Hi Matt Egen,
Thanks for the awesome writeup. I am trying to set this up and while running the playbook, it is erroring out at the stage of sending the retrieved indicator data to Microsoft Graph Security API. I'm able to view different retrieved indicators(domains, IPv4, hostnames etc.) as the output of the GET request and as the input to the final POST request to the Graph API, but the output of POST request shows the error message:
Http request failed with statusCode=BadRequest : {\"error\":{\"code\":\"ValidationFailed\",\"message\":\"Validation of indicator content failed.\",\"target\":\"body\",\"details\":[{\"code\":\"ValidationFailed\",\"message\":\"At least one Observable must be set (e.g. IP or URL).\",\"target\":\"Any Observables (e.g. IP or URL).\"}]}}; "
Here is the body of the POST request for your reference:
Please help out on this issue. Thank you.
Regards,
Anand R Menon
Microsoft