mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge pull request #6226 from konstruktoid/mslinting
threat-protection/microsoft-defender-atp linting
This commit is contained in:
Kateyanne
GitHub
commit
3db0fe8129
@ -1,108 +1,108 @@
|
||||
---
|
||||
title: List all recommendations
|
||||
description: Retrieves a list of all security recommendations affecting the organization.
|
||||
keywords: apis, graph api, supported apis, get, security recommendations, mdatp tvm api, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List all recommendations
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of all security recommendations affecting the organization.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the list of security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations",
|
||||
"value": [
|
||||
{
|
||||
"id": "va-_-microsoft-_-windows_10",
|
||||
"productName": "windows_10",
|
||||
"recommendationName": "Update Windows 10",
|
||||
"weaknesses": 397,
|
||||
"vendor": "microsoft",
|
||||
"recommendedVersion": "",
|
||||
"recommendationCategory": "Application",
|
||||
"subCategory": "",
|
||||
"severityScore": 0,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"associatedThreats": [
|
||||
"3098b8ef-23b1-46b3-aed4-499e1928f9ed",
|
||||
"40c189d5-0330-4654-a816-e48c2b7f9c4b",
|
||||
"4b0c9702-9b6c-4ca2-9d02-1556869f56f8",
|
||||
"e8fc2121-3cf3-4dd2-9ea0-87d7e1d2b29d",
|
||||
"94b6e94b-0c1d-4817-ac06-c3b8639be3ab"
|
||||
],
|
||||
"remediationType": "Update",
|
||||
"status": "Active",
|
||||
"configScoreImpact": 0,
|
||||
"exposureImpact": 7.674418604651163,
|
||||
"totalMachineCount": 37,
|
||||
"exposedMachinesCount": 7,
|
||||
"nonProductivityImpactedAssets": 0,
|
||||
"relatedComponent": "Windows 10"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
|
||||
---
|
||||
title: List all recommendations
|
||||
description: Retrieves a list of all security recommendations affecting the organization.
|
||||
keywords: apis, graph api, supported apis, get, security recommendations, mdatp tvm api, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List all recommendations
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of all security recommendations affecting the organization.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the list of security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations",
|
||||
"value": [
|
||||
{
|
||||
"id": "va-_-microsoft-_-windows_10",
|
||||
"productName": "windows_10",
|
||||
"recommendationName": "Update Windows 10",
|
||||
"weaknesses": 397,
|
||||
"vendor": "microsoft",
|
||||
"recommendedVersion": "",
|
||||
"recommendationCategory": "Application",
|
||||
"subCategory": "",
|
||||
"severityScore": 0,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"associatedThreats": [
|
||||
"3098b8ef-23b1-46b3-aed4-499e1928f9ed",
|
||||
"40c189d5-0330-4654-a816-e48c2b7f9c4b",
|
||||
"4b0c9702-9b6c-4ca2-9d02-1556869f56f8",
|
||||
"e8fc2121-3cf3-4dd2-9ea0-87d7e1d2b29d",
|
||||
"94b6e94b-0c1d-4817-ac06-c3b8639be3ab"
|
||||
],
|
||||
"remediationType": "Update",
|
||||
"status": "Active",
|
||||
"configScoreImpact": 0,
|
||||
"exposureImpact": 7.674418604651163,
|
||||
"totalMachineCount": 37,
|
||||
"exposedMachinesCount": 7,
|
||||
"nonProductivityImpactedAssets": 0,
|
||||
"relatedComponent": "Windows 10"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
|
||||
|
||||
@ -1,96 +1,96 @@
|
||||
---
|
||||
title: Get all vulnerabilities
|
||||
description: Retrieves a list of all the vulnerabilities affecting the organization
|
||||
keywords: apis, graph api, supported apis, get, vulnerability information, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List vulnerabilities
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of all the vulnerabilities affecting the organization.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the list of vulnerabilities in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Vulnerabilities",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2019-0608",
|
||||
"name": "CVE-2019-0608",
|
||||
"description": "A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.The update addresses the vulnerability by correcting how Microsoft Browsers parses HTTP responses.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.3,
|
||||
"exposedMachines": 4,
|
||||
"publishedOn": "2019-10-08T00:00:00Z",
|
||||
"updatedOn": "2019-12-16T16:20:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
...
|
||||
]
|
||||
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
---
|
||||
title: Get all vulnerabilities
|
||||
description: Retrieves a list of all the vulnerabilities affecting the organization
|
||||
keywords: apis, graph api, supported apis, get, vulnerability information, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List vulnerabilities
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of all the vulnerabilities affecting the organization.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the list of vulnerabilities in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Vulnerabilities",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2019-0608",
|
||||
"name": "CVE-2019-0608",
|
||||
"description": "A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.The update addresses the vulnerability by correcting how Microsoft Browsers parses HTTP responses.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.3,
|
||||
"exposedMachines": 4,
|
||||
"publishedOn": "2019-10-08T00:00:00Z",
|
||||
"updatedOn": "2019-12-16T16:20:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
...
|
||||
]
|
||||
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
|
||||
@ -1,83 +1,83 @@
|
||||
---
|
||||
title: Get Machine Secure score
|
||||
description: Retrieves the organizational device secure score.
|
||||
keywords: apis, graph api, supported apis, get, alerts, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get Machine Secure score
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves the organizational device secure score.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Score.Read.Alll | 'Read Threat and Vulnerability Management score'
|
||||
Delegated (work or school account) | Score.Read | 'Read Threat and Vulnerability Management score'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/configurationScore
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with the with device secure score data in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/configurationScore
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response list shown here may be truncated for brevity.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ConfigurationScore/$entity",
|
||||
"time": "2019-12-03T09:15:58.1665846Z",
|
||||
"score": 340
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
---
|
||||
title: Get Machine Secure score
|
||||
description: Retrieves the organizational device secure score.
|
||||
keywords: apis, graph api, supported apis, get, alerts, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get Machine Secure score
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves the organizational device secure score.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Score.Read.Alll | 'Read Threat and Vulnerability Management score'
|
||||
Delegated (work or school account) | Score.Read | 'Read Threat and Vulnerability Management score'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/configurationScore
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with the device secure score data in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/configurationScore
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response list shown here may be truncated for brevity.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ConfigurationScore/$entity",
|
||||
"time": "2019-12-03T09:15:58.1665846Z",
|
||||
"score": 340
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
@ -1,93 +1,93 @@
|
||||
---
|
||||
title: Get discovered vulnerabilities
|
||||
description: Retrieves a collection of discovered vulnerabilities related to a given device ID.
