Theseus

Appearance

Microsoft Defender and Intune ​

Two connectors that pull Microsoft data into the stack. Both authenticate as a Microsoft Entra application with a client secret. Create one application per connector, or one for both with the permissions of both.

Create the Entra application ​

  1. In the Microsoft Entra admin center, App registrations → New registration. Single tenant.
  2. Note the Application (client) ID and Directory (tenant) ID.
  3. Certificates & secrets → New client secret. Note its value.
  4. API permissions → Add a permission, application permissions, as listed below, then Grant admin consent.

Microsoft Defender for Endpoint ​

Pulls Defender machines, vulnerabilities and alerts, and Microsoft security incidents (Microsoft Graph). Theseus rules 101400 to 101496 classify them.

Permissions: application access to the Defender for Endpoint API (WindowsDefenderATP) to read machines, vulnerabilities and alerts, and Microsoft Graph security incidents read access.

In the console, Admin → Integrations → Microsoft Defender for Endpoint:

FieldNotes
Entra tenant idThe Directory (tenant) ID
App (client) id
Client secretNever shown again once saved
API hostDefault api.security.microsoft.com

Then Test connection and Save. The change is applied within a minute.

Microsoft Intune ​

Pulls managed devices, compliance state changes, audit events, apps, compliance policies, configuration profiles, scripts, enrolment and Autopilot configuration, Conditional Access policies and device categories. Compliance transitions and audit events become alerts (rules 101600 to 101671).

Microsoft Graph application permissions:

  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementApps.Read.All
  • DeviceManagementConfiguration.Read.All
  • DeviceManagementScripts.Read.All
  • DeviceManagementServiceConfig.Read.All
  • Policy.Read.All
  • User.Read.All

In the console, Admin → Integrations → Microsoft Intune:

FieldNotes
Entra tenant idThe Directory (tenant) ID
App (client) id
Client secretNever shown again once saved

Then Test connection and Save. The change is applied within a minute.

Intune device actions (for example sync or retire) from Theseus are not available: the connector reads only.

Polling ​

Both connectors poll every 30 minutes by default.

On a stack without the console, sudo ./theseus connectors enable defender (or intune) on the server asks for the same values.

Theseus documentation