Microsoft Defender Vulnerability Management (beta)
Connect Nebulock Helix to Microsoft Defender for Endpoint for just-in-time vulnerability enrichment
The Microsoft Defender Vulnerability Management integration enables Nebulock Helix to query device inventory and CVE-level vulnerability findings from Microsoft Defender for Endpoint on demand, during hunts and investigations.
This is a separate integration from the Microsoft Defender and Entra data ingestion integration. This page covers Helix enrichment only.
Prerequisites
- Access to an Azure account via the Entra Portal or Azure Portal, with permission to create app registrations
- Microsoft Defender for Endpoint licensed and deployed, with devices onboarded
Create an app registration
Log in to the Entra or Azure portal and navigate to App registrations > New registration.
Provide a name for the application (e.g. "Nebulock Helix Enrichment") and click Register.
Note the Application (client) ID and Directory (tenant) ID.
Configure permissions
Within the app registration, go to Manage > API Permissions > Add a permission.
Select APIs my organization uses and search for WindowsDefenderATP (Microsoft Defender for Endpoint). Choose Application permissions (not Delegated), and add:
- Machine.Read.All — required to query device inventory
- Vulnerability.Read.All — required to query vulnerability findings and CVE data
Click Add permissions, then Grant admin consent for your tenant.
Before proceeding, verify that both permissions are Application permissions and that admin consent shows as granted.
Create a client secret
Within the app registration, go to Manage > Certificates & secrets > Client secrets > New client secret.
Fill in a description, select an expiration period, and click Add. Note the secret Value.
Azure only displays the secret value once. If you navigate away without copying it, you'll need to create a new secret.
Determine your regional URL
The Defender for Endpoint API uses a regional base URL in the format https://api-{region}.securitycenter.microsoft.com:
- US:
https://api-us.securitycenter.microsoft.com - EU:
https://api-eu.securitycenter.microsoft.com - UK:
https://api-uk.securitycenter.microsoft.com
Most US-based tenants can also use https://api.securitycenter.microsoft.com, which routes automatically.
Enable the integration in Nebulock
In Nebulock, go to Settings > Integrations.
In the search bar, type "Defender" and click Add New Connection.
Enter the connection details:
- Name: a description of your choice, e.g. "Nebulock Defender VM"
- URL: your regional API URL from the step above
- Tenent ID: the Application (client) ID from the app registration
- Client ID: the Directory (tenant) ID from the app registration
- Client Secret: the client secret value
Click Test, then Create Configuration.
Test the integration
Within Nebulock, navigate to Investigate. A simple "List the vulnerabilities from Defender" will pull data from your Microsoft Defender for Endpoint instance.
Updated 27 days ago