Skip to main content
Question

Querying a Microsoft service (Defender Adv Hunting) via MS Graph from a freshservice ticket


Forum|alt.badge.img

Hi, this is my first post so let me know if I’m not doing this correctly.

 

We have an employee offboarding process in Freshservice and would like to add Freshservice automation that, when an offboarding ticket is created, sends a KQL query to our Microsoft instance, specifically Defender Advanced Hunting, and the results of the query should be placed back in the ticket.

The Microsoft documentation suggests that we should do this via Microsoft Graph.  I’d like to create a FS workflow that makes a web request to Microsoft Graph to start the query, but no matter what combinations of configurations I attempt I get blocked with errors like “invalid host” or "InvalidAuthenticationToken", or whatever.

The Microsoft documentation is splintered into scattered sub-topics, doesn’t include examples, and assumes I’m using a programming language like JavaScript, not a platform like FreshService.

Has anyone else managed to make calls into Microsoft, not using the existing AD/Azure apps which don’t include the functions I want?  How did you do it?

 

Did this topic help you find an answer to your question?

3 replies

Forum|alt.badge.img

I am actually making headway with this, I don’t need the answer.  For those who want to know, try: 

security: runHuntingQuery - Microsoft Graph v1.0 | Microsoft Learn

in web requests after using an earlier web request to get a bearer token for acces.


Kamakshi V
Community Manager
Forum|alt.badge.img+10
  • Community Manager
  • 278 replies
  • March 13, 2025

Congrats on your first post ​@Doug_in_Wellington_NZ ! And I’m happy that you were able to self-serve it and thank you for sharing it here!


David Pietrs
Skilled Expert
Forum|alt.badge.img+5
  • Skilled Expert
  • 20 replies
  • March 13, 2025

This post helped me a lot when I was working on MS authentication in a freshservice workflow. 

Specifically this comment 

 


Reply