If there is one thing that I’ve been striving to automate it’s the blocking of malicious IOCs detected during phishing analysis by adding Tenant Allow/Block List entries. The issue that still keeps arising is the Microsoft Security Graph API being in preview for this function.
I’m looking at workarounds, including running a PS that authenticates with a cert. Alternatively, I’m looking at Azure Runbooks that could run this PS for me within the MS tenant, but I would need to find a way to trigger this.
I’ve seen examples of people managing Sharepoint spreadsheets, which host IOCs, and corresponding Power Automate functions that update the TABL with the spreadsheet content.
I’m pleaing with this community…has anyone found a reliable and clean method of adding entries to the Defender TABL via automation? Or has anyone actually worked with the preview API successfully?
Sharepoint has an outbound webhook feature. We don’t have a plugin that writes to Sharepoint, but it is easy enough to script out, I might even have a working example that does this already. Once it hits Sharepoint the webhook feature would allow your own internal server to pick it up and run the Powershell. I haven’t looked what other actions Sharepoint supports, the webhook was good enough for what I was doing, but it might also be able to trigger scripts without needing the webhook.
I explored adding to the list via API, and I don’t think it is possible. If it is I have not seen a way it can be done.
The Tenant Allow/Block API has been in preview for a very long time. I’ve been messing with the idea of authenticating a PS script via certificate but I don’t think that translates as nicely in ICON.
I have heard of a method in Sharepoint managing a list which runs Power Automate/Azure Runbooks to eventually run a PS. It sounds like yours is a bit simpler, but from what I can tell you’ll still need a Postman subscription.
This seems like something that should definitely be easier to do and is some gatekeeping by Microsoft.