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, discovered vulnerabilities, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get discovered vulnerabilities
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of discovered vulnerabilities related to a given device ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/{machineId}/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the discovered vulnerability information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2019-1348",
|
||||
"name": "CVE-2019-1348",
|
||||
"description": "Git could allow a remote attacker to bypass security restrictions, caused by a flaw in the --export-marks option of git fast-import. By persuading a victim to import specially-crafted content, an attacker could exploit this vulnerability to overwrite arbitrary paths.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.3,
|
||||
"exposedMachines": 1,
|
||||
"publishedOn": "2019-12-13T00:00:00Z",
|
||||
"updatedOn": "2019-12-13T00:00:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
---
|
||||
title: Get discovered vulnerabilities
|
||||
description: Retrieves a collection of discovered vulnerabilities related to a given device ID.
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, discovered vulnerabilities, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get discovered vulnerabilities
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of discovered vulnerabilities related to a given device ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/{machineId}/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the discovered vulnerability information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2019-1348",
|
||||
"name": "CVE-2019-1348",
|
||||
"description": "Git could allow a remote attacker to bypass security restrictions, caused by a flaw in the --export-marks option of git fast-import. By persuading a victim to import specially-crafted content, an attacker could exploit this vulnerability to overwrite arbitrary paths.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.3,
|
||||
"exposedMachines": 1,
|
||||
"publishedOn": "2019-12-13T00:00:00Z",
|
||||
"updatedOn": "2019-12-13T00:00:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
|
||||
@ -1,88 +1,88 @@
|
||||
---
|
||||
title: Get exposure score
|
||||
description: Retrieves the organizational exposure score.
|
||||
keywords: apis, graph api, supported apis, get, exposure score, organizational exposure score
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get exposure score
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves the organizational exposure score.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Score.Read.All | 'Read Threat and Vulnerability Management score'
|
||||
Delegated (work or school account) | Score.Read | 'Read Threat and Vulnerability Management score'
|
||||
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/exposureScore
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with the exposure data in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/exposureScore
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response list shown here may be truncated for brevity.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ExposureScore/$entity",
|
||||
"time": "2019-12-03T07:23:53.280499Z",
|
||||
"score": 33.491554051195706
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability exposure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score)
|
||||
|
||||
|
||||
---
|
||||
title: Get exposure score
|
||||
description: Retrieves the organizational exposure score.
|
||||
keywords: apis, graph api, supported apis, get, exposure score, organizational exposure score
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get exposure score
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves the organizational exposure score.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Score.Read.All | 'Read Threat and Vulnerability Management score'
|
||||
Delegated (work or school account) | Score.Read | 'Read Threat and Vulnerability Management score'
|
||||
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/exposureScore
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with the exposure data in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/exposureScore
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response list shown here may be truncated for brevity.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ExposureScore/$entity",
|
||||
"time": "2019-12-03T07:23:53.280499Z",
|
||||
"score": 33.491554051195706
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability exposure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score)
|
||||
|
||||
|
||||
|
||||
@ -1,89 +1,89 @@
|
||||
---
|
||||
title: Get installed software
|
||||
description: Retrieves a collection of installed software related to a given device ID.
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, software inventory, installed software per device, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get installed software
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of installed software related to a given device ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/{machineId}/software
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the installed software information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/software
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Software",
|
||||
"value": [
|
||||
{
|
||||
"id": "microsoft-_-internet_explorer",
|
||||
"name": "internet_explorer",
|
||||
"vendor": "microsoft",
|
||||
"weaknesses": 67,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 42115,
|
||||
"impactScore": 46.2037163
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
---
|
||||
title: Get installed software
|
||||
description: Retrieves a collection of installed software related to a given device ID.
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, software inventory, installed software per device, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get installed software
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of installed software related to a given device ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/{machineId}/software
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the installed software information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/software
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Software",
|
||||
"value": [
|
||||
{
|
||||
"id": "microsoft-_-internet_explorer",
|
||||
"name": "internet_explorer",
|
||||
"vendor": "microsoft",
|
||||
"weaknesses": 67,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 42115,
|
||||
"impactScore": 46.2037163
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
|
||||
@ -1,91 +1,91 @@
|
||||
---
|
||||
title: List exposure score by device group
|
||||
description: Retrieves a list of exposure scores by device group.
|
||||
keywords: apis, graph api, supported apis, get, exposure score, device group, device group exposure score
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List exposure score by device group
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of alerts related to a given domain address.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Score.Read.All | 'Read Threat and Vulnerability Management score'
|
||||
Delegated (work or school account) | Score.Read | 'Read Threat and Vulnerability Management score'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/exposureScore/ByMachineGroups
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with a list of exposure score per device group data in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/exposureScore/ByMachineGroups
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ExposureScore",
|
||||
"value": [
|
||||
{
|
||||
"time": "2019-12-03T09:51:28.214338Z",
|
||||
"score": 41.38041766305988,
|
||||
"rbacGroupName": "GroupOne"
|
||||
},
|
||||
{
|
||||
"time": "2019-12-03T09:51:28.2143399Z",
|
||||
"score": 37.403726933165366,
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability exposure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score)
|
||||
---
|
||||
title: List exposure score by device group
|
||||
description: Retrieves a list of exposure scores by device group.
|
||||
keywords: apis, graph api, supported apis, get, exposure score, device group, device group exposure score
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List exposure score by device group
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of alerts related to a given domain address.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Score.Read.All | 'Read Threat and Vulnerability Management score'
|
||||
Delegated (work or school account) | Score.Read | 'Read Threat and Vulnerability Management score'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/exposureScore/ByMachineGroups
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with a list of exposure score per device group data in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/exposureScore/ByMachineGroups
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ExposureScore",
|
||||
"value": [
|
||||
{
|
||||
"time": "2019-12-03T09:51:28.214338Z",
|
||||
"score": 41.38041766305988,
|
||||
"rbacGroupName": "GroupOne"
|
||||
},
|
||||
{
|
||||
"time": "2019-12-03T09:51:28.2143399Z",
|
||||
"score": 37.403726933165366,
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability exposure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score)
|
||||
|
||||
@ -1,93 +1,93 @@
|
||||
---
|
||||
title: List devices by software
|
||||
description: Retrieve a list of devices that has this software installed.
