diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index d300cff5df..70ad8183e2 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -78,11 +78,12 @@ #### [Management and APIs](windows-defender-atp/management-apis.md) ##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -##### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) -######Actor + +##### [TO BE DEPRECATED - Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) +######Actor - TO BE DEPRECATED ####### [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) ####### [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) -######Alerts +######Alerts - TO BE DEPRECATED ####### [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) ####### [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) ####### [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) @@ -90,13 +91,13 @@ ####### [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) ####### [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) ####### [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) -#######Domain +#######Domain - TO BE DEPRECATED ######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) ######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) ######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) ######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) -######File +######File - TO BE DEPRECATED ####### [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) ####### [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) ####### [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) @@ -105,12 +106,12 @@ ####### [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) ####### [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) -######IP +######IP - TO BE DEPRECATED ####### [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) ####### [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) ####### [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) ####### [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) -######Machines +######Machines - TO BE DEPRECATED ####### [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) ####### [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) ####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) @@ -131,14 +132,14 @@ ####### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) ####### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) -######User +######User - TO BE DEPRECATED ####### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) ####### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) ####### [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) ####### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) -##### [Managed service provider provider support](windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md) +##### [Managed security service provider support](windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md) #### [Microsoft threat protection](windows-defender-atp/threat-protection-integration.md) ##### [Protect users, data, and devices with conditional access](windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md) @@ -277,9 +278,146 @@ ###### [Troubleshoot onboarding issues](windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) ####### [Troubleshoot subscription and portal access issues](windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -##### API for custom alerts +##### [**Beta!** Windows Defender ATP APIs](windows-defender-atp/exposed-apis-intro.md) +###### Create your app +####### [Get access on behalf of a user](windows-defender-atp/exposed-apis-create-app-nativeapp.md) +####### [Get access without a user](windows-defender-atp/exposed-apis-create-app-webapp.md) +###### [Supported Windows Defender ATP APIs](windows-defender-atp/exposed-apis-list.md) +####### [Advanced Hunting](windows-defender-atp/run-advanced-query-api.md) + +####### [Alert](windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md) +######## [List alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md) +######## [Create alert](windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md) +######## [Update Alert](windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md) +######## [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md) +######## [Get alert related domains information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md) +######## [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md) +######## [Get alert related IPs information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md) +######## [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md) +######## [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md) + +####### Domain +######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md) +######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md) +######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md) +######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md) + +####### [File](windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md) +######## [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md) +######## [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md) +######## [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md) +######## [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md) + +####### IP +######## [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md) +######## [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md) +######## [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md) +######## [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md) + +####### [Machine](windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md) +######## [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md) +######## [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md) +######## [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md) +######## [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md) + +####### [Machine Action](windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md) +######## [List MachineActions](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md) +######## [Get MachineAction](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md) +######## [Collect investigation package](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md) +######## [Get investigation package SAS URI](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md) +######## [Isolate machine](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md) +######## [Release machine from isolation](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md) +######## [Restrict app execution](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md) +######## [Remove app restriction](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md) +######## [Run antivirus scan](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md) +######## [Offboard machine](windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md) + +####### [User](windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md) +######## [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md) +######## [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md) + +###### How to use APIs - Samples +####### Advanced Hunting API +######## [Schedule advanced Hunting using Microsoft Flow](windows-defender-atp/run-advanced-query-sample-ms-flow.md) +######## [Advanced Hunting using PowerShell](windows-defender-atp/run-advanced-query-sample-powershell.md) +######## [Advanced Hunting using Python](windows-defender-atp/run-advanced-query-sample-python.md) +######## [Create custom Power BI