mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 14:27:22 +00:00
domains
This commit is contained in:
Ben Alfasi
parent
68eeb287df
commit
20cecb5e8c
@ -18,11 +18,19 @@ ms.topic: article
|
||||
|
||||
# Get domain related alerts API
|
||||
|
||||
**Applies to:**
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
## API description
|
||||
Retrieves a collection of [Alerts](alerts.md) related to a given domain address.
|
||||
|
||||
|
||||
## Limitations
|
||||
1. You can query on alerts last updated in the past 30 days.
|
||||
2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
Retrieves a collection of alerts related to a given domain address.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
@ -68,58 +76,3 @@ Here is an example of the request.
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/domains/client.wns.windows.com/alerts
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "441688558380765161_2136280442",
|
||||
"incidentId": 8633,
|
||||
"assignedTo": "secop@contoso.com",
|
||||
"severity": "Low",
|
||||
"status": "InProgress",
|
||||
"classification": "TruePositive",
|
||||
"determination": "Malware",
|
||||
"investigationState": "Running",
|
||||
"category": "MalwareDownload",
|
||||
"detectionSource": "WindowsDefenderAv",
|
||||
"threatFamilyName": "Mikatz",
|
||||
"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
|
||||
"description": "Some description",
|
||||
"alertCreationTime": "2018-11-25T16:19:21.8409809Z",
|
||||
"firstEventTime": "2018-11-25T16:17:50.0948658Z",
|
||||
"lastEventTime": "2018-11-25T16:18:01.809871Z",
|
||||
"resolvedTime": null,
|
||||
"machineId": "9d80fbbc1bdbc5ce968f1d37c72384cbe17ee337"
|
||||
},
|
||||
{
|
||||
"id": "121688558380765161_2136280442",
|
||||
"incidentId": 4123,
|
||||
"assignedTo": "secop@contoso.com",
|
||||
"severity": "Low",
|
||||
"status": "InProgress",
|
||||
"classification": "TruePositive",
|
||||
"determination": "Malware",
|
||||
"investigationState": "Running",
|
||||
"category": "MalwareDownload",
|
||||
"detectionSource": "WindowsDefenderAv",
|
||||
"threatFamilyName": "Mikatz",
|
||||
"title": "Windows Defender AV detected 'Mikatz', high-severity malware",
|
||||
"description": "Some description",
|
||||
"alertCreationTime": "2018-11-24T16:19:21.8409809Z",
|
||||
"firstEventTime": "2018-11-24T16:17:50.0948658Z",
|
||||
"lastEventTime": "2018-11-24T16:18:01.809871Z",
|
||||
"resolvedTime": null,
|
||||
"machineId": "9d80fbbc1bdbc5ce968f1d37c72384cbe17ee337"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
@ -17,10 +17,20 @@ ms.topic: article
|
||||
---
|
||||
|
||||
# Get domain related machines API
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Retrieves a collection of machines that have communicated to or from a given domain address.
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
## API description
|
||||
Retrieves a collection of [Machines](machine.md) that have communicated to or from a given domain address.
|
||||
|
||||
|
||||
## Limitations
|
||||
1. You can query on machines last seen in the past 30 days.
|
||||
2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
@ -68,54 +78,3 @@ Here is an example of the request.
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/domains/api.securitycenter.windows.com/machines
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
|
||||
"computerDnsName": "mymachine1.contoso.com",
|
||||
"firstSeen": "2018-08-02T14:55:03.7791856Z",
|
||||
"lastSeen": "2018-08-02T14:55:03.7791856Z",
|
||||
"osPlatform": "Windows10",
|
||||
"osVersion": "10.0.0.0",
|
||||
"lastIpAddress": "172.17.230.209",
|
||||
"lastExternalIpAddress": "167.220.196.71",
|
||||
"agentVersion": "10.5830.18209.1001",
|
||||
"osBuild": 18209,
|
||||
"healthStatus": "Active",
|
||||
"rbacGroupId": 140,
|
||||
"rbacGroupName": "The-A-Team",
|
||||
"riskScore": "Low",
|
||||
"aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9",
|
||||
"machineTags": [ "test tag 1", "test tag 2" ]
|
||||
},
|
||||
{
|
||||
"id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7",
|
||||
"computerDnsName": "mymachine2.contoso.com",
|
||||
"firstSeen": "2018-07-09T13:22:45.1250071Z",
|
||||
"lastSeen": "2018-07-09T13:22:45.1250071Z",
|
||||
"osPlatform": "Windows10",
|
||||
"osVersion": "10.0.0.0",
|
||||
"lastIpAddress": "192.168.12.225",
|
||||
"lastExternalIpAddress": "79.183.65.82",
|
||||
"agentVersion": "10.5820.17724.1000",
|
||||
"osBuild": 17724,
|
||||
"healthStatus": "Inactive",
|
||||
"rbacGroupId": 140,
|
||||
"rbacGroupName": "The-A-Team",
|
||||
"riskScore": "Low",
|
||||
"aadDeviceId": null,
|
||||
"machineTags": [ "test tag 1" ]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
@ -18,10 +18,18 @@ ms.topic: article
|
||||
|
||||
# Get domain statistics API
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
## API description
|
||||
Retrieves the statistics on the given domain.
|
||||
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
Retrieves the prevalence for the given domain.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user