|
||||
keywords: apis, graph api, supported apis, get, list devices, devices list, list devices by software, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List devices by software
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieve a list of device references that has this software installed.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}/machineReferences
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK and a list of devices with the software installed in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/machineReferences
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#MachineReferences",
|
||||
"value": [
|
||||
{
|
||||
"id": "7c7e1896fa39efb0a32a2cf421d837af1b9bf762",
|
||||
"computerDnsName": "dave_desktop",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
},
|
||||
{
|
||||
"id": "7d5cc2e7c305e4a0a290392abf6707f9888fda0d",
|
||||
"computerDnsName": "jane_PC",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
---
|
||||
title: List devices by software
|
||||
description: Retrieve a list of devices that has this software installed.
|
||||
keywords: apis, graph api, supported apis, get, list devices, devices list, list devices by software, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List devices by software
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieve a list of device references that has this software installed.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}/machineReferences
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK and a list of devices with the software installed in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/machineReferences
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#MachineReferences",
|
||||
"value": [
|
||||
{
|
||||
"id": "7c7e1896fa39efb0a32a2cf421d837af1b9bf762",
|
||||
"computerDnsName": "dave_desktop",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
},
|
||||
{
|
||||
"id": "7d5cc2e7c305e4a0a290392abf6707f9888fda0d",
|
||||
"computerDnsName": "jane_PC",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
|
||||
@ -1,92 +1,92 @@
|
||||
---
|
||||
title: List devices by vulnerability
|
||||
description: Retrieves a list of devices affected by a vulnerability.
|
||||
keywords: apis, graph api, supported apis, get, devices list, vulnerable devices, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List devices by vulnerability
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of devices affected by a vulnerability.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/vulnerabilities/{cveId}/machineReferences
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the vulnerability information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/vulnerabilities/CVE-2019-0608/machineReferences
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineReferences",
|
||||
"value": [
|
||||
{
|
||||
"id": "235a2e6278c63fcf85bab9c370396972c58843de",
|
||||
"computerDnsName": "h1mkn_PC",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
},
|
||||
{
|
||||
"id": "afb3f807d1a185ac66668f493af028385bfca184",
|
||||
"computerDnsName": "chat_Desk ",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
---
|
||||
title: List devices by vulnerability
|
||||
description: Retrieves a list of devices affected by a vulnerability.
|
||||
keywords: apis, graph api, supported apis, get, devices list, vulnerable devices, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List devices by vulnerability
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of devices affected by a vulnerability.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/vulnerabilities/{cveId}/machineReferences
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the vulnerability information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/vulnerabilities/CVE-2019-0608/machineReferences
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineReferences",
|
||||
"value": [
|
||||
{
|
||||
"id": "235a2e6278c63fcf85bab9c370396972c58843de",
|
||||
"computerDnsName": "h1mkn_PC",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
},
|
||||
{
|
||||
"id": "afb3f807d1a185ac66668f493af028385bfca184",
|
||||
"computerDnsName": "chat_Desk ",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
|
||||
@ -1,96 +1,96 @@
|
||||
---
|
||||
title: Get recommendation by Id
|
||||
description: Retrieves a security recommendation by its ID.
|
||||
keywords: apis, graph api, supported apis, get, security recommendation, security recommendation by ID, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get recommendation by ID
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a security recommendation by its ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations/$entity",
|
||||
"id": "va-_-google-_-chrome",
|
||||
"productName": "chrome",
|
||||
"recommendationName": "Update Chrome",
|
||||
"weaknesses": 38,
|
||||
"vendor": "google",
|
||||
"recommendedVersion": "",
|
||||
"recommendationCategory": "Application",
|
||||
"subCategory": "",
|
||||
"severityScore": 0,
|
||||
"publicExploit": false,
|
||||
"activeAlert": false,
|
||||
"associatedThreats": [],
|
||||
"remediationType": "Update",
|
||||
"status": "Active",
|
||||
"configScoreImpact": 0,
|
||||
"exposureImpact": 3.9441860465116285,
|
||||
"totalMachineCount": 6,
|
||||
"exposedMachinesCount": 5,
|
||||
"nonProductivityImpactedAssets": 0,
|
||||
"relatedComponent": "Chrome"
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
---
|
||||
title: Get recommendation by Id
|
||||
description: Retrieves a security recommendation by its ID.
|
||||
keywords: apis, graph api, supported apis, get, security recommendation, security recommendation by ID, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get recommendation by ID
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a security recommendation by its ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations/$entity",
|
||||
"id": "va-_-google-_-chrome",
|
||||
"productName": "chrome",
|
||||
"recommendationName": "Update Chrome",
|
||||
"weaknesses": 38,
|
||||
"vendor": "google",
|
||||
"recommendedVersion": "",
|
||||
"recommendationCategory": "Application",
|
||||
"subCategory": "",
|
||||
"severityScore": 0,
|
||||
"publicExploit": false,
|
||||
"activeAlert": false,
|
||||
"associatedThreats": [],
|
||||
"remediationType": "Update",
|
||||
"status": "Active",
|
||||
"configScoreImpact": 0,
|
||||
"exposureImpact": 3.9441860465116285,
|
||||
"totalMachineCount": 6,
|
||||
"exposedMachinesCount": 5,
|
||||
"nonProductivityImpactedAssets": 0,
|
||||
"relatedComponent": "Chrome"
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
|
||||
@ -1,85 +1,85 @@
|
||||
---
|
||||
title: List devices by recommendation
|
||||
description: Retrieves a list of devices associated with the security recommendation.
