ServiceNow Microsoft Defender Integration Guide

Architecture Overview

Implementation Steps

// Flow script step for alert deduplication
(function execute(inputs, outputs) {
    var alertId = inputs.alert_id;
    var gr = new GlideRecord('sn_si_incident');
    gr.addQuery('correlation_id', alertId);
    gr.query();
    
    if (gr.hasNext()) {
        outputs.alert_exists = true;
        outputs.existing_incident = gr.getUniqueValue();
    } else {
        outputs.alert_exists = false;
    }
})(inputs, outputs);

// Script step for CMDB device update
(function execute(inputs, outputs) {
    var deviceName = inputs.device_name;
    var riskScore = inputs.risk_score;
    
    var computer = new GlideRecord('cmdb_ci_computer');
    computer.addQuery('name', deviceName);
    computer.query();
    
    if (computer.next()) {
        computer.setValue('u_defender_risk_score', riskScore);
        computer.setValue('u_last_defender_sync', new GlideDateTime());
        computer.update();
        outputs.action_taken = 'updated';
    } else {
        computer.initialize();
        computer.setValue('name', deviceName);
        computer.setValue('u_defender_risk_score', riskScore);
        computer.insert();
        outputs.action_taken = 'created';
    }
})(inputs, outputs);

// REST Message for custom device isolation if spoke action unavailable
var rm = new RESTMessage('Microsoft Graph API', 'POST');
rm.setEndpoint('https://graph.microsoft.com/v1.0/security/machines/' + device_id + '/isolate');
rm.setRequestHeader('Authorization', 'Bearer ' + access_token);
rm.setRequestHeader('Content-Type', 'application/json');
var requestBody = {
    'Comment': 'Automated isolation from ServiceNow incident ' + incident_number,
    'IsolationType': 'Full'
};
rm.setRequestBody(JSON.stringify(requestBody));
var response = rm.execute();
gs.info('Device isolation response: ' + response.getBody());

// Business Rule script for incident closure sync
(function executeRule(current, previous) {
    if (current.state == '3' && previous.state != '3') { // Resolved state
        var correlationId = current.correlation_id.toString();
        if (correlationId) {
            sn_fd.FlowAPI.getRunner().trigger('defender_update_alert_status', {
                'alert_id': correlationId,
                'status': 'resolved',
                'feedback': current.u_alert_feedback.toString(),
                'comments': current.close_notes.toString()
            });
        }
    }
})(current, previous);

// Test script for connection validation
var testConnection = function() {
    try {
        var rm = new RESTMessage('Microsoft Graph API', 'GET');
        rm.setEndpoint('https://graph.microsoft.com/v1.0/security/alerts?$top=1');
        var response = rm.execute();
        
        if (response.getStatusCode() == 200) {
            gs.info('Microsoft Defender ATP connection test successful');
            return true;
        } else {
            gs.error('Connection test failed: ' + response.getStatusCode());
            return false;
        }
    } catch (ex) {
        gs.error('Connection test exception: ' + ex.getMessage());
        return false;
    }
};

Common Use Cases

Troubleshooting

Pro Tips

• →Implement custom retry logic with exponential backoff in your Integration Hub flows to handle Microsoft Graph API rate limits gracefully, using Wait actions with dynamically calculated delays based on the Retry-After response header. This prevents flow failures during high-volume alert periods and ensures reliable data synchronization.
• →Create custom ServiceNow tables for storing Microsoft Defender-specific metadata like alert evidence, investigation timeline data, and device threat analytics that don't map cleanly to standard incident fields. This preserves valuable forensic information while keeping incident records clean and allows for advanced reporting on threat patterns.
• →Use ServiceNow's Event Management capabilities alongside Security Incident Response to handle lower-priority Defender alerts as events first, automatically promoting them to incidents only when specific criteria are met like multiple related alerts or high device risk scores. This reduces incident noise while maintaining visibility into security telemetry.
• →Configure webhook endpoints in ServiceNow using Scripted REST APIs for real-time alert ingestion instead of relying solely on scheduled polling, reducing alert detection-to-incident creation time from minutes to seconds. Implement proper authentication and payload validation to secure these endpoints against unauthorized access.
• →Leverage ServiceNow's Connection Aliases for different Defender tenants or environments, allowing the same flows to work across development, staging, and production Microsoft environments by simply changing the connection configuration rather than maintaining separate flows.
• →Implement comprehensive logging and monitoring of integration health using ServiceNow's Metrics framework to track API call success rates, alert processing times, and data synchronization lag, enabling proactive identification and resolution of integration issues before they impact security operations.

Known Limitations

• —Microsoft Graph Security APIs enforce rate limits of approximately 15,000 requests per 10-minute window per application, which can constrain real-time alert processing in high-volume environments with thousands of endpoints. Large organizations may need to implement request queuing and batching strategies to stay within these limits.
• —The Microsoft Security Graph spoke in Integration Hub may not support all available Microsoft Defender for Endpoint API endpoints, requiring custom REST Message implementations for advanced features like live response commands, custom threat indicators, or advanced hunting queries. This increases development complexity and maintenance overhead.
• —Alert data retention in Microsoft Graph is limited to 30 days for most alert types, meaning ServiceNow cannot retrieve historical alert data beyond this timeframe through the standard APIs. Organizations requiring longer retention periods must implement continuous synchronization rather than one-time bulk imports.
• —Device action APIs in Microsoft Defender have inherent latency of 2-5 minutes before actions take effect on endpoints, which may not meet requirements for immediate threat containment in critical scenarios. Network isolation and other containment actions should not be considered instantaneous.
• —Complex alert evidence and investigation data from Microsoft Defender may not map cleanly to ServiceNow's standard incident and task structure, requiring custom tables and workflows to preserve forensic details and maintain investigative context across platforms.

Frequently Asked Questions