deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-16 15:27:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

API pages update

Browse Source 
1. Adding US Gov reference to all pages with URIs.
2. Adding geo reference to all pages with URIs.
3. Replace MDE URLs ending with "windows.com" with "microsoft.com".
4. Replace the login endpoint from "login.windows.net" to "login.microsoftonline.com".
This commit is contained in:
adirdidi 2020-12-23 02:07:53 +02:00
parent 83d9bd9b7a
commit 8b119a506e
93 changed files with 518 additions and 254 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Adds or remove tag to a specific [Machine](machine.md).
@ -54,7 +59,7 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine
## HTTP request
```http
POST https://api.securitycenter.windows.com/api/machines/{id}/tags
POST https://api.securitycenter.microsoft.com/api/machines/{id}/tags
```
## Request headers
@ -84,10 +89,8 @@ If successful, this method returns 200 - Ok response code and the updated Machin
Here is an example of a request that adds machine tag.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```http
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags
Content-type: application/json
{
"Value" : "test Tag 2",

7
windows/security/threat-protection/microsoft-defender-atp/alerts.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Methods
Method |Return Type |Description
@ -71,7 +76,7 @@ comments | List of Alert comments | Alert Comment is an object that contains: co
### Response example for getting single alert:
```
GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-292920499
GET https://api.securitycenter.microsoft.com/api/alerts/da637084217856368682_-292920499
```
```json

4
windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md
View File

@ -28,6 +28,8 @@ ms.topic: article
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Get Alerts using a simple PowerShell script
@ -97,8 +99,6 @@ Done! You have successfully registered an application!
- Copy the script below to PowerShell ISE or to a text editor, and save it as "**Get-Token.ps1**"
- Running this script will generate a token and will save it in the working folder under the name "**Latest-token.txt**".
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
# That code gets the App Context Token and save it to a file named "Latest-token.txt" under the current directory
# Paste below your Tenant ID, App ID and App Secret (App key).

4
windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md
View File

@ -28,6 +28,8 @@ ms.topic: article
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
In this section you will learn create a Power BI report on top of Defender for Endpoint APIs.
The first example demonstrates how to connect Power BI to Advanced Hunting API and the second example demonstrates a connection to our OData APIs, such as Machine Actions or Alerts.
@ -46,8 +48,6 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a
- Copy the below and paste it in the editor:
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
let
AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti'",

11
windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md
View File

@ -26,6 +26,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Collect investigation package from a device.
@ -49,7 +54,7 @@ Delegated (work or school account) | Machine.CollectForensics | 'Collect forensi
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/collectInvestigationPackage
POST https://api.securitycenter.microsoft.com/api/machines/{id}/collectInvestigationPackage
```
## Request headers
@ -76,10 +81,8 @@ If successful, this method returns 201 - Created response code and [Machine Acti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.windows.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage
POST https://api.securitycenter.microsoft.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage
Content-type: application/json
{
"Comment": "Collect forensics due to alert 1234"

10
windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Creates new [Alert](alerts.md) on top of **Event**.
@ -56,7 +60,7 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
## HTTP request
```
POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference
POST https://api.securitycenter.microsoft.com/api/alerts/CreateAlertByReference
```
## Request headers
@ -91,10 +95,8 @@ If successful, this method returns 200 OK, and a new