Unable to get Incident URL from Microsoft Defender ATP Trigger in Insightconnect

InsightConnect Workflows
1

Hello All - I’m creating a workflow with Trigger of Microsof Defender ATP (Also called MDATP - Defender for Endpoint). Plaaning to use the Alert URL of the triggered alert. However not finding the Incident URL from the output.
Is it possible to ferch Alert\incident URL of the triered alert?

2

I dont see that as an output of the trigger, or in the custom outputs section for the Defender ATP plugin. I dont see anything in the API docs either.
API Docs: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/alerts?view=o365-worldwide

1 Like
3

So, updating it for others as I can get it from a workaround.
MDATP Alert links are in the format of https://security.microsoft.com/alerts/ and hence used below to get the respective alert’s URL.
https://security.microsoft.com/alerts/{{[“MDATP”].[alert].[id]}}