mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 14:23:38 +00:00
update toc, add apis
This commit is contained in:
Joey Caparas
@ -93,7 +93,7 @@
|
||||
#### [Experiment with custom threat intelligence alerts](windows-defender-atp\experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
#### [Troubleshoot custom threat intelligence issues](windows-defender-atp\troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
### [Use the Windows Defender ATP exposed APIs](windows-defender-atp\exposed-apis-windows-defender-advanced-threat-protection.md)
|
||||
#### [Supported Windows Defender ATP APIs](windows-defender-atp\supported-apis-windows-defender-advanced-threat-protection.md)
|
||||
#### [Supported Windows Defender ATP query APIs](windows-defender-atp\supported-apis-windows-defender-advanced-threat-protection.md)
|
||||
##### Actor
|
||||
###### [Get actor information](windows-defender-atp\get-actor-information-windows-defender-advanced-threat-protection.md)
|
||||
###### [Get actor related alerts](windows-defender-atp\get-actor-related-alerts-windows-defender-advanced-threat-protection.md)
|
||||
@ -131,6 +131,23 @@
|
||||
###### [Get user information](windows-defender-atp\get-user-information-windows-defender-advanced-threat-protection.md)
|
||||
###### [Get user related alerts](windows-defender-atp\get-user-related-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Get user related machines](windows-defender-atp\get-user-related-machines-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
#### [Supported Windows Defender ATP response APIs](windows-defender-atp\supported-response-apis-windows-defender-advanced-threat-protection.md)
|
||||
##### [Collect investigation package API](windows-defender-atp\collect-investigation-package-windows-defender-advanced-threat-protection.md)
|
||||
##### [Isolate machine API](windows-defender-atp\isolate-machine-windows-defender-advanced-threat-protection.md)
|
||||
##### [Release machine from isolation API](windows-defender-atp\unisolate-machine-windows-defender-advanced-threat-protection.md)
|
||||
##### [Restrict app execution API](windows-defender-atp\restrict-code-execution-windows-defender-advanced-threat-protection.md)
|
||||
##### [Remove app restriction API](windows-defender-atp\unrestrict-code-execution-windows-defender-advanced-threat-protection.md)
|
||||
##### [Run antivirus scan API](windows-defender-atp\run-av-scan-windows-defender-advanced-threat-protection.md)
|
||||
##### [Stop and quarantine file API](windows-defender-atp\stop-quarantine-file-windows-defender-advanced-threat-protection.md)
|
||||
##### [Request sample API](windows-defender-atp\request-sample-windows-defender-advanced-threat-protection.md)
|
||||
##### [Block file API](windows-defender-atp\block-file-windows-defender-advanced-threat-protection.md)
|
||||
##### [Unblock file API](windows-defender-atp\unblock-file-windows-defender-advanced-threat-protection.md)
|
||||
##### [Get package SAS URI API](windows-defender-atp\get-package-sas-uri-windows-defender-advanced-threat-protection.md)
|
||||
##### [Get MachineAction object API](windows-defender-atp\get-machineaction-object-windows-defender-advanced-threat-protection.md)
|
||||
##### [Get FileMachineAction object API](windows-defender-atp\get-filemachineaction-object-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
title: Block file API
|
||||
description: Use this API to create calls related to blocking files from being executed in the organization.
|
||||
keywords: apis, graph api, supported apis, block file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Block file
|
||||
Prevent a file from being executed in the organization using Windows Defender Antivirus.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/files/{sha1}/block
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with empty body, which indicates that block message was sent to Windows Defender deployed in the organization.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/7327b54fd718525cbca07dacde913b5ac3c85673/block
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Block file due to alert 32123"
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
```
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Collect investigation package API
|
||||
description: Use this API to create calls related to the collecting an investigation package from a machine.
