

Azure RBAC with write access to Microsoft.SecurityInsights watchlists.

Endpoints

• PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}?api-version=2025-09-01
• PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}?api-version=2025-09-01

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/high-value-assets/watchlistItems/{watchlistItemId}?api-version=2025-09-01
Authorization: Bearer <arm-token>
Content-Type: application/json

{
  "properties": {
    "itemsKeyValue": {
      "Hostname": "dc01.contoso.com",
      "Owner": "Identity team",
      "Criticality": "High"
    }
  }
}

Ingest IOCs Into Sentinel

Upload STIX 2.0/2.1 indicators and other supported STIX objects from custom TIPs or scripts into ThreatIntelIndicators and ThreatIntelObjects. Current STIX upload API limits are 100 objects per request and 100 requests per minute, for about 10,000 objects per minute maximum throughput.

Auth

Microsoft Entra token plus Microsoft Sentinel Contributor at the workspace scope.

Endpoints

• POST https://api.ti.sentinel.azure.com/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload?api-version=2024-02-01-preview

POST https://api.ti.sentinel.azure.com/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload?api-version=2024-02-01-preview
Authorization: Bearer <token>
Content-Type: application/json

{
  "sourcesystem": "custom-tip",
  "stixobjects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--<uuid>",
      "created": "2026-08-11T00:00:00Z",
      "modified": "2026-08-11T00:00:00Z",
      "pattern": "[ipv4-addr:value = '203.0.113.10']",
      "pattern_type": "stix",
      "valid_from": "2026-08-11T00:00:00Z"
    }
  ]
}

Ingest Custom Logs With DCRs

Send custom JSON records into a Sentinel-connected Log Analytics workspace through a Data Collection Rule stream.

Auth

Microsoft Entra token using the https://monitor.azure.com/.default scope and appropriate Azure RBAC on the DCR or target scope.

Endpoints

• POST https://{dcr-or-dce-endpoint}/dataCollectionRules/{dcrImmutableId}/streams/{streamName}?api-version=2023-01-01

POST https://{endpoint}/dataCollectionRules/{dcrImmutableId}/streams/{streamName}?api-version=2023-01-01
Authorization: Bearer <monitor-token>
Content-Type: application/json

[
  {
    "TimeGenerated": "2026-08-11T00:00:00Z",
    "Source": "custom-app",
    "Severity": "Medium",
    "Message": "Suspicious activity observed"
  }
]

from azure.identity import ClientSecretCredential
import requests

tenant_id = "<tenant-id>"
client_id = "<app-client-id>"
client_secret = "<client-secret>"
endpoint = "https://<dcr-or-dce-endpoint>"
dcr_immutable_id = "<dcr-immutable-id>"
stream_name = "Custom-SecurityEvents_CL"

credential = ClientSecretCredential(tenant_id, client_id, client_secret)
token = credential.get_token("https://monitor.azure.com/.default")

records = [
    {
        "TimeGenerated": "2026-08-11T00:00:00Z",
        "Source": "custom-app",
        "Severity": "Medium",
        "Message": "Suspicious activity observed",
    }
]

url = f"{endpoint}/dataCollectionRules/{dcr_immutable_id}/streams/{stream_name}?api-version=2023-01-01"
response = requests.post(
    url,
    headers={
        "Authorization": f"Bearer {token.token}",
        "Content-Type": "application/json",
    },
    json=records,
    timeout=30,
)
response.raise_for_status()

Ingest Custom Indicators Into MDE

Create custom indicators for Defender for Endpoint prevention, alerting, allow, block, and audit actions.

Auth

WindowsDefenderATP API permissions such as Ti.Read.All and Ti.ReadWrite.All.

Endpoints

• POST https://api.security.microsoft.com/api/indicators
• POST https://api.security.microsoft.com/api/indicators/import

POST https://api.security.microsoft.com/api/indicators/import
Authorization: Bearer <mde-token>
Content-Type: application/json

{
  "Indicators": [
    {
      "indicatorValue": "203.0.113.10",
      "indicatorType": "IpAddress",
      "title": "Custom suspicious IP",
      "application": "custom-tip",
      "expirationTime": "2026-12-31T00:00:00Z",
      "action": "Alert",
      "severity": "Medium"
    }
  ]
}

Run MDE Device Actions

Isolate devices, restrict app execution, run antivirus scans, collect investigation packages, offboard devices, stop and quarantine files, and start Live Response sessions.

Auth

WindowsDefenderATP machine action permissions, for example Machine.Isolate, Machine.Scan, Machine.CollectForensics, and Machine.LiveResponse.

Endpoints

• POST https://api.security.microsoft.com/api/machines/{machineId}/isolate
• POST https://api.security.microsoft.com/api/machines/{machineId}/runAntiVirusScan
• POST https://api.security.microsoft.com/api/machines/{machineId}/collectInvestigationPackage
• GET https://api.security.microsoft.com/api/machineactions

POST https://api.security.microsoft.com/api/machines/{machineId}/isolate
Authorization: Bearer <mde-token>
Content-Type: application/json

{
  "Comment": "Isolating host during active incident IR-2026-001",
  "IsolationType": "Full"
}