Skip to main content

Microsoft Defender for Cloud Apps

Details
Content
Dependencies
Version History

Download With Dependencies

Microsoft Cloud App Security Integration, a Cloud Access Security Broker that supports various deployment modes

License Information

Available for E3 (EMS), E5, and standalone licenses.

Note: Time parsing is supported only when the field "timestamp" is in epoch milliseconds format (for example 1674208800123).

License Information

Available for E3 (EMS), E5, and standalone licenses.

Note: Time parsing is supported only when the field "timestamp" is in epoch milliseconds format (for example 1674208800123).

Classifiers

Name	Description
Microsoft CAS Classifier	Classifies Microsoft CAS Alerts
Microsoft CAS	Maps incoming Microsoft CAS fields

Incident Types

Name	Description
Microsoft CAS Alert

Integrations

Name	Description
Microsoft Defender for Cloud Apps	Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.

Layouts

Name	Description
MicrosoftCloudAppSecurity

Classifiers

Name	Description
Microsoft CAS Classifier	Classifies Microsoft CAS Alerts
Microsoft CAS	Maps incoming Microsoft CAS fields

Incident Types

Name	Description
Microsoft CAS Alert

Integrations

Name	Description
Microsoft Defender for Cloud Apps Event Collector	Collects the events log for alerts and activities provided Microsoft Defender for Cloud Apps API.
Microsoft Defender for Cloud Apps	Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.

Modeling Rules

Name	Description
Microsoft Defender Cloud Apps Modeling Rule

Parsing Rules

Name	Description
Microsoft Cloud App Security Parsing Rule

Required Content Packs (1)

Pack Name	Pack By
Base	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (2)

Pack Name	Pack By
Aggregated Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

2.2.26 - 10004541 (June 9, 2026)

Integrations

Microsoft Defender for Cloud Apps

Updated the error message displayed when an invalid or malformed authorization code is provided during Authorization Code flow configuration.

Related pull requests:
- 44467

Download

2.2.25 - 8769861 (May 5, 2026)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.8187750.

Related pull requests:
- 44123

Download

2.2.24 - 8515806 (April 27, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 43940

Download

2.2.23 - 8479105 (April 26, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 43941

Download

2.2.22 - 8210013 (April 13, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 43748

Download

2.2.21 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

2.2.20 - 5940029 (November 20, 2025)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.5490413.

Related pull requests:
- 41956

Download

2.2.19 - 5740182 (November 5, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41763

Download

2.2.18 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

2.2.17 - R5469292 (October 20, 2025)

Integrations

Microsoft Defender for Cloud Apps

Added automatic retry mechanism for HTTP 503 (Service Unavailable) errors to enhance reliability when Microsoft Graph services are temporarily unavailable.

Related pull requests:
- 40846

Download

2.2.16 - 4431069 (August 5, 2025)

Integrations

Microsoft Defender for Cloud Apps

Fixed a bug in the request retry logic that caused all requests to fail with a type error.

Related pull requests:
- 40838

Download

2.2.15 - 4419577 (August 4, 2025)

Integrations

Microsoft Defender for Cloud Apps

Added automatic retry mechanism for HTTP 503 (Service Unavailable) errors to enhance reliability when Microsoft Graph services are temporarily unavailable.
Improved error messages to include specific Microsoft error codes when available, providing better visibility into the root cause of failures.

Related pull requests:
- 40769

Download

2.2.14 - 4083045 (July 7, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 40525

Download

2.2.13 - 3887930 (June 20, 2025)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.3539024.

Related pull requests:
- 40309

Download

2.2.12 - 3481649 (May 21, 2025)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue with error message extraction in MicrosoftApiModule.

Related pull requests:
- 38951

Download

2.2.11 - R3340687 (May 7, 2025)

Integrations

Microsoft Defender for Cloud Apps

Metadata and documentation improvements.

Related pull requests:
- 39095

Download

2.2.10 - R2989425 (March 26, 2025)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.117163.

Related pull requests:
- 37921

Download

2.2.9 - R1741355 (December 3, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.114611.

Related pull requests:
- 37375
- 37353

Download

2.2.8 - 1669335 (November 19, 2024)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue in MicrosoftApiModule where the GCC High Defender endpoint was incorrect.

