Integrating Forescout Cloud with Microsoft Defender for Endpoint (SOAR)

Forescout Cloud integrates with Microsoft Defender for Endpoint to support security orchestration, automation, and response (SOAR) workflows by automating your IT tasks to reduce strain on your team.

Before integrating, note the following Microsoft Defender for Endpoint credentials:

  • Client ID
  • Client Secret
  • Base API URL for Microsoft Defender for Endpoint

For more information, see Microsoft Defender for Endpoint in the Microsoft documentation.

To integrate Forescout Cloud with Microsoft Defender for Endpoint to support SOAR:

  1. In the Forescout Cloud Console, select Administration > Integrations.
  2. Click the Add Application button.
  3. In the Category dropdown, select SOAR.
  4. In the Application dropdown, select Microsoft Defender for Endpoint.
  5. In the Application Name field, enter a unique name for the integration.
  6. In the Configurations pane, enter the Client ID, enter the Client Secret, select the Base API URL For MS Defender for Endpoint, and enter your Tenant ID.
  7. Click the Add Application button to save the configuration.

After you integrate Forescout Cloud with Microsoft Defender for Endpoint, you can configure actions. For details on configuring SOAR actions, see Configuring SOAR actions.