|
||||
keywords: apis, graph api, supported apis, collect investigation package
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Collect investigation package
|
||||
Collect investigation package from a machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/collectInvestigationPackage
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. Required.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | Text | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Collect forensics due to alert 1234"
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "CollectInvestigationPackage",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Get FileMachineAction object API
|
||||
description: Use this API to create calls related to get machineaction object
|
||||
keywords: apis, graph api, supported apis, filemachineaction object
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get FileMachineAction object
|
||||
Get MachineAction object.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/filemachineactions/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with the *FileMachineAction* object.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/filemachineactions/7327b54fd718525cbca07dacde913b5ac3c85673
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
|
||||
"id": " 7327b54fd718525cbca07dacde913b5ac3c85673",
|
||||
"sha1": "1163788484e3258ab9fcf692f7db7938f72ddfc2",
|
||||
"type": "StopAndQuarantineFile",
|
||||
"status": "Succeeded",
|
||||
"machineId": "970a58d5f61786bb7799dfdb5395ec364ffceace",
|
||||
"fileInstances": [
|
||||
{
|
||||
"filePath": "C:\\Users\\alex\\AppData\\Local\\AppFetch\\Temp\\3324bcb\\AppDownloader\\AnApp.appfetch.zip",
|
||||
"status": "Succeeded"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Get MachineAction object API
|
||||
description: Use this API to create calls related to get machineaction object
|
||||
keywords: apis, graph api, supported apis, machineaction object
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get MachineAction object
|
||||
Get MachineAction object
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machineactions/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with the *MachineAction* object.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "UnrestrictExecution",
|
||||
"status": "Success",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Get package SAS URI API
|
||||
description: Use this API to get a URI that allows downloading an investigation package.
|
||||
keywords: apis, graph api, supported apis, get package, sas, uri
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get package SAS URI
|
||||
Get a URI that allows downloading an investigation package.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machineactions/{id}/getPackageUri
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with object that holds the link to the package in the “value” parameter. This link is valid for a very short time and should be used immediately for downloading the package to a local storage.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673/GetPackageUri
|
||||
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testrespver1/$metadata#Edm.String",
|
||||
"value": "\"https://userrequests-us.securitycenter.windows.com:443/safedownload/WDATP_Investigation_Package.zip?token=gbDyj7y%2fbWGAZjn2sFiZXlliBTXOCVG7yiJ6mXNaQ9pLByC2Wxeno9mENsPFP3xMk5l%2bZiJXjLvqAyNEzUNROxoM2I1er9dxzfVeBsxSmclJjPsAx%2btiNyxSz1Ax%2b5jaT5cL5bZg%2b8wgbwY9urXbTpGjAKh6FB1e%2b0ypcWkPm8UkfOwsmtC%2biZJ2%2bPqnkkeQk7SKMNoAvmh9%2fcqDIPKXGIBjMa0D9auzypOqd8bQXp7p2BnLSH136BxST8n9IHR4PILvRjAYW9kvtHkBpBitfydAsUW4g2oDZSPN3kCLBOoo1C4w4Lkc9Bc3GNU2IW6dfB7SHcp7G9p4BDkeJl3VuDs6esCaeBorpn9FKJ%2fXo7o9pdcI0hUPZ6Ds9hiPpwPUtz5J29CBE3QAopCK%2fsWlf6OW2WyXsrNRSnF1tVE5H3wXpREzuhD7S4AIA3OIEZKzC4jIPLeMu%2bazZU9xGwuc3gICOaokbwMJiZTqcUuK%2fV9YdBdjdg8wJ16NDU96Pl6%2fgew2KYuk6Wo7ZuHotgHI1abcsvdlpe4AvixDbqcRJthsg2PpLRaFLm5av44UGkeK6TJpFvxUn%2f9fg6Zk5yM1KUTHb8XGmutoCM8U9er6AzXZlY0gGc3D3bQOg41EJZkEZLyUEbk1hXJB36ku2%2bW01cG71t7MxMBYz7%2bdXobxpdo%3d%3bRWS%2bCeoDfTyDcfH5pkCg6hYDmCOPr%2fHYQuaUWUBNVnXURYkdyOzVHqp%2fe%2f1BNyPdVoVkpQHpz1pPS3b5g9h7IMmNKCk5gFq5m2nPx6kk9EYtzx8Ndoa2m9Yj%2bSaf8zIFke86YnfQL4AYewsnQNJJh4wc%2bXxGlBq7axDcoiOdX91rKzVicH3GSBkFoLFAKoegWWsF%2fEDZcVpF%2fXUA1K8HvB6dwyfy4y0sAqnNPxYTQ97mG7yHhxPt4Pe9YF2UPPAJVuEf8LNlQ%2bWHC9%2f7msF6UUI4%2fca%2ftpjFs%2fSNeRE8%2fyQj21TI8YTF1SowvaJuDc1ivEoeopNNGG%2bGI%2fX0SckaVxU9Hdkh0zbydSlT5SZwbSwescs0IpzECitBbaLUz4aT8KTs8T0lvx8D7Te3wVsKAJ1r3iFMQZrlk%2bS1WW8rvac7oHRx2HKURn1v7fDIQWgJr9aNsNlFz4fLJ50T2qSHuuepkLVbe93Va072aMGhvr09WVKoTpAf1j2bcFZZU6Za5PxI32mr0k90FgiYFJ1F%2f1vRDrGwvWVWUkR3Z33m4g0gHa52W1FMxQY0TJIwbovD6FaSNDx7xhKZSd5IJ7r6P91Gez49PaZRcAZPjd%2bfbul3JNm1VqQPTLohT7wa0ymRiXpSST74xtFzuEBzNSNATdbngj3%2fwV4JesTjZjIj5Dc%3d%3blumqauVlFuuO8MQffZgs0tLJ4Fq6fpeozPTdDf8Ll6XLegi079%2b4mSPFjTK0y6eohstxdoOdom2wAHiZwk0u4KLKmRkfYOdT1wHY79qKoBQ3ZDHFTys9V%2fcwKGl%2bl8IenWDutHygn5IcA1y7GTZj4g%3d%3d\""
