Forum Discussion

CommanderNorton's avatar
CommanderNorton
Copper Contributor
Mar 05, 2025
Solved

Automate bulk-import of file with IP-adresses to block

We use SOAR to bulid a block-file containing IP-adresses we want to block.  We can place this file on a network share, sftp, or "whereever".  Is it possible for us to instruct Defender to read this...
  • luchete's avatar
    luchete
    Mar 06, 2025

    Hi CommanderNorton,

    Yes, you can automate this by using Microsoft Defender’s API or PowerShell. You can set up a script to pull the block list from your SOAR-generated file and push it to Defender automatically. Another option is using Microsoft Sentinel playbooks to handle the import process. This way, you don’t need manual uploads in the security center.

    Let me know if you need specific guidance on this. 

    Regards!

luchete's avatar
luchete
Iron Contributor
Mar 06, 2025

Hi CommanderNorton,

Yes, you can automate this by using Microsoft Defender’s API or PowerShell. You can set up a script to pull the block list from your SOAR-generated file and push it to Defender automatically. Another option is using Microsoft Sentinel playbooks to handle the import process. This way, you don’t need manual uploads in the security center.

Let me know if you need specific guidance on this. 

Regards!

Resources