Related pull requests:
- 37253

Download

2.2.7 - 1615839 (November 10, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 37120
- 37113

Download

2.2.6 - 1480610 (October 8, 2024)

Integrations

Microsoft Defender for Cloud Apps

Added infrastructure support for Microsoft Graph Application endpoints.

Related pull requests:
- 36407

Download

2.2.5 - 1316088 (August 27, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35955

Download

2.2.4 - 1244506 (August 5, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the MicrosoftApiModule with exchange_online endpoints.

Related pull requests:
- 34917
- 34909
- 34903
- 34906
- 34147
- 34217
- 34908
- 34619
- 34911
- 34823
- 34837
- 34918
- 34816
- 34630
- 34871
- 34767
- 34879
- 34912
- 34840
- 34931
- 34892
- 34920
- 34926
- 34814
- 34811
- 34964
- 34967
- 34979
- 34921
- 34990
- 34896
- 34966
- 34985
- 34983
- 34255
- 34975
- 34999
- 34913
- 35000
- 34990
- 35002
- 34932
- 34862
- 35005
- 34868
- 34977
- 35009
- 34969
- 34591
- 34693
- 34657
- 34671
- 34681
- 34676
- 34672
- 34372
- 34701
- 34660
- 34684
- 34700
- 34702
- 34696
- 34117
- 34704
- 34706
- 34692
- 33735
- 34714
- 34703
- 34353
- 34725
- 34694
- 34734
- 34640
- 34724
- 34652
- 34443
- 34730
- 34653
- 34732
- 34667
- 34709
- 34755
- 34759
- 32423
- 34598
- 34758
- 34745
- 34762
- 34327
- 34742
- 34474
- 34766
- 34774
- 34782
- 34763
- 34756
- 34747
- 34645
- 34532
- 34675
- 34777
- 34788
- 34804
- 34729
- 34796
- 34691
- 34784
- 34783
- 34765
- 34485
- 34768
- 34593
- 34813
- 34818
- 34832
- 34772
- 34830
- 34833
- 34829
- 34834
- 34839
- 34828
- 34388
- 34838
- 34761
- 34858
- 34861
- 34764
- 34738
- 34538
- 34831
- 34748
- 34846
- 34845
- 34864
- 34817
- 34686
- 34865
- 34867
- 34863
- 34880
- 34876
- 34386
- 34881
- 34884
- 34799
- 34827
- 34883
- 34886
- 34512
- 34887
- 34889
- 34877
- 34904
- 34905
- 34909
- 34903
- 34906
- 34147
- 34217
- 34908
- 34619
- 34911
- 34823
- 34837
- 34918
- 34816
- 34630
- 34871
- 34767
- 34879
- 34912
- 34840
- 34931
- 34892
- 34920
- 34926
- 34814
- 34811
- 34964
- 34967
- 34979
- 34921
- 34990
- 34896
- 34966
- 34985
- 34983
- 34255
- 34608
- 35026
- 35029
- 35015
- 35023
- 34776
- 34654
- 34978
- 34986
- 34938
- 34506
- 35011
- 35014
- 34779
- 35019
- 35039
- 34897
- 35049
- 35016
- 35046
- 35051
- 35040
- 34614
- 32477

Download

2.2.3 - 1234417 (August 1, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35725

Download

2.2.2 - 1180297 (July 16, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35425

Download

2.2.1 - 1162940 (July 9, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35083

Download

2.2.0 - 1094962 (June 16, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 34764

Download

2.1.62 - 1066075 (June 3, 2024)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue in where the GCC endpoints were incorrect in the supported integrations.

Related pull requests:
- 34634

Download

2.2.26 - 10004541 (June 9, 2026)

Integrations

Microsoft Defender for Cloud Apps

Updated the error message displayed when an invalid or malformed authorization code is provided during Authorization Code flow configuration.

Microsoft Defender for Cloud Apps Event Collector

Updated the error message displayed when an invalid or malformed authorization code is provided during Authorization Code flow configuration.

Related pull requests:
- 44467

Download

2.2.25 - 8769861 (May 5, 2026)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.8187750.

Related pull requests:
- 44123

Download

2.2.24 - 8542515 (April 28, 2026)

Modeling Rules

Microsoft Defender Cloud Apps Modeling Rule

Documentation and metadata improvements.

