Skip to content

Rename MSSentinel integration to MSDefenderGraphSecurityAPI - #4

Open
3lina wants to merge 1 commit into
StrangeBeeCorp:mainfrom
3lina:rename-sentinel-integration-to-msdefender-xdr
Open

Rename MSSentinel integration to MSDefenderGraphSecurityAPI#4
3lina wants to merge 1 commit into
StrangeBeeCorp:mainfrom
3lina:rename-sentinel-integration-to-msdefender-xdr

Conversation

@3lina

@3lina 3lina commented Aug 18, 2026

Copy link
Copy Markdown

Summary

This feeder was initially named and scoped around Microsoft Sentinel, but it now polls the
Microsoft Graph Security API (/security/alerts_v2), which aggregates alerts
from any product in the Microsoft Defender suite, not just Sentinel. This PR
renames the vendor and function so their name and description reflect that
actual scope.

Changes

  1. Renamed integrations/vendors/MSSentinel to integrations/vendors/MSDefenderGraphSecurityAPI
  2. Updated vendor.yml with the new id, name (Microsoft Defender via Graph Security API), and a description that explains the cross product aggregation
  3. Renamed the function file and its definition to alertfeeder_ingestMSDefenderIncidents, with an updated description that calls out the Graph Security API explicitly
  4. Updated the tag, source, and title strings in the function body from Sentinel to Defender
  5. Removed an orphaned earlier draft of this function under integrations/generic/functions/

Breaking change to note

The alert sourceRef prefix changed from sentinel-incident- to
msdefender-incident-. Incidents already ingested under the old prefix will
not be matched as duplicates after this change deploys.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant