When an organisation doesn't synchronise computers in AzureAD, the function getMachineID is not able to retrieve an id as the field AadDeviceID returns null. In this case, it retrieves the field id, which is an id provided by MDE to the machine.
We had issues with the oauth uri, and updated the uri provided in the json files with the latest one on MS's documentation.
Fixed the Dockerfile as the -r option was causing issues during the build.
Fixed the malformed json body of the pushCustomIOCAlert function.
New Features :
You can now lauch an automated investigation on a device
You can restrict the exectution of apps on the device (leaves Outlook, skype, Teams operational). Not as restrictive as device isolation. A tag is applied to the observable
Added more IOC options to push to MDE :
Hashes (MD5, SHA1 and SHA256)
Domains
Url
Also minor updates to the readme file, a new api permission is required to restrict device app execution
This issue is related to the following PR : #1225
New Features :
Also minor updates to the readme file, a new api permission is required to restrict device app execution