Microsoft Defender for Cloud alert integration

Microsoft Defender for Cloud Workflow automation runs a Logic App when a security alert is created; it has no direct webhook output. The Logic App HTTP action can POST JSON to any address, so no separate Defender for Cloud integration is needed: create a Standard Alert Event integration in Flashduty and let the Logic App push security alerts to it in the standard alert format. If the same tenant already sends Defender for Cloud alerts to Microsoft Sentinel, you can use the Microsoft Sentinel integration instead, which pushes per incident and supports recovery.

Configure in Microsoft Defender for Cloud

You need the Security admin role or Owner on the resource group; creating and editing Logic Apps needs Logic App Contributor.

Create a Logic App with an HTTP action in the Azure portal

Where: Azure portal › Logic apps › + Add

Create a Consumption Logic App. Workflow automation only triggers Consumption Logic Apps
Choose When a Defender for Cloud Alert is created or triggered as the workflow trigger. Do not use the legacy When a response to a Microsoft Defender for Cloud alert is triggered; workflow automation does not run Logic Apps that use it
After the trigger, add the built-in HTTP action with these fields:

Field	Value
Method (Required)	`POST`
URI (Required)	`{integration_url}`
Headers (Required)	`Content-Type`: `application/json`
Body (Required)	The JSON below

Below is the JSON definition of this HTTP action; in the Logic App Code view it goes under actions. A string that starts with @ and is a single expression is a Logic App expression evaluated from the alert trigger output; the value is emitted as JSON, so an alert name containing quotes does not break the body:

"Send_to_Flashduty": {
  "type": "Http",
  "runAfter": {},
  "inputs": {
    "method": "POST",
    "uri": "{integration_url}",
    "headers": { "Content-Type": "application/json" },
    "body": {
      "title_rule": "@triggerBody()?['AlertDisplayName']",
      "event_status": "@if(equals(triggerBody()?['Severity'], 'High'), 'Critical', if(equals(triggerBody()?['Severity'], 'Informational'), 'Info', 'Warning'))",
      "alert_key": "@triggerBody()?['SystemAlertId']",
      "description": "@triggerBody()?['Description']",
      "labels": {
        "alert_type": "@triggerBody()?['AlertType']",
        "alert_url": "@triggerBody()?['AlertUri']",
        "resource": "@coalesce(triggerBody()?['CompromisedEntity'], 'unknown')",
        "product_name": "@triggerBody()?['ProductName']",
        "vendor_name": "@triggerBody()?['VendorName']",
        "defender_severity": "@triggerBody()?['Severity']"
      }
    }
  }
}

In the designer, the same values map to these dynamic contents (outputs of the When a Defender for Cloud Alert is created or triggered trigger):

Flashduty field	Dynamic content	Expression path
`title_rule`	Alert Display Name	`AlertDisplayName`
`event_status`	Severity	`Severity`
`alert_key`	System Alert Id	`SystemAlertId`
`description`	Description	`Description`
Label `alert_type`	Alert Type	`AlertType`
Label `alert_url`	Alert Uri	`AlertUri`
Label `resource`	Compromised Entity	`CompromisedEntity`
Labels `product_name`, `vendor_name`	Product Name, Vendor Name	`ProductName`, `VendorName`

Save the workflow when the fields are filled in.

Create a workflow automation in Defender for Cloud

Where: Azure portal › Microsoft Defender for Cloud › Workflow automation › Add workflow automation

Field	Value
Name (Required)	A name of your choice, for example `Flashduty`
Description (Optional)	A description of your choice
Trigger conditions (Required)	Select security alerts and limit the severity if needed
Actions (Required)	Select the Logic App from the previous step; click Refresh if it is not listed

Save when done.

Trigger an alert by hand and confirm

Where: The page of any security alert in Defender for Cloud › Trigger logic appClick Trigger logic app to run the Logic App for that alert manually, without waiting for a new alert. The run result is in the Logic App run history.After a few seconds, go back to Flashduty. If the integration shows a Latest event time, the setup works.

Field mapping

Defender for Cloud field	Flashduty
Alert Display Name	Alert title (`title_rule`, truncated beyond 512 characters)
Severity	`High` → Critical; `Informational` → Info; `Medium` and `Low` → Warning. Also kept in the label `defender_severity`
System Alert Id	Alert Key. A repeated trigger of the same alert merges into one Flashduty alert
Description	Alert description (truncated beyond 2048 characters)
Compromised Entity	Label `resource`; `unknown` when the alert has none
Alert Uri	Label `alert_url`, which opens the alert details in the Azure portal

Recovery and deduplication

Defender for Cloud workflow automation runs the Logic App only when an alert is created or triggered and sends nothing when the alert is dismissed, so alerts from this integration do not recover automatically. Enable auto-resolve timeout on the channel that receives this integration, with a suggested window of 3 days or the time your team usually takes to handle alerts; you can also close alerts manually in Flashduty.

Troubleshooting

Flashduty returns InvalidParameter: check that event_status is one of the capitalized Critical, Warning, Info, and that title_rule is not empty
The Logic App is missing from the workflow automation list: the list shows only Consumption Logic Apps that use a Defender for Cloud connector; click Refresh after creating it
The Logic App does not run: confirm the trigger is When a Defender for Cloud Alert is created or triggered and that the workflow automation trigger conditions (severity) cover the alert

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices

Microsoft Defender for Cloud alert integration

In Flashduty On-call

Use a dedicated integration

Use a shared integration

Configure in Microsoft Defender for Cloud

Field mapping

Recovery and deduplication

Troubleshooting