deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-23 14:23:38 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

inv

Browse Source
This commit is contained in:
Ben Alfasi
2020-01-06 23:02:39 +02:00
parent 217a2019c9
commit 2e60553f9e
4 changed files with 14 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
windows/security/threat-protection/TOC.md
View File

@ -406,7 +406,6 @@
####### [Run antivirus scan](microsoft-defender-atp/run-av-scan.md)
####### [Offboard machine](microsoft-defender-atp/offboard-machine-api.md)
####### [Stop and quarantine file](microsoft-defender-atp/stop-and-quarantine-file.md)
####### [Initiate investigation (preview)](microsoft-defender-atp/initiate-autoir-investigation.md)
###### [Automated Investigation]()
####### [Investigation methods and properties](microsoft-defender-atp/investigation.md)

98
windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md
View File

@ -1,98 +0,0 @@
---
title: Initiate machine investigation API
description: Use this API to create calls related to initiating an investigation on a machine.
keywords: apis, graph api, supported apis, initiate AutoIR investigation
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
---
# Initiate machine investigation API (Preview)
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
> [!IMPORTANT]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Initiate AutoIR investigation on a machine.
>[!Note]
> This page focuses on performing an automated investigation on a machine. See [automated investigation](automated-investigations.md) for more information.
## Limitations
1. The number of executions is limited (up to 5 calls per hour).
2. For Automated Investigation limitations, see [Automated Investigation](automated-investigations.md).
## Permissions
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
Permission type | Permission | Permission display name
:---|:---|:---
Application | Alert.ReadWrite.All | 'Read and write all alerts'
Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
>[!Note]
> When obtaining a token using user credentials:
>- The user needs to have at least the following role permission: 'Alerts Investigation' (See [Create and manage roles](user-roles.md) for more information)
>- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information)
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/InitiateInvestigation
```
## Request headers
Name | Type | Description
:---|:---|:---
Authorization | String | Bearer {token}. **Required**.
Content-Type | string | application/json. **Required**.
## Request body
In the request body, supply a JSON object with the following parameters:
Parameter | Type | Description
:---|:---|:---
Comment | String | Comment to associate with the action. **Required**.
## Response
If successful, this method returns 200 OK response code with object that holds the investigation ID in the "value" parameter. If machine was not found - 404 Not Found.
## Example
**Request**
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.windows.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/InitiateInvestigation
Content-type: application/json
{
"Comment": "Initiate an investigation on machine fb9ab6be3965095a09c057be7c90f0a2"
}
```
**Response**
Here is an example of the response.
```
HTTP/1.1 200 Created
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Edm.Int64",
"value": 5146
}
```

7
windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt
View File

@ -380,7 +380,12 @@
####### [Run antivirus scan](run-av-scan.md)
####### [Offboard machine](offboard-machine-api.md)
####### [Stop and quarantine file](stop-and-quarantine-file.md)
####### [Initiate investigation (preview)](initiate-autoir-investigation.md)
###### [Automated Investigation]()
####### [Investigation methods and properties](microsoft-defender-atp/investigation.md)
####### [List Investigation](microsoft-defender-atp/get-investigation-collection.md)
####### [Get Investigation](microsoft-defender-atp/get-investigation-object.md)
####### [Start Investigation](microsoft-defender-atp/start-investigation.md)
###### [Indicators]()
####### [Methods and properties](ti-indicator.md)

29
windows/security/threat-protection/microsoft-defender-atp/start-investigation.md
View File

@ -24,25 +24,21 @@ ms.topic: article
## API description
Starts automated investigation on a machine.
Start automated investigation on a machine.
<br>See [Overview of automated investigations](automated-investigations.md) for more information.
-------------------------- im here
## Limitations
1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
1. Rate limitations for this API are 50 calls per hour.
[!include[Machine actions note](../../includes/machineactionsnote.md)]
## Permissions
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
Permission type | Permission | Permission display name
:---|:---|:---
Application | Machine.Isolate | 'Isolate machine'
Delegated (work or school account) | Machine.Isolate | 'Isolate machine'
Application | Alert.ReadWrite.All | 'Read and write all alerts'
Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
>[!Note]
> When obtaining a token using user credentials:
@ -52,7 +48,7 @@ Delegated (work or school account) | Machine.Isolate | 'Isolate machine'
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/isolate
POST https://api.securitycenter.microsoft.com/api/machines/{id}/startInvestigation
```
## Request headers
@ -68,15 +64,10 @@ In the request body, supply a JSON object with the following parameters:
Parameter | Type | Description
:---|:---|:---
Comment | String | Comment to associate with the action. **Required**.
IsolationType | String | Type of the isolation. Allowed values are: 'Full' or 'Selective'.
**IsolationType** controls the type of isolation to perform and can be one of the following:
- Full – Full isolation
- Selective – Restrict only limited set of applications from accessing the network (see [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network) for more details)
## Response
If successful, this method returns 201 - Created response code and [Machine Action](machineaction.md) in the response body.
If successful, this method returns 201 - Created response code and [Investigation](investigation.md) in the response body.
## Example
@ -88,12 +79,8 @@ Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/isolate
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/startInvestigation
Content-type: application/json
{
"Comment": "Isolate machine due to alert 1234",
“IsolationType”: “Full”
"Comment": "Test investigation",
}
- To unisolate a machine, see [Release machine from isolation](unisolate-machine.md).