Related pull requests:
- 43940

Download

2.2.23 - 8479105 (April 26, 2026)

Parsing Rules

Microsoft Cloud App Security Parsing Rule

Documentation and metadata improvements.

Related pull requests:
- 43941

Download

2.2.22 - 8210013 (April 13, 2026)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Documentation and metadata improvements.

Related pull requests:
- 43748

Download

2.2.21 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

2.2.20 - 5940029 (November 20, 2025)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.5490413.

Related pull requests:
- 41956

Download

2.2.19 - 5740182 (November 5, 2025)

Modeling Rules

Microsoft Defender Cloud Apps Modeling Rule

Updated the Microsoft Defender Cloud Apps Modeling Rule to improve its fields' extractions.

Related pull requests:
- 41763

Download

2.2.18 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

2.2.17 - R5469292 (October 20, 2025)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Added automatic retry mechanism for HTTP 503 (Service Unavailable) errors to enhance reliability when Microsoft Graph services are temporarily unavailable.

Microsoft Defender for Cloud Apps

Added automatic retry mechanism for HTTP 503 (Service Unavailable) errors to enhance reliability when Microsoft Graph services are temporarily unavailable.

Related pull requests:
- 40846

Download

2.2.16 - 4431069 (August 5, 2025)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Fixed a bug in the request retry logic that caused all requests to fail with a type error.

Microsoft Defender for Cloud Apps

Fixed a bug in the request retry logic that caused all requests to fail with a type error.

Related pull requests:
- 40838

Download

2.2.15 - 4419577 (August 4, 2025)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Added automatic retry mechanism for HTTP 503 (Service Unavailable) errors to enhance reliability when Microsoft Graph services are temporarily unavailable.
Improved error messages to include specific Microsoft error codes when available, providing better visibility into the root cause of failures.

Microsoft Defender for Cloud Apps

Added automatic retry mechanism for HTTP 503 (Service Unavailable) errors to enhance reliability when Microsoft Graph services are temporarily unavailable.
Improved error messages to include specific Microsoft error codes when available, providing better visibility into the root cause of failures.

Related pull requests:
- 40769

Download

2.2.14 - 4083045 (July 7, 2025)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Updated the Docker image to: demisto/auth-utils:1.0.0.3562326.

Related pull requests:
- 40525

Download

2.2.13 - 3887930 (June 20, 2025)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.3539024.

Related pull requests:
- 40309

Download

2.2.12 - 3481649 (May 21, 2025)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Fixed an issue with error message extraction in MicrosoftApiModule.

Microsoft Defender for Cloud Apps

Fixed an issue with error message extraction in MicrosoftApiModule.

Related pull requests:
- 38951

Download

2.2.11 - R3340687 (May 7, 2025)

Integrations

Microsoft Defender for Cloud Apps

Metadata and documentation improvements.

Microsoft Defender for Cloud Apps Event Collector

Metadata and documentation improvements.

Related pull requests:
- 39095

Download

2.2.10 - R2989425 (March 26, 2025)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.117163.

Related pull requests:
- 37921

Download

2.2.9 - R1741355 (December 3, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the Docker image to: demisto/crypto:1.0.0.114611.

Related pull requests:
- 37375
- 37353

Download

2.2.8 - 1669335 (November 19, 2024)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue in MicrosoftApiModule where the GCC High Defender endpoint was incorrect.

Microsoft Defender for Cloud Apps Event Collector

Fixed an issue in MicrosoftApiModule where the GCC High Defender endpoint was incorrect.

Related pull requests:
- 37253

Download

2.2.7 - 1615839 (November 10, 2024)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Updated the Docker image to: demisto/auth-utils:1.0.0.115527.

Related pull requests:
- 37120
- 37113

Download

2.2.6 - 1480610 (October 8, 2024)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Added infrastructure support for Microsoft Graph Application endpoints.

Microsoft Defender for Cloud Apps

Added infrastructure support for Microsoft Graph Application endpoints.

Related pull requests:
- 36407

Download

2.2.5 - 1316088 (August 27, 2024)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Documentation and metadata improvements.
Updated the Docker image to: demisto/auth-utils:1.0.0.108110.

Related pull requests:
- 35955

Download

2.2.4 - 1244506 (August 5, 2024)

Integrations

Microsoft Defender for Cloud Apps

Updated the MicrosoftApiModule with exchange_online endpoints.