|
||||
keywords: apis, graph api, supported apis, get, security recommendation for vulnerable devices, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List devices by recommendation
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of devices associated with the security recommendation.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}/machineReferences
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the list of devices associated with the security recommendation.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/machineReferences
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineReferences",
|
||||
"value": [
|
||||
{
|
||||
"id": "e058770379bc199a9c179ce52a23e16fd44fd2ee",
|
||||
"computerDnsName": "niw_pc",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
---
|
||||
title: List devices by recommendation
|
||||
description: Retrieves a list of devices associated with the security recommendation.
|
||||
keywords: apis, graph api, supported apis, get, security recommendation for vulnerable devices, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List devices by recommendation
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of devices associated with the security recommendation.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}/machineReferences
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the list of devices associated with the security recommendation.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/machineReferences
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineReferences",
|
||||
"value": [
|
||||
{
|
||||
"id": "e058770379bc199a9c179ce52a23e16fd44fd2ee",
|
||||
"computerDnsName": "niw_pc",
|
||||
"osPlatform": "Windows10",
|
||||
"rbacGroupName": "GroupTwo"
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
|
||||
@ -1,84 +1,84 @@
|
||||
---
|
||||
title: Get recommendation by software
|
||||
description: Retrieves a security recommendation related to a specific software.
|
||||
keywords: apis, graph api, supported apis, get, security recommendation, security recommendation for software, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get recommendation by software
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a security recommendation related to a specific software.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}/software
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the software associated with the security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/software
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Analytics.Contracts.PublicAPI.PublicProductDto",
|
||||
"id": "google-_-chrome",
|
||||
"name": "chrome",
|
||||
"vendor": "google",
|
||||
"weaknesses": 38,
|
||||
"publicExploit": false,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 5,
|
||||
"impactScore": 3.94418621
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
---
|
||||
title: Get recommendation by software
|
||||
description: Retrieves a security recommendation related to a specific software.
|
||||
keywords: apis, graph api, supported apis, get, security recommendation, security recommendation for software, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get recommendation by software
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a security recommendation related to a specific software.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}/software
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the software associated with the security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/software
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Analytics.Contracts.PublicAPI.PublicProductDto",
|
||||
"id": "google-_-chrome",
|
||||
"name": "chrome",
|
||||
"vendor": "google",
|
||||
"weaknesses": 38,
|
||||
"publicExploit": false,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 5,
|
||||
"impactScore": 3.94418621
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
|
||||
@ -1,94 +1,94 @@
|
||||
---
|
||||
title: List vulnerabilities by recommendation
|
||||
description: Retrieves a list of vulnerabilities associated with the security recommendation.
|
||||
keywords: apis, graph api, supported apis, get, list of vulnerabilities, security recommendation, security recommendation for vulnerabilities, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List vulnerabilities by recommendation
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of vulnerabilities associated with the security recommendation.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with the list of vulnerabilities associated with the security recommendation.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2019-13748",
|
||||
"name": "CVE-2019-13748",
|
||||
"description": "Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 6.5,
|
||||
"exposedMachines": 0,
|
||||
"publishedOn": "2019-12-10T00:00:00Z",
|
||||
"updatedOn": "2019-12-16T12:15:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
---
|
||||
title: List vulnerabilities by recommendation
|
||||
description: Retrieves a list of vulnerabilities associated with the security recommendation.
|
||||
keywords: apis, graph api, supported apis, get, list of vulnerabilities, security recommendation, security recommendation for vulnerabilities, threat and vulnerability management, threat and vulnerability management api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List vulnerabilities by recommendation
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of vulnerabilities associated with the security recommendation.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/recommendations/{id}/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, with the list of vulnerabilities associated with the security recommendation.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2019-13748",
|
||||
"name": "CVE-2019-13748",
|
||||
"description": "Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 6.5,
|
||||
"exposedMachines": 0,
|
||||
"publishedOn": "2019-12-10T00:00:00Z",
|
||||
"updatedOn": "2019-12-16T12:15:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
|
||||
@ -1,101 +1,101 @@
|
||||
---
|
||||
title: Get security recommendations
|
||||
description: Retrieves a collection of security recommendations related to a given device ID.
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, security recommendation per device, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get security recommendations
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of security recommendations related to a given device ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/{machineId}/recommendations
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/recommendations
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations",
|
||||
"value": [
|
||||
{
|
||||
"id": "va-_-git-scm-_-git",
|
||||
"productName": "git",
|
||||
"recommendationName": "Update Git to version 2.24.1.2",
|
||||
"weaknesses": 3,
|
||||
"vendor": "git-scm",
|
||||
"recommendedVersion": "2.24.1.2",
|
||||
"recommendationCategory": "Application",
|
||||
"subCategory": "",
|
||||
"severityScore": 0,
|
||||
"publicExploit": false,
|
||||
"activeAlert": false,
|
||||
"associatedThreats": [],
|
||||
"remediationType": "Update",
|
||||
"status": "Active",
|
||||
"configScoreImpact": 0,
|
||||
"exposureImpact": 0,
|
||||
"totalMachineCount": 0,
|
||||
"exposedMachinesCount": 1,
|
||||
"nonProductivityImpactedAssets": 0,
|
||||
"relatedComponent": "Git"
|
||||
},
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
---
|
||||
title: Get security recommendations
|
||||
description: Retrieves a collection of security recommendations related to a given device ID.
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, security recommendation per device, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get security recommendations
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a collection of security recommendations related to a given device ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | SecurityRecommendation.Read.All | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
Delegated (work or school account) | SecurityRecommendation.Read | 'Read Threat and Vulnerability Management security recommendation information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/{machineId}/recommendations
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the security recommendations in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/recommendations
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations",
|
||||
"value": [
|
||||
{
|
||||
"id": "va-_-git-scm-_-git",
|
||||
"productName": "git",
|
||||
"recommendationName": "Update Git to version 2.24.1.2",
|
||||
"weaknesses": 3,
|
||||
"vendor": "git-scm",
|
||||
"recommendedVersion": "2.24.1.2",
|
||||
"recommendationCategory": "Application",
|
||||
"subCategory": "",
|
||||
"severityScore": 0,
|
||||
"publicExploit": false,
|
||||
"activeAlert": false,
|
||||
"associatedThreats": [],
|
||||
"remediationType": "Update",
|
||||
"status": "Active",
|
||||
"configScoreImpact": 0,
|
||||
"exposureImpact": 0,
|
||||
"totalMachineCount": 0,
|
||||
"exposedMachinesCount": 1,
|
||||
"nonProductivityImpactedAssets": 0,
|
||||
"relatedComponent": "Git"
|
||||
},
|
||||
…
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation)
|
||||
|
||||
@ -1,86 +1,86 @@
|
||||
---
|
||||
title: Get software by Id
|
||||
description: Retrieves a list of exposure scores by device group.