reports](windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md) +####### Multiple APIs +######## [PowerShell](windows-defender-atp/exposed-apis-full-sample-powershell.md) + +##### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) +###### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md) +#######Actor +######## [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md) +######## [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +#######Alerts +######## [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md) +######## [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +######## [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +######## [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +######## [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +######## [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +######## [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +#######Domain +######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md) +######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md) +######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) + +#######File +######## [Block file](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md) +######## [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md) +######## [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md) +######## [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md) +######## [Get FileActions collection](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md) +######## [Unblock file](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md) + +#######IP +######## [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md) +######## [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md) +######## [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md) +#######Machines +######## [Collect investigation package](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md) +######## [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +######## [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +######## [Get FileMachineAction object](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +######## [Get FileMachineActions collection](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +######## [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md) +######## [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +######## [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get MachineAction object](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md) +######## [Get MachineActions collection](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md) +######## [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md) +######## [Get package SAS URI](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md) +######## [Isolate machine](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md) +######## [Release machine from isolation](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md) +######## [Remove app restriction](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +######## [Request sample](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md) +######## [Restrict app execution](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md) +######## [Run antivirus scan](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) +######## [Stop and quarantine file](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) + +#######User +######## [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +######## [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) +######## [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md) +######## [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + +##### TO BE DEPRECATED - API for custom alerts ###### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) +###### [TO BE DEPRECATED Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) ####### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) ####### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) ####### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index ab294c45ed..f3b08f98b0 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -78,10 +78,10 @@ ### [Management and APIs](management-apis.md) #### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) #### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) -#####Actor +#####Actor - TO BE DEPRECATED ###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) ###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) -#####Alerts +#####Alerts - TO BE DEPRECATED ###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) ###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) ###### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) @@ -89,13 +89,13 @@ ###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) ###### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) ###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) -######Domain +######Domain - TO BE DEPRECATED ####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) ####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) ####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) ####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) -#####File +#####File - TO BE DEPRECATED ###### [Block file API](block-file-windows-defender-advanced-threat-protection.md) ###### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) ###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) @@ -104,12 +104,12 @@ ###### [Get FileActions collection API](get-fileactions-collection-windows-defender-advanced-threat-protection.md) ###### [Unblock file API](unblock-file-windows-defender-advanced-threat-protection.md) -#####IP +#####IP - TO BE DEPRECATED ###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) ###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) ###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) ###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) -#####Machines +#####Machines - TO BE DEPRECATED ###### [Collect investigation package API](collect-investigation-package-windows-defender-advanced-threat-protection.md) ###### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) ###### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) @@ -130,14 +130,14 @@ ###### [Run antivirus scan API](run-av-scan-windows-defender-advanced-threat-protection.md) ###### [Stop and quarantine file API](stop-quarantine-file-windows-defender-advanced-threat-protection.md) -#####User +#####User - TO BE DEPRECATED ###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) ###### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) ###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) ###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) -#### [Managed service provider provider support](mssp-support-windows-defender-advanced-threat-protection.md) +#### [Managed security service provider support](mssp-support-windows-defender-advanced-threat-protection.md) ### [Microsoft threat protection](threat-protection-integration.md) @@ -274,7 +274,157 @@ ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) ###### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) -#### API for custom alerts + +#### [**Beta!