Microsoft Defender for Cloud Apps Event Collector

Updated the MicrosoftApiModule with exchange_online endpoints.

Related pull requests:
- 34917
- 34909
- 34903
- 34906
- 34147
- 34217
- 34908
- 34619
- 34911
- 34823
- 34837
- 34918
- 34816
- 34630
- 34871
- 34767
- 34879
- 34912
- 34840
- 34931
- 34892
- 34920
- 34926
- 34814
- 34811
- 34964
- 34967
- 34979
- 34921
- 34990
- 34896
- 34966
- 34985
- 34983
- 34255
- 34975
- 34999
- 34913
- 35000
- 34990
- 35002
- 34932
- 34862
- 35005
- 34868
- 34977
- 35009
- 34969
- 34591
- 34693
- 34657
- 34671
- 34681
- 34676
- 34672
- 34372
- 34701
- 34660
- 34684
- 34700
- 34702
- 34696
- 34117
- 34704
- 34706
- 34692
- 33735
- 34714
- 34703
- 34353
- 34725
- 34694
- 34734
- 34640
- 34724
- 34652
- 34443
- 34730
- 34653
- 34732
- 34667
- 34709
- 34755
- 34759
- 32423
- 34598
- 34758
- 34745
- 34762
- 34327
- 34742
- 34474
- 34766
- 34774
- 34782
- 34763
- 34756
- 34747
- 34645
- 34532
- 34675
- 34777
- 34788
- 34804
- 34729
- 34796
- 34691
- 34784
- 34783
- 34765
- 34485
- 34768
- 34593
- 34813
- 34818
- 34832
- 34772
- 34830
- 34833
- 34829
- 34834
- 34839
- 34828
- 34388
- 34838
- 34761
- 34858
- 34861
- 34764
- 34738
- 34538
- 34831
- 34748
- 34846
- 34845
- 34864
- 34817
- 34686
- 34865
- 34867
- 34863
- 34880
- 34876
- 34386
- 34881
- 34884
- 34799
- 34827
- 34883
- 34886
- 34512
- 34887
- 34889
- 34877
- 34904
- 34905
- 34909
- 34903
- 34906
- 34147
- 34217
- 34908
- 34619
- 34911
- 34823
- 34837
- 34918
- 34816
- 34630
- 34871
- 34767
- 34879
- 34912
- 34840
- 34931
- 34892
- 34920
- 34926
- 34814
- 34811
- 34964
- 34967
- 34979
- 34921
- 34990
- 34896
- 34966
- 34985
- 34983
- 34255
- 34608
- 35026
- 35029
- 35015
- 35023
- 34776
- 34654
- 34978
- 34986
- 34938
- 34506
- 35011
- 35014
- 34779
- 35019
- 35039
- 34897
- 35049
- 35016
- 35046
- 35051
- 35040
- 34614
- 32477

Download

2.2.3 - 1234417 (August 1, 2024)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Breaking Change: Updated the default value of the Number of alerts for each fetch parameter to 100 due to API limitations. Instances configured with values higher than 100 will encounter errors.

Related pull requests:
- 35725

Download

2.2.2 - 1180297 (July 16, 2024)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Updated the Docker image to: demisto/auth-utils:1.0.0.103532.

Related pull requests:
- 35425

Download

2.2.1 - 1162940 (July 9, 2024)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Fixed an issue where the fetch-events command was fetching only one type of event despite selecting several types.

Related pull requests:
- 35083

Download

2.2.0 - 1094962 (June 16, 2024)

Integrations

Microsoft Defender for Cloud Apps Event Collector

Added support for choosing event types to fetch, using a new Event types to fetch parameter.
Updated the Docker image to: demisto/auth-utils:1.0.0.97301.

Related pull requests:
- 34764

Download

2.1.62 - 1066075 (June 3, 2024)

Integrations

Microsoft Defender for Cloud Apps

Fixed an issue in where the GCC endpoints were incorrect in the supported integrations.

Microsoft Defender for Cloud Apps Event Collector

Fixed an issue in where the GCC endpoints were incorrect in the supported integrations.

Related pull requests:
- 34634

Download

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 9, 2020
Last Release	June 9, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

Microsoft Defender for Cloud Apps

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.