|
||||
keywords: apis, graph api, supported apis, get, software, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get software by Id
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves software details by ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the specified software data in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Software/$entity",
|
||||
"id": "microsoft-_-edge",
|
||||
"name": "edge",
|
||||
"vendor": "microsoft",
|
||||
"weaknesses": 467,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 172,
|
||||
"impactScore": 2.39947438
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
---
|
||||
title: Get software by Id
|
||||
description: Retrieves a list of exposure scores by device group.
|
||||
keywords: apis, graph api, supported apis, get, software, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get software by Id
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves software details by ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the specified software data in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Software/$entity",
|
||||
"id": "microsoft-_-edge",
|
||||
"name": "edge",
|
||||
"vendor": "microsoft",
|
||||
"weaknesses": 467,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 172,
|
||||
"impactScore": 2.39947438
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
|
||||
@ -1,91 +1,91 @@
|
||||
---
|
||||
title: List software version distribution
|
||||
description: Retrieves a list of your organization's software version distribution
|
||||
keywords: apis, graph api, supported apis, get, software version distribution, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List software version distribution
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of your organization's software version distribution.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}/distributions
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with a list of software distributions data in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/distributions
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Distributions",
|
||||
"value": [
|
||||
{
|
||||
"version": "11.0.17134.1039",
|
||||
"installations": 1,
|
||||
"vulnerabilities": 11
|
||||
},
|
||||
{
|
||||
"version": "11.0.18363.535",
|
||||
"installations": 750,
|
||||
"vulnerabilities": 0
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
---
|
||||
title: List software version distribution
|
||||
description: Retrieves a list of your organization's software version distribution
|
||||
keywords: apis, graph api, supported apis, get, software version distribution, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List software version distribution
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves a list of your organization's software version distribution.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}/distributions
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with a list of software distributions data in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/distributions
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Distributions",
|
||||
"value": [
|
||||
{
|
||||
"version": "11.0.17134.1039",
|
||||
"installations": 1,
|
||||
"vulnerabilities": 11
|
||||
},
|
||||
{
|
||||
"version": "11.0.18363.535",
|
||||
"installations": 750,
|
||||
"vulnerabilities": 0
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
|
||||
@ -1,90 +1,90 @@
|
||||
---
|
||||
title: List software
|
||||
description: Retrieves a list of software inventory
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, software inventory, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List software inventory API
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
Retrieves the organization software inventory.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the software inventory in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Software",
|
||||
"value": [
|
||||
{
|
||||
"id": "microsoft-_-edge",
|
||||
"name": "edge",
|
||||
"vendor": "microsoft",
|
||||
"weaknesses": 467,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 172,
|
||||
"impactScore": 2.39947438
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
---
|
||||
title: List software
|
||||
description: Retrieves a list of software inventory
|
||||
keywords: apis, graph api, supported apis, get, list, file, information, software inventory, threat & vulnerability management api, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List software inventory API
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
Retrieves the organization software inventory.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application |Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the software inventory in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Software",
|
||||
"value": [
|
||||
{
|
||||
"id": "microsoft-_-edge",
|
||||
"name": "edge",
|
||||
"vendor": "microsoft",
|
||||
"weaknesses": 467,
|
||||
"publicExploit": true,
|
||||
"activeAlert": false,
|
||||
"exposedMachines": 172,
|
||||
"impactScore": 2.39947438
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory)
|
||||
|
||||
@ -1,93 +1,93 @@
|
||||
---
|
||||
title: List vulnerabilities by software
|
||||
description: Retrieve a list of vulnerabilities in the installed software.
|
||||
keywords: apis, graph api, supported apis, get, vulnerabilities list, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List vulnerabilities by software
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieve a list of vulnerabilities in the installed software.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with a a list of vulnerabilities exposed by the specified software.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2017-0140",
|
||||
"name": "CVE-2017-0140",
|
||||
"description": "A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted.In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.The security update addresses the vulnerability by modifying how affected Microsoft Edge handles different-origin requests.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.2,
|
||||
"exposedMachines": 1,
|
||||
"publishedOn": "2017-03-14T00:00:00Z",
|
||||
"updatedOn": "2019-10-03T00:03:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
title: List vulnerabilities by software
|
||||
description: Retrieve a list of vulnerabilities in the installed software.
|
||||
keywords: apis, graph api, supported apis, get, vulnerabilities list, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List vulnerabilities by software
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieve a list of vulnerabilities in the installed software.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Software.Read.All | 'Read Threat and Vulnerability Management Software information'
|
||||
Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/Software/{Id}/vulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
| Name | Type | Description
|
||||
|:--------------|:-------|:--------------|
|
||||
| Authorization | String | Bearer {token}.**Required**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with a a list of vulnerabilities exposed by the specified software.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/vulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
{
|
||||
"id": "CVE-2017-0140",
|
||||
"name": "CVE-2017-0140",
|
||||
"description": "A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins. The vulnerability allows Microsoft Edge to bypass Same-Origin Policy (SOP) restrictions, and to allow requests that should otherwise be ignored. An attacker who successfully exploited the vulnerability could force the browser to send data that would otherwise be restricted.In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.The security update addresses the vulnerability by modifying how affected Microsoft Edge handles different-origin requests.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.2,
|
||||
"exposedMachines": 1,
|
||||
"publishedOn": "2017-03-14T00:00:00Z",
|
||||
"updatedOn": "2019-10-03T00:03:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
@ -1,88 +1,88 @@
|
||||
---
|
||||
title: Get vulnerability by Id
|
||||
description: Retrieves vulnerability information by its ID.
|
||||
keywords: apis, graph api, supported apis, get, vulnerability information, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get vulnerability by ID
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves vulnerability information by its ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/vulnerabilities/{cveId}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the vulnerability information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Vulnerabilities/CVE-2019-0608
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Vulnerabilities/$entity",
|
||||
"id": "CVE-2019-0608",
|
||||
"name": "CVE-2019-0608",
|
||||
"description": "A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.The update addresses the vulnerability by correcting how Microsoft Browsers parses HTTP responses.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.3,
|
||||
"exposedMachines": 4,
|
||||
"publishedOn": "2019-10-08T00:00:00Z",
|
||||
"updatedOn": "2019-12-16T16:20:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
```
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
---
|
||||
title: Get vulnerability by Id
|
||||
description: Retrieves vulnerability information by its ID.
|
||||
keywords: apis, graph api, supported apis, get, vulnerability information, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get vulnerability by ID
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Retrieves vulnerability information by its ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/vulnerabilities/{cveId}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the vulnerability information in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/Vulnerabilities/CVE-2019-0608
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Vulnerabilities/$entity",
|
||||
"id": "CVE-2019-0608",
|
||||
"name": "CVE-2019-0608",
|
||||
"description": "A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.The update addresses the vulnerability by correcting how Microsoft Browsers parses HTTP responses.",
|
||||
"severity": "Medium",
|
||||
"cvssV3": 4.3,
|
||||
"exposedMachines": 4,
|
||||
"publishedOn": "2019-10-08T00:00:00Z",
|
||||
"updatedOn": "2019-12-16T16:20:00Z",
|
||||
"publicExploit": false,
|
||||
"exploitVerified": false,
|
||||
"exploitInKit": false,
|
||||
"exploitTypes": [],
|
||||
"exploitUris": []
|
||||
}
|
||||
```
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Create indicators
|
||||
ms.reviewer:
|
||||
title: Create indicators
|
||||
ms.reviewer:
|
||||
description: Create indicators for a file hash, IP address, URLs, or domains that define the detection, prevention, and exclusion of entities.
|
||||
keywords: manage, allowed, blocked, block, clean, malicious, file hash, ip address, urls, domain
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -14,11 +14,11 @@ author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Create indicators
|
||||
# Create indicators
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -40,10 +40,10 @@ The same list of indicators is honored by the prevention agent. Meaning, if Micr
|
||||
|
||||
**Automated investigation and remediation engine**<BR>
|
||||
The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad".
|
||||
|
||||
|
||||
|
||||
The current supported actions are:
|
||||
- Allow
|
||||
- Allow
|
||||
- Alert only
|
||||
- Alert and block
|
||||
|
||||
@ -55,7 +55,7 @@ You can create an indicator for:
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>There is a limit of 15,000 indicators per tenant.
|
||||
>There is a limit of 15,000 indicators per tenant.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -1,59 +1,59 @@
|
||||
---
|
||||
title: Recommendation methods and properties
|
||||
description: Retrieves top recent alerts.
|
||||
keywords: apis, graph api, supported apis, get, alerts, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Recommendation resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[List all recommendations](get-all-recommendations.md) | Recommendation collection | Retrieves a list of all security recommendations affecting the organization
|
||||
[Get recommendation by Id](get-recommendation-by-id.md) | Recommendation | Retrieves a security recommendation by its ID
|
||||
[Get recommendation software](get-recommendation-software.md)| [Software](software.md) | Retrieves a security recommendation related to a specific software
|
||||
[Get recommendation devices](get-recommendation-machines.md)|MachineRef collection | Retrieves a list of devices associated with the security recommendation
|
||||
[Get recommendation vulnerabilities](get-recommendation-vulnerabilities.md) | [Vulnerability](vulnerability.md) collection | Retrieves a list of vulnerabilities associated with the security recommendation
|
||||
|
||||
|
||||
## Properties
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
id | String | Recommendation ID
|
||||
productName | String | Related software name
|
||||
recommendationName | String | Recommendation name
|
||||
Weaknesses | Long | Number of discovered vulnerabilities
|
||||
Vendor | String | Related vendor name
|
||||
recommendedVersion | String | Recommended version
|
||||
recommendationCategory | String | Recommendation category. Possible values are: "Accounts", "Application", "Network", "OS", "SecurityStack
|
||||
subCategory | String | Recommendation sub-category
|
||||
severityScore | Double | Potential impact of the configuration to the organization's Microsoft Secure Score for Devices (1-10)
|
||||
publicExploit | Boolean | Public exploit is available
|
||||
activeAlert | Boolean | Active alert is associated with this recommendation
|
||||
associatedThreats | String collection | Threat analytics report is associated with this recommendation
|
||||
remediationType | String | Remediation type. Possible values are: "ConfigurationChange","Update","Upgrade","Uninstall"
|
||||
Status | Enum | Recommendation exception status. Possible values are: "Active" and "Exception"
|
||||
configScoreImpact | Double | Microsoft Secure Score for Devices impact
|
||||
exposureImpacte | Double | Exposure score impact
|
||||
totalMachineCount | Long | Number of installed devices
|
||||
exposedMachinesCount | Long | Number of installed devices that are exposed to vulnerabilities
|
||||
nonProductivityImpactedAssets | Long | Number of devices which are not affected
|
||||
relatedComponent | String | Related software component
|
||||
---
|
||||
title: Recommendation methods and properties
|
||||
description: Retrieves top recent alerts.
|
||||
keywords: apis, graph api, supported apis, get, alerts, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Recommendation resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[List all recommendations](get-all-recommendations.md) | Recommendation collection | Retrieves a list of all security recommendations affecting the organization
|
||||
[Get recommendation by Id](get-recommendation-by-id.md) | Recommendation | Retrieves a security recommendation by its ID
|
||||
[Get recommendation software](get-recommendation-software.md)| [Software](software.md) | Retrieves a security recommendation related to a specific software
|
||||
[Get recommendation devices](get-recommendation-machines.md)|MachineRef collection | Retrieves a list of devices associated with the security recommendation
|
||||
[Get recommendation vulnerabilities](get-recommendation-vulnerabilities.md) | [Vulnerability](vulnerability.md) collection | Retrieves a list of vulnerabilities associated with the security recommendation
|
||||
|
||||
|
||||
## Properties
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
id | String | Recommendation ID
|
||||
productName | String | Related software name
|
||||
recommendationName | String | Recommendation name
|
||||
Weaknesses | Long | Number of discovered vulnerabilities
|
||||
Vendor | String | Related vendor name
|
||||
recommendedVersion | String | Recommended version
|
||||
recommendationCategory | String | Recommendation category. Possible values are: "Accounts", "Application", "Network", "OS", "SecurityStack
|
||||
subCategory | String | Recommendation sub-category
|
||||
severityScore | Double | Potential impact of the configuration to the organization's Microsoft Secure Score for Devices (1-10)
|
||||
publicExploit | Boolean | Public exploit is available
|
||||
activeAlert | Boolean | Active alert is associated with this recommendation
|
||||
associatedThreats | String collection | Threat analytics report is associated with this recommendation
|
||||
remediationType | String | Remediation type. Possible values are: "ConfigurationChange","Update","Upgrade","Uninstall"
|
||||
Status | Enum | Recommendation exception status. Possible values are: "Active" and "Exception"
|
||||
configScoreImpact | Double | Microsoft Secure Score for Devices impact
|
||||
exposureImpacte | Double | Exposure score impact
|
||||
totalMachineCount | Long | Number of installed devices
|
||||
exposedMachinesCount | Long | Number of installed devices that are exposed to vulnerabilities
|
||||
nonProductivityImpactedAssets | Long | Number of devices which are not affected
|
||||
relatedComponent | String | Related software component
|
||||
|
||||
@ -1,40 +1,40 @@
|
||||
---
|
||||
title: Score methods and properties
|
||||
description: Retrieves your organization's exposure score, device secure score, and exposure score by device group
|
||||
keywords: apis, graph api, supported apis, score, exposure score, device secure score, exposure score by device group
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Score resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get exposure score](get-exposure-score.md) | [Score](score.md) | Get the organizational exposure score.
|
||||
[Get device secure score](get-device-secure-score.md) | [Score](score.md) | Get the organizational device secure score.
|
||||
[List exposure score by device group](get-machine-group-exposure-score.md)| [Score](score.md) | List scores by device group.
|
||||
|
||||
|
||||
## Properties
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
Score | Double | The current score.
|
||||
Time | DateTime | The date and time in which the call for this API was made.
|
||||
RbacGroupName | String | The device group name.
|
||||
---
|
||||
title: Score methods and properties
|
||||
description: Retrieves your organization's exposure score, device secure score, and exposure score by device group
|
||||
keywords: apis, graph api, supported apis, score, exposure score, device secure score, exposure score by device group
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Score resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get exposure score](get-exposure-score.md) | [Score](score.md) | Get the organizational exposure score.
|
||||
[Get device secure score](get-device-secure-score.md) | [Score](score.md) | Get the organizational device secure score.
|
||||
[List exposure score by device group](get-machine-group-exposure-score.md)| [Score](score.md) | List scores by device group.
|
||||
|
||||
|
||||
## Properties
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
Score | Double | The current score.
|
||||
Time | DateTime | The date and time in which the call for this API was made.
|
||||
RbacGroupName | String | The device group name.
|
||||
|
||||
@ -1,49 +1,49 @@
|
||||
---
|
||||
title: Software methods and properties
|
||||
description: Retrieves top recent alerts.
|
||||
keywords: apis, graph api, supported apis, get, alerts, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Software resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[List software](get-software.md) | Software collection | List the organizational software inventory.
|
||||
[Get software by Id](get-software-by-id.md) | Software | Get a specific software by its software ID.
|
||||
[List software version distribution](get-software-ver-distribution.md)| Distribution collection | List software version distribution by software ID.
|
||||
[List machines by software](get-machines-by-software.md)| MachineRef collection | Retrieve a list of devices that are associated with the software ID.
|
||||
[List vulnerabilities by software](get-vuln-by-software.md) | [Vulnerability](vulnerability.md) collection | Retrieve a list of vulnerabilities associated with the software ID.
|
||||
[Get missing KBs](get-missing-kbs-software.md) | KB collection | Get a list of missing KBs associated with the software ID
|
||||
|
||||
## Properties
|
||||
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
id | String | Software ID
|
||||
Name | String | Software name
|
||||
Vendor | String | Software vendor name
|
||||
Weaknesses | Long | Number of discovered vulnerabilities
|
||||
publicExploit | Boolean | Public exploit exists for some of the vulnerabilities
|
||||
activeAlert | Boolean | Active alert is associated with this software
|
||||
exposedMachines | Long | Number of exposed devices
|
||||
impactScore | Double | Exposure score impact of this software
|
||||
---
|
||||
title: Software methods and properties
|
||||
description: Retrieves top recent alerts.
|
||||
keywords: apis, graph api, supported apis, get, alerts, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Software resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[List software](get-software.md) | Software collection | List the organizational software inventory.
|
||||
[Get software by Id](get-software-by-id.md) | Software | Get a specific software by its software ID.
|
||||
[List software version distribution](get-software-ver-distribution.md)| Distribution collection | List software version distribution by software ID.
|
||||
[List machines by software](get-machines-by-software.md)| MachineRef collection | Retrieve a list of devices that are associated with the software ID.
|
||||
[List vulnerabilities by software](get-vuln-by-software.md) | [Vulnerability](vulnerability.md) collection | Retrieve a list of vulnerabilities associated with the software ID.
|
||||
[Get missing KBs](get-missing-kbs-software.md) | KB collection | Get a list of missing KBs associated with the software ID
|
||||
|
||||
## Properties
|
||||
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
id | String | Software ID
|
||||
Name | String | Software name
|
||||
Vendor | String | Software vendor name
|
||||
Weaknesses | Long | Number of discovered vulnerabilities
|
||||
publicExploit | Boolean | Public exploit exists for some of the vulnerabilities
|
||||
activeAlert | Boolean | Active alert is associated with this software
|
||||
exposedMachines | Long | Number of exposed devices
|
||||
impactScore | Double | Exposure score impact of this software
|
||||
|
||||
@ -1,58 +1,58 @@
|
||||
---
|
||||
title: Supported operating systems and platforms for threat and vulnerability management
|
||||
description: Before you begin, ensure that you meet the operating system or platform requisites for threat and vulnerability management so the activities in your all devices are properly accounted for.
|
||||
keywords: threat & vulnerability management, threat and vulnerability management, operating system, platform requirements, prerequisites, mdatp-tvm supported os, mdatp-tvm, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score
|
||||
search.appverid: met150
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
# Supported operating systems and platforms - threat and vulnerability management
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
Before you begin, ensure that you meet the following operating system or platform requisites for threat and vulnerability management so the activities in your devices are properly accounted for.
|
||||
|
||||
>[!NOTE]
|
||||
>The supported systems and platforms for threat and vulnerability management may be different from the [Minimum requirements for Microsoft Defender ATP](minimum-requirements.md) list.
|
||||
|
||||
Operating system | Security assessment support
|
||||
:---|:---
|
||||
Windows 7 | Operating System (OS) vulnerabilities
|
||||
Windows 8.1 | Not supported
|
||||
Windows 10 1607-1703 | Operating System (OS) vulnerabilities
|
||||
Windows 10 1709+ |Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2008 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2012 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2016 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2019 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
macOS | Not supported (planned)
|
||||
Linux | Not supported (planned)
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||
- [Exposure score](tvm-exposure-score.md)
|
||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||
- [Security recommendations](tvm-security-recommendation.md)
|
||||
- [Remediation and exception](tvm-remediation.md)
|
||||
- [Software inventory](tvm-software-inventory.md)
|
||||
- [Weaknesses](tvm-weaknesses.md)
|
||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||
- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
---
|
||||
title: Supported operating systems and platforms for threat and vulnerability management
|
||||
description: Before you begin, ensure that you meet the operating system or platform requisites for threat and vulnerability management so the activities in your all devices are properly accounted for.
|
||||
keywords: threat & vulnerability management, threat and vulnerability management, operating system, platform requirements, prerequisites, mdatp-tvm supported os, mdatp-tvm, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score
|
||||
search.appverid: met150
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
# Supported operating systems and platforms - threat and vulnerability management
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
Before you begin, ensure that you meet the following operating system or platform requisites for threat and vulnerability management so the activities in your devices are properly accounted for.
|
||||
|
||||
>[!NOTE]
|
||||
>The supported systems and platforms for threat and vulnerability management may be different from the [Minimum requirements for Microsoft Defender ATP](minimum-requirements.md) list.
|
||||
|
||||
Operating system | Security assessment support
|
||||
:---|:---
|
||||
Windows 7 | Operating System (OS) vulnerabilities
|
||||
Windows 8.1 | Not supported
|
||||
Windows 10 1607-1703 | Operating System (OS) vulnerabilities
|
||||
Windows 10 1709+ |Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2008 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2012 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2016 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2019 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
macOS | Not supported (planned)
|
||||
Linux | Not supported (planned)
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md)
|
||||
- [Exposure score](tvm-exposure-score.md)
|
||||
- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
|
||||
- [Security recommendations](tvm-security-recommendation.md)
|
||||
- [Remediation and exception](tvm-remediation.md)
|
||||
- [Software inventory](tvm-software-inventory.md)
|
||||
- [Weaknesses](tvm-weaknesses.md)
|
||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||
- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
|
||||
@ -1,50 +1,50 @@
|
||||
---
|
||||
title: Vulnerability methods and properties
|
||||
description: Retrieves vulnerability information
|
||||
keywords: apis, graph api, supported apis, get, vulnerability
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Vulnerability resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get all vulnerabilities](get-all-vulnerabilities.md) | Vulnerability collection | Retrieves a list of all the vulnerabilities affecting the organization
|
||||
[Get vulnerability by Id](get-vulnerability-by-id.md) | Vulnerability | Retrieves vulnerability information by its ID
|
||||
[List devices by vulnerability](get-machines-by-vulnerability.md)| MachineRef collection | Retrieve a list of devices that are associated with the vulnerability ID
|
||||
|
||||
|
||||
## Properties
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
id | String | Vulnerability ID
|
||||
Name | String | Vulnerability title
|
||||
Description | String | Vulnerability description
|
||||
Severity | String | Vulnerability Severity. Possible values are: “Low”, “Medium”, “High”, “Critical”
|
||||
cvssV3 | Double | CVSS v3 score
|
||||
exposedMachines | Long | Number of exposed devices
|
||||
publishedOn | DateTime | Date when vulnerability was published
|
||||
updatedOn | DateTime | Date when vulnerability was updated
|
||||
publicExploit | Boolean | Public exploit exists
|
||||
exploitVerified | Boolean | Exploit is verified to work
|
||||
exploitInKit | Boolean | Exploit is part of an exploit kit
|
||||
exploitTypes | String collection | Exploit impact. Possible values are: “Denial of service”, “Local privilege escalation”, “Denial of service”
|
||||
exploitUris | String collection | Exploit source URLs
|
||||
---
|
||||
title: Vulnerability methods and properties
|
||||
description: Retrieves vulnerability information
|
||||
keywords: apis, graph api, supported apis, get, vulnerability
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Vulnerability resource type
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Methods
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get all vulnerabilities](get-all-vulnerabilities.md) | Vulnerability collection | Retrieves a list of all the vulnerabilities affecting the organization
|
||||
[Get vulnerability by Id](get-vulnerability-by-id.md) | Vulnerability | Retrieves vulnerability information by its ID
|
||||
[List devices by vulnerability](get-machines-by-vulnerability.md)| MachineRef collection | Retrieve a list of devices that are associated with the vulnerability ID
|
||||
|
||||
|
||||
## Properties
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
id | String | Vulnerability ID
|
||||
Name | String | Vulnerability title
|
||||
Description | String | Vulnerability description
|
||||
Severity | String | Vulnerability Severity. Possible values are: “Low”, “Medium”, “High”, “Critical”
|
||||
cvssV3 | Double | CVSS v3 score
|
||||
exposedMachines | Long | Number of exposed devices
|
||||
publishedOn | DateTime | Date when vulnerability was published
|
||||
updatedOn | DateTime | Date when vulnerability was updated
|
||||
publicExploit | Boolean | Public exploit exists
|
||||
exploitVerified | Boolean | Exploit is verified to work
|
||||
exploitInKit | Boolean | Exploit is part of an exploit kit
|
||||
exploitTypes | String collection | Exploit impact. Possible values are: “Denial of service”, “Local privilege escalation”, “Denial of service”
|
||||
exploitUris | String collection | Exploit source URLs
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user