deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-15 14:57:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Undo changes to API topics

Browse Source
This commit is contained in:
lomayor 2019-12-13 17:31:13 -08:00
parent 9d467cb68e
commit 3325a4ea9e
4 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md
View File

@ -32,7 +32,7 @@ In this section we share PowerShell samples to
>**Prerequisite**: You first need to [create an app](apis-intro.md). >**Prerequisite**: You first need to [create an app](apis-intro.md).
## Preparation Instructions ## Preparation instructions
- Open a PowerShell window. - Open a PowerShell window.
- If your policy does not allow you to run the PowerShell commands, you can run the below command: - If your policy does not allow you to run the PowerShell commands, you can run the below command:
@ -99,7 +99,7 @@ Foreach($alert in $alerts)
$commaSeparatedMachines = '"{0}"' -f ($machinesToInvestigate -join '","') $commaSeparatedMachines = '"{0}"' -f ($machinesToInvestigate -join '","')
$query = "DeviceNetworkEvents $query = "NetworkCommunicationEvents
| where MachineId in ($commaSeparatedMachines) | where MachineId in ($commaSeparatedMachines)
| where RemoteUrl == `"$suspiciousUrl`" | where RemoteUrl == `"$suspiciousUrl`"
| summarize ConnectionsCount = count() by MachineId" | summarize ConnectionsCount = count() by MachineId"

2
windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md
View File

@ -81,7 +81,7 @@ Here is an example of the request.
POST https://api.securitycenter.windows.com/api/advancedqueries/run POST https://api.securitycenter.windows.com/api/advancedqueries/run
Content-type: application/json Content-type: application/json
{ {
"Query":"DeviceProcessEvents "Query":"ProcessCreationEvents
| where InitiatingProcessFileName =~ \"powershell.exe\" | where InitiatingProcessFileName =~ \"powershell.exe\"
| where ProcessCommandLine contains \"appdata\" | where ProcessCommandLine contains \"appdata\"
| project EventTime, FileName, InitiatingProcessFileName | project EventTime, FileName, InitiatingProcessFileName

2
windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md
View File

@ -70,7 +70,7 @@ where
Run the following query: Run the following query:
``` ```
$query = 'DeviceRegistryEvents | limit 10' # Paste your own query here $query = 'RegistryEvents | limit 10' # Paste your own query here
$url = "https://api.securitycenter.windows.com/api/advancedqueries/run" $url = "https://api.securitycenter.windows.com/api/advancedqueries/run"
$headers = @{ $headers = @{

2
windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md
View File

@ -73,7 +73,7 @@ where
Run the following query: Run the following query:
``` ```
query = 'DeviceRegistryEvents | limit 10' # Paste your own query here query = 'RegistryEvents | limit 10' # Paste your own query here
url = "https://api.securitycenter.windows.com/api/advancedqueries/run" url = "https://api.securitycenter.windows.com/api/advancedqueries/run"
headers = { headers = {