Pre-Release

This feature is actively being developed. Breaking changes should be expected. Synqly Labs is available only in Synqly Mesh.

Please contact us before using this feature.

Microsoft

Labs URL: synqly://labs/defender

Create a Labs integration

Create an integration for the provider, the same way you would for the real provider.
Set the provider's URL to the Labs URL at the top of this page.
Fill in the credential fields. Labs accepts any value, but the credential must be the type the provider asks for, such as an OAuth client ID and secret or an API token.

Then call any operation the provider supports. Your requests run through the same connector that serves a real provider tenant, so the responses have the provider's shape and your code works against the real provider without changes.

EDR

Provider: Microsoft Defender for Endpoint

Operation	On Labs
`create_ioa`	Available
`create_iocs`	Available
`create_threat_note`	Available
`delete_ioa`	Available
`delete_iocs`	Available
`execute_command`	Not available. Live response is not available on Labs yet.
`get_endpoint`	Available
`get_threat_notes`	Available
`network_quarantine`	Available
`query_alerts`	Available
`query_applications`	Available
`query_edr_events`	Available
`query_endpoints`	Available
`query_ioa`	Available
`query_iocs`	Available
`query_posture_score`	Available
`query_threatevents`	Available
`retrieve_file`	Not available. Live response is not available on Labs yet.
`update_alert`	Available

`query_alerts`

Filter	Operators	Not on Labs
`actor.user.name`	eq, in, ne
`analytic.category`	eq, in, ne
`finding_info.created_time`	gt, gte, lt, lte
`finding_info.created_time_dt`	gt, gte, lt, lte
`finding_info.last_seen_time`	gt, gte, lt, lte
`finding_info.last_seen_time_dt`	gt, gte, lt, lte
`finding_info.modified_time`	gt, gte, lt, lte
`finding_info.modified_time_dt`	gt, gte, lt, lte
`finding_info.uid`	eq, in, ne
`metadata.uid`	eq, in, ne
`severity`	eq, in, ne
`status`	eq, in, ne
`time`	gt, gte, lt, lte

`query_applications`

Filter	Operators	Not on Labs
`device.hostname`	eq, in, like
`device.uid`	eq, in
`product.name`	eq, in, like
`product.vendor_name`	eq, in, like
`product.version`	eq, in, like

`query_edr_events`

Filter	Operators	Not on Labs
`actor.process.cmd_line`	eq, ne, in, not_in	like, not_like
`actor.process.file.hashes`	eq, ne, in, not_in, like, not_like
`actor.process.file.name`	eq, ne, in, not_in, like, not_like
`actor.process.file.path`	eq, ne, in, not_in	like, not_like
`actor.process.name`	eq, ne, in, not_in, like, not_like
`device.hostname`	eq, ne, in, not_in, like, not_like
`device.ip`	eq, ne, in, not_in, like, not_like
`device.os.name`	eq, ne, in, not_in, like, not_like
`metadata.product.feature.name`	eq, ne, in, not_in, like, not_like
`status`	eq, ne, in, not_in, like, not_like
`time`	gte, lte

Sort	Directions	Not on Labs
`time`	asc, desc

`query_endpoints`

Filter	Operators	Not on Labs
`cloud.account.uid`	eq, ne, in, not_in, like, not_like
`device.hostname`	eq, ne, in, not_in, like, not_like
`device.ip`	eq, ne, in, not_in, like, not_like
`device.last_seen_time`	eq, ne, gt, gte, lt, lte
`device.last_seen_time_dt`	eq, ne, gt, gte, lt, lte
`device.os.name`	eq, ne, in, not_in, like, not_like
`device.risk_level`	eq, ne, in, not_in, like, not_like
`device.uid`	eq, ne, in, not_in, like, not_like
`enrichments.reputation.score`	eq, ne, in, not_in, like, not_like
`metadata.labels`	eq, ne, in, not_in, like, not_like
`metadata.product.version`	eq, ne, in, not_in, like, not_like
`risk_level_id`	eq, ne, in, not_in, like, not_like
`status`	eq, ne, in, not_in, like, not_like
`status_code`	eq, ne, in, not_in, like, not_like
`status_detail`	eq, ne, in, not_in, like, not_like
`time`	eq, ne, gt, gte, lt, lte

Sort	Directions	Not on Labs
`device.hostname`	asc, desc
`device.last_seen_time`	asc, desc
`time`	asc, desc

`query_ioa`

Filter	Operators	Not on Labs
`created_time`	eq, gt, gte, lt, lte
`description`	eq, like
`enabled`	eq
`modified_time`	eq, gt, gte, lt, lte
`name`	eq, like

Sort	Directions	Not on Labs
`created_time`	asc, desc
`modified_time`	asc, desc
`name`	asc, desc

`query_iocs`

Filter	Operators	Not on Labs
`created`	eq, in
`created_by_ref.Id`	eq, in
`created_by_ref.name`	eq, in
`extensions.action`	eq, in
`extensions.alert`	eq, in
`extensions.application`	eq, in
`extensions.rbacGroupIds`	eq, in
`extensions.rbacGroupNames`	eq, in
`extensions.severity`	eq, in
`name`	eq, in
`pattern`	eq, in
`pattern_type`	eq, in
`valid_until`	eq, in

`query_threatevents`

Filter	Operators	Not on Labs
`actor.user.name`	lt, gt, eq, in
`finding_info.created_time`	lt, gt
`finding_info.modified_time`	lt, gt
`status`	lt, gt, eq, in
`time`	lt, gt

Microsoft

Create a Labs integration

EDR

query_alerts

query_applications

query_edr_events

query_endpoints

query_ioa

query_iocs

query_threatevents

Was this helpful?