From 7da89e0d2640e7de18890be1751d6167b95cd643 Mon Sep 17 00:00:00 2001 From: David Laufer Date: Sun, 11 Nov 2018 13:25:34 +0200 Subject: [PATCH] Advanced Hunting API --- .../windows-defender-atp/run-advanced-query-api.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md index 4281f9dd00..8decfce57c 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md @@ -29,7 +29,7 @@ This API allows you to run programmatic queries that you are used to running fro This API is a beta version only and is currently restricted to the following actions: 1. ​You can only run a query on data from the last 30 days 2. The results will include a maximum of 10,000 rows -3. The number of executions is limited​ (up to 15 minutes every hour and 4 hours a day) +3. The number of executions is limited​ (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day) ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) @@ -41,7 +41,7 @@ Delegated (work or school account) | AdvancedQuery.Read | 'Run advanced queries' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have 'Global Admin' AD role +>- The user needs to have 'Global Admin' AD role (note: will be updated soon to 'View Data') >- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) for more information) ## HTTP request