MDE Isolate Host: IP lookup returned Machine ID for different device

kishdh
Mega Contributor

2 hours ago

Hi ...

We are troubleshooting the ServiceNow Security Incident Response Microsoft Defender for Endpoint Isolate Host integration.

 

For example, we tested:

 
Hostname: USxxxxx
FQDN: usxxxxx.america.xxxxx.xxx
IP: xxx.xx.240.1
 

ServiceNow selected IP as the MDE device lookup method and called: /api/machines/findbyip using the Configuration Item's IP address.

The lookup returned "Success" and a Defender Machine ID. However, Microsoft Defender Advanced Hunting showed that the returned Machine ID actually belonged to a different endpoint:

 
 
cnxxxxx.asiapac.xxxxx.xxx and this intended device had a different Defender Device ID.
 

The workflow subsequently submitted an isolation request using the returned Machine ID. Thankfully, that action remained "Pending" and eventually timed out.

 

Has anyone encountered this behavior with the ServiceNow MDE integration?

Specifically:

  • Is IP expected to take priority over FQDN/hostname for MDE machine resolution?
  • Is there a supported way to prefer FQDN or hostname over IP?
  • Does anyone know if the OOB integration validates the Defender "computerDnsName" returned by the lookup against the CI hostname/FQDN before using the Machine ID for remediation?
  • I am assuming that /api/machines/findbyip returned a different machine due to stale/reused IP information. and if the IP associated with a CI is stale or incorrect, is it expected that the integration should trust the result without cross-validating the hostname/FQDN? <yikes>

We obviously cannot use this OOB functionality currently, but I swear it used to work.

0 Helpfuls
  • 53 Views
0 REPLIES 0