Cracken + Microsoft Defender for Endpoint
Cracken attacks the devices in scope whether Microsoft Defender for Endpoint has onboarded them or not. It reads Defender's alerts through an Entra ID app registration to name every technique that raised none.
Connecting Microsoft Defender for Endpoint
- Connect with
Directory Tenant ID, application Client ID and client-secret value for a single-tenant Entra app registration holding the WindowsDefenderATP application permissions Alert.Read.All and Machine.Read.All, with tenant-wide admin consent granted.
- Cadence
Fetched on demand during an operation, not on a schedule — Cracken triggers a fresh pull when it needs current alerts.
- Requires
A Microsoft Defender for Endpoint tenant; permission to create an app registration and client secret; a tenant administrator who can grant consent for the Defender application permissions. Vulnerability findings need the separate Microsoft Defender Vulnerability Management connection.
What Cracken gets from Microsoft Defender for Endpoint
EDR Alerts with title, description, severity, status and Defender's own verdict
The process behind the alert: process_filename, process_filepath, process_command_line, pid, parent_pid and process_sha256 / sha1 / md5
The identity on the alert: user_name, windows_sid, active_directory_user_id and active_directory_domain
first_event_time, last_event_time, resolved_time and assigned_user
A device{} object carrying hostnames and ipv4s, filterable by host_name and user_name
A mitre[] array and an observables[] array per alert, plus vendor_severity, vendor_status and the raw vendor_data{}
What Microsoft Defender for Endpoint does not do
Microsoft Defender for Endpoint is never synced on a schedule: a scheduled sync returns no findings, no nodes and no relationships. Cracken pulls alerts on demand instead, and they do not land in the Cybergraph. Nothing is written back: Cracken cannot isolate a device, run live response, or change an alert's status.
How Cracken uses Microsoft Defender for Endpoint
- 01
Grant Cracken read access to Defender alerts and devices
- 02
Attack the devices in scope
- 03
Read the Defender alerts back
- 04
Confirm it connected
Frequently asked questions
What permissions does Cracken need for Microsoft Defender for Endpoint?
A single-tenant Microsoft Entra ID app registration with two read-only WindowsDefenderATP permissions, Alert.Read.All and Machine.Read.All, under tenant-wide admin consent.
Does Cracken continuously sync Microsoft Defender for Endpoint data?
No; Defender for Endpoint alerts are pulled on demand during or after an operation, with no scheduled background sync into Cracken.
“I've been pretty impressed with how CrackenAGI is able to do its vulnerability discovery, enumeration, reconnaissance, as well as eventually being able to actually execute different exploitation paths.”
More integrations
CrowdStrike Falcon
Cracken shows what CrowdStrike Falcon caught and missed against real attacks.
SentinelOne
Cracken attacks your endpoints, then reads what SentinelOne flagged, blocked, and missed.
Tenable
Cracken attacks Tenable findings in scope to prove which ones an attacker reaches.
Attack with real Microsoft Defender for Endpoint context.
See how Cracken works what Microsoft Defender for Endpoint already knows into attack paths it proves end to end.