** Windows Defender ATP APIs](exposed-apis-intro.md) +##### Create your app +###### [Get access on behalf of a user](exposed-apis-create-app-nativeapp.md) +###### [Get access without a user](exposed-apis-create-app-webapp.md) +##### [Supported Windows Defender ATP APIs](exposed-apis-list.md) +###### [Advanced Hunting](run-advanced-query-api.md) + +###### [Alert](alerts-windows-defender-advanced-threat-protection-new.md) +####### [List alerts](get-alerts-windows-defender-advanced-threat-protection-new.md) +####### [Create alert](create-alert-by-reference-windows-defender-advanced-threat-protection-new.md) +####### [Update Alert](update-alert-windows-defender-advanced-threat-protection-new.md) +####### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md) +####### [Get alert related domains information](get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md) +####### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md) +####### [Get alert related IPs information](get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md) +####### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md) +####### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md) + +###### Domain +####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md) +####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection-new.md) +####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection-new.md) +####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md) + +###### [File](files-windows-defender-advanced-threat-protection-new.md) +####### [Get file information](get-file-information-windows-defender-advanced-threat-protection-new.md) +####### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection-new.md) +####### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection-new.md) +####### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection-new.md) + +###### IP +####### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md) +####### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection-new.md) +####### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection-new.md) +####### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection-new.md) + +###### [Machine](machine-windows-defender-advanced-threat-protection-new.md) +####### [Get machines](get-machines-windows-defender-advanced-threat-protection-new.md) +####### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection-new.md) +####### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md) +####### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md) + +###### [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) +####### [List MachineActions](get-machineactions-collection-windows-defender-advanced-threat-protection-new.md) +####### [Get MachineAction](get-machineaction-object-windows-defender-advanced-threat-protection-new.md) +####### [Collect investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md) +####### [Get investigation package SAS URI](get-package-sas-uri-windows-defender-advanced-threat-protection-new.md) +####### [Isolate machine](isolate-machine-windows-defender-advanced-threat-protection-new.md) +####### [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection-new.md) +####### [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md) +####### [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md) +####### [Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection-new.md) +####### [Offboard machine](offboard-machine-api-windows-defender-advanced-threat-protection-new.md) + +###### [User](user-windows-defender-advanced-threat-protection-new.md) +####### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection-new.md) +####### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection-new.md) + +##### How to use APIs - Samples +###### Advanced Hunting API +####### [Schedule advanced Hunting using Microsoft Flow](run-advanced-query-sample-ms-flow.md) +####### [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) +####### [Advanced Hunting using Python](run-advanced-query-sample-python.md) +####### [Create custom Power BI reports](run-advanced-query-sample-power-bi-app-token.md) +###### Multiple APIs +####### [PowerShell](exposed-apis-full-sample-powershell.md) + +#### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) +##### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) +######Actor +####### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) +####### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) +######Alerts +####### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) +####### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) +####### [Get alert related actor information](get-alert-related-actor-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related domain information](get-alert-related-domain-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related IP information](get-alert-related-ip-info-windows-defender-advanced-threat-protection.md) +####### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection.md) +######Domain +####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection.md) +####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection.md) + +######File +####### [Block file](block-file-windows-defender-advanced-threat-protection.md) +####### [Get file information](get-file-information-windows-defender-advanced-threat-protection.md) +####### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection.md) +####### [Get FileActions collection](get-fileactions-collection-windows-defender-advanced-threat-protection.md) +####### [Unblock file](unblock-file-windows-defender-advanced-threat-protection.md) + +######IP +####### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection.md) +####### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection.md) +####### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection.md) +######Machines +####### [Collect investigation package](collect-investigation-package-windows-defender-advanced-threat-protection.md) +####### [Find machine information by IP](find-machine-info-by-ip-windows-defender-advanced-threat-protection.md) +####### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineAction object](get-filemachineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get FileMachineActions collection](get-filemachineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection.md) +####### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection.md) +####### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get MachineAction object](get-machineaction-object-windows-defender-advanced-threat-protection.md) +####### [Get MachineActions collection](get-machineactions-collection-windows-defender-advanced-threat-protection.md) +####### [Get machines](get-machines-windows-defender-advanced-threat-protection.md) +####### [Get package SAS URI](get-package-sas-uri-windows-defender-advanced-threat-protection.md) +####### [Isolate machine](isolate-machine-windows-defender-advanced-threat-protection.md) +####### [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection.md) +####### [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Request sample](request-sample-windows-defender-advanced-threat-protection.md) +####### [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection.md) +####### [Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection.md) +####### [Stop and quarantine file](stop-quarantine-file-windows-defender-advanced-threat-protection.md) + +######User +####### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection.md) +####### [Get user information](get-user-information-windows-defender-advanced-threat-protection.md) +####### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) +####### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) + + + + + + + + + + + + + + + + + + + + + + + +#### TO BE DEPRECATED - API for custom alerts ##### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) ##### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) ###### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md)