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,83 @@
|
||||
---
|
||||
title: Isolate machine API
|
||||
description: Use this API to create calls related isolating a machine.
|
||||
keywords: apis, graph api, supported apis, isolate machine
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Isolate machine
|
||||
Isolates a machine from accessing external network.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/isolate
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
IsolationType | IsolationType | Full or selective isolation
|
||||
|
||||
**IsolationType** controls the type of isolation to perform and can be one of the following:
|
||||
- Full – Full isolation
|
||||
- Selective – Restrict only limited set of applications from accessing the network
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/isolate
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Isolate machine due to alert 1234",
|
||||
“IsolationType”: “Full”
|
||||
}
|
||||
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "Isolate",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Request sample API
|
||||
description: Use this API to create calls related to requesting a sample from a machine.
|
||||
keywords: apis, graph api, supported apis, request sample
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Request sample
|
||||
Request sample of a file from a specific machine. File will be collected from the machine and uploaded to a secure storage.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/requestSample
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
Sha1 | String | Sha1 of the file to upload to the secure storage. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and *FileMachineAction* object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/requestSample
|
||||
Content-type: application/json
|
||||
{
|
||||
“Sha1”: “7327b54fd718525cbca07dacde913b5ac3c85673”
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "RequestSample",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
title: Restrict app execution API
|
||||
description: Use this API to create calls related to restricting an application from executing.
|
||||
keywords: apis, graph api, supported apis, collect investigation package
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Restrict app execution
|
||||
Restrict execution of set of predefined applications.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/restrictCodeExecution
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/restrictCodeExecution
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Restrict code execution due to alert 1234"
|
||||
}
|
||||
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "RestrictExecution",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,85 @@
|
||||
---
|
||||
title: Run antivirus scan API
|
||||
description: Use this API to create calls related to running an antivirus scan on a machine.
|
||||
keywords: apis, graph api, supported apis, remove machine from isolation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Run antivirus scan
|
||||
Initiate Windows Defender Antivirus scan on the machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/runAntiVirusScan
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
ScanType| ScanType | Defines the type of the Scan. **Required**.
|
||||
|
||||
**ScanType** controls the type of isolation to perform and can be one of the following:
|
||||
|
||||
- **Quick** – Perform quick scan on the machine
|
||||
- **Full** – Perform full scan on the machine
|
||||
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/runAntiVirusScan
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Check machine for viruses due to alert 3212",
|
||||
“ScanType”: “Full”
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "RunAntiVirusScan",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,85 @@
|
||||
---
|
||||
title: Stop and quarantine file API
|
||||
description: Use this API to create calls related to stopping and quarantining a file.
|
||||
keywords: apis, graph api, supported apis, stop, quarantine, file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Stop and quarantine file
|
||||
Stop execution of a file on a machine and ensure it’s not executed again on that machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/stopAndQuarantineFile
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
Sha1 | String | Sha1 of the file to stop and quarantine on the machine. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _FileMachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unrestrictCodeExecution
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Stop and quarantine file on machine due to alert 32123",
|
||||
“Sha1”: “7327b54fd718525cbca07dacde913b5ac3c85673”
|
||||
}
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
|
||||
"id": "5841901d-6d04-4278-b0b3-8dd6a2acc8a5",
|
||||
"sha1": “1163788484e3258ab9fcf692f7db7938f72ddfc2”,
|
||||
"type": "StopAndQuarantineFile",
|
||||
"status": "Succeeded",
|
||||
"machineId": "970a58d5f61786bb7799dfdb5395ec364ffceace",
|
||||
"fileInstances": [
|
||||
{
|
||||
"filePath": "C:\\Users\\alex\\AppData\\Local\\AppFetch\\Temp\\3324bcb\\AppDownloader\\AnApp.appfetch.zip",
|
||||
"status": "Succeeded"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
```
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Supported Windows Defender Advanced Threat Protection APIs
|
||||
title: Supported Windows Defender Advanced Threat Protection query APIs
|
||||
description: Learn about the specific supported Windows Defender Advanced Threat Protection entities where you can create API calls to.
|
||||
keywords: apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 10/17/2017
|
||||
---
|
||||
|
||||
# Supported Windows Defender ATP APIs
|
||||
# Supported Windows Defender ATP query APIs
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
@ -0,0 +1,43 @@
|
||||
---
|
||||
title: Supported Windows Defender Advanced Threat Protection response APIs
|
||||
description: Learn about the specific response related Windows Defender Advanced Threat Protection API calls.
|
||||
keywords: response apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 12/01/2017
|
||||
---
|
||||
|
||||
# Supported Windows Defender ATP query APIs
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink)
|
||||
|
||||
Learn about the supported response related API calls you can run and details such as the required request headers, and expected response from the calls.
|
||||
|
||||
## In this section
|
||||
Topic | Description
|
||||
:---|:---
|
||||
Collect investigation package | Run this to collect an investigation package from a machine.
|
||||
Isolate machine | Run this to isolate a machine from the network.
|
||||
Unisolate machine | Remove a machine from isolation.
|
||||
Restrict code execution | Run this to contain an attack by stopping malicious processes. You can also lock down a device and prevent subsequent attempts of potentially malicious programs from running.
|
||||
Unrestrict code execution | Run this to reverse the restriction of applications policy after you have verified that the compromised machine has been remediated.
|
||||
Run antivirus scan | Remotely initiate an antivirus scan to help identify and remediate malware that might be present on a compromised machine.
|
||||
Stop and quarantine file | Run this call to stop running processes, quarantine files, and delete persistency such as registry keys.
|
||||
Request sample | Run this call to request a sample of a file from a specific machine. The file will be collected from the machine and uploaded to a secure storage.
|
||||
Block file | Run this to prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
Unblock file | Allow a file run in the organization using Windows Defender Antivirus.
|
||||
Get package SAS URI | Run this to get a URI that allows downloading an investigation package.
|
||||
Get MachineAction object | Run this to get MachineAction object.
|
||||
Get FileMachineAction object | Run this to get FileMachineAction object.
|
||||
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Unblock file API
|
||||
description: Use this API to create calls related to allowing a file to be executed in the organization
|
||||
keywords: apis, graph api, supported apis, unblock file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Unblock file
|
||||
Allow a file to be executed in the organization, using Windows Defender Antivirus.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/files/{sha1}/unblock
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with empty body, which indicates that block message was sent to Windows Defender deployed in the organization.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/files/7327b54fd718525cbca07dacde913b5ac3c85673/unblock
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Unblock file since alert 1234 was investigated and discovered to be false alarm",
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
```
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Unisolate machine API
|
||||
description: Use this API to create calls related to removing a machine from isolation.
|
||||
keywords: apis, graph api, supported apis, remove machine from isolation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Unisolate machine
|
||||
Undo isolation of a machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/unisolate
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unisolate
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Unisolate machine since it was clean and validated"
|
||||
}
|
||||
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "Unisolate",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,78 @@
|
||||
---
|
||||
title: Unrestrict code execution API
|
||||
description: Use this API to create calls related to removing a restriction from applications from executing.
|
||||
keywords: apis, graph api, supported apis, remove machine from isolation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Unrestrict code execution
|
||||
Unrestrict execution of set of predefined applications.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/unrestrictCodeExecution
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. Required.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unrestrictCodeExecution
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Unrestrict code execution since machine was cleaned and validated"
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "UnrestrictExecution",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
Reference in New Issue
Block a user