MS Defender Advanced Hunting

This add-on enables Advanced Hunting queries (KQL) against Microsoft Defender APIs directly from Splunk search commands. Microsoft provides three APIs for Advanced Hunting: - Microsoft Defender for Endpoint - Microsoft Defender XDR - Microsoft Graph REST API This add-on automatically detects which API endpoint your credentials are authorized to access. If credentials for multiple APIs are available, **Microsoft Defender for Endpoint** is prioritized. - [Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide)