Unanswered

Defender ATP onboarding notification fails

(0) Share

Report

Posted on by Community Power Pla... Microsoft Employee

Hi all,

Newbie here trying to learn by setting up a notification when a new computer onboards Microsoft Defender ATP service.

The process is described here: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification

Everything is working until I get to the last action.

The execution of template action 'Apply_to_each' failed: the result of the evaluation of 'foreach' expression '@body('Parse_JSON')?['properties']?['value']' is of type 'Null'. The result must be a valid array.

Anyone have clue on how to get this to work?

Thanks!

My flow overview

The step where it stop working

Here is a pic of the sharepoint list

Categories:

Building flows

I have the same question (0)

All responses (4)

Answers (0)

PrasadAthalye on at

Like (1)

Report
Copy link

Link copied!

@Anonymous - Looks like your http action may not have returned any data and as a result its an empty array Or a null object.

Can you check the output of Http Action if it shows anything? Do you have required permissions to query defender?

Was this reply helpful? Yes No
Community Power Pla... Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Hi @PrasadAthalye and thanks for your reply.

Output from http and parse json are both populated with all the machines. So the last action (where error occurs) should have data.

Triple-checked against Microsofts guide and I can't find any differences, except that GetItem is a bit updated in my flow.

Also, I find this Sharepoint List a bit overly complex, maybe it's necessary though. I just want an e-mail when new machines shows up in the ATP service. Since the flow is running each 5 mins, I'm thinking if "First Seen" is less than 5 mins ago I want an e-mail. No clue how to configure that though. 😅

Thanks

My settings to the right in green

Was this reply helpful? Yes No
Greeny75 2 on at

Like (0)

Report
Copy link

Link copied!

I'm having the same issue, both HTTP and parse JSON show output. Any advice appreciated. @Anonymous did you end up getting it to work?

Was this reply helpful? Yes No
Community Power Pla... Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Nope and its unfortunate. We have pretty bad awareness on new or failing sensors since the built-in notifications in Defender SecurityCenter does not include onboarding/offboarding/sensor errors. This is one of the biggest downsides for with Defender ATP for us.

Was this reply helpful? Yes No