Defender XDR On-Queue

​

Overview

Agent On-Queue for Defender XDR allows ContraForce Security Delivery Agents to automatically detect and respond to incidents originating directly from Microsoft Defender XDR with no Microsoft Sentinel forwarding required. Previously, agents could only auto-trigger on incidents ingested through Sentinel. Customers using Defender XDR directly had to manually trigger agent actions. With this update, ContraForce polls Defender XDR for new incidents approximately every 2 minutes, automatically triggering your agent to triage and respond in order to deliver the autonomous SOC experience with minimal time-to-respond.

​

How It Works

ContraForce continuously polls the Microsoft Defender XDR security API for new incidents across all eligible customer accounts. When a new incident is detected:

1. The platform identifies the incident and checks it against previously processed incidents to prevent duplicates.
2. A notification is queued for processing.
3. ContraForce validates that the account has a deployed agent with the appropriate severity capability for the incident.
4. The agent is automatically triggered on-queue to investigate and respond — just as it would for Sentinel-ingested incidents.

The entire pipeline runs automatically. No manual intervention is required once configured.

​

Prerequisites

Before Agent On-Queue for Defender XDR can activate for a workspace, all of the following must be true:

​

What Changes for You

​

If you use Defender XDR without Sentinel

This is the feature for you. Once the prerequisites are met, your agent will begin automatically processing Defender XDR incidents within approximately 2 minutes of their creation. No configuration changes are needed on your end — the platform handles everything.

​

If you already forward to Sentinel

Nothing changes. Your incidents continue to flow through the Sentinel ingestion pipeline as before. The Defender XDR polling pipeline automatically excludes accounts with Sentinel forwarding enabled.

​

If you use both

Accounts are evaluated individually. Workspaces with Sentinel forwarding enabled use the Sentinel pipeline. Workspaces without Sentinel forwarding use the new Defender XDR polling pipeline. There is no overlap or duplicate processing.

​

Configuring Your Agent for Defender XDR Incidents

If you already have a Security Delivery Agent deployed and configured, no additional setup is required. The platform automatically detects eligible workspaces and begins polling. To deploy or configure an agent:

1. Navigate to Agent Center from the left navigation menu.
2. Deploy your agent following the Agent Center Deployment guide.
3. Configure the agent’s ProcessIncident capability and select which severity levels the agent should handle automatically.
4. Set the agent mode to On Queue.

Once the agent is on-queue with ProcessIncident enabled, ContraForce will begin polling Defender XDR and triggering the agent for matching incidents.

​

Verifying It’s Working

After setup, confirm that the pipeline is active:

1. Check Agent Center — Verify your agent status shows On Queue and the mode is set to your preferred level (Manual, Automatic, or Autonomous).
2. Monitor the Command Dashboard — New Defender XDR incidents should appear on the Command Dashboard within approximately 2 minutes of creation in Defender.
3. Review Gamebook Activity — When the agent processes an incident, you’ll see corresponding Gamebook activity in the Gamebook Activity widgets and the incident’s Workbench.
4. Check Agent Execution History — Navigate to Agent Center to review the agent’s execution history and confirm incidents are being processed.

​

Incident Detection Timing

ContraForce polls Defender XDR approximately every 2 minutes. This means:

• New incidents are typically detected within 2 minutes of appearing in Defender XDR.
• The agent is triggered immediately after detection and validation.
• End-to-end time from incident creation to agent response initiation is typically under 5 minutes.

​

Troubleshooting

If the issue persists after reviewing the above, contact support@contraforce.com with:

• Workspace name
• Agent status screenshot from Agent Center
• Approximate timestamp of the incident that was not processed
• Any error messages visible in the portal

​

Frequently Asked Questions

Do I need to change anything if I’m already using Sentinel? No. If your workspace forwards Defender XDR incidents to Sentinel, your existing pipeline continues to work. The Defender XDR polling pipeline automatically skips your account. Can I use both Sentinel and direct Defender XDR ingestion for the same workspace? No. Each workspace uses one ingestion path. If Sentinel forwarding is enabled, incidents come through Sentinel. If it’s disabled, incidents come through the Defender XDR polling pipeline. This prevents duplicate processing. What response actions are available for Defender XDR incidents? The same Gamebook response actions available for any incident — device isolation, account disabling, password resets, IP/URL blocking, file quarantine, email deletion, and more. See the Microsoft Defender Capability Matrix for the full list based on your license. Is there any additional cost for this feature? No. Agent On-Queue for Defender XDR is included with your existing ContraForce subscription and agent deployment. No additional modules or licenses are required beyond the standard XDR module and Agent Center. What happens if the polling service restarts? Polling state is persisted per account. If the service restarts, it resumes from the last known position with a configurable overlap window to ensure no incidents are missed.