TechWatchAlert
Fleet and cloud

Microsoft Defender for Endpoint

Defender machines and the software installed on each, with no extra agent.

What the connector does

The Defender connector reads machines and their software inventory with an application that only has the “Machine.Read.All” and “Software.Read.All” permissions. The fleet covered by Defender joins the watch without deploying anything.

What comes into TechWatchAlert

  • Machines: name, OS, build, last IP address
  • Software installed on each machine, with its version
  • Only products known to CVEs, added to the stack

Setup

  1. In Entra ID, create an application with the WindowsDefenderATP “Machine.Read.All” and “Software.Read.All” permissions
  2. Grant admin consent, then create a secret
  3. In TechWatchAlert, enter the tenant, the application ID and the secret

In the same family

Connectors

Plug in your tools in minutes

Start with a repository, a fleet or a scan report: your first targeted alerts arrive with the first sync.

Talk to the team

Free plan, no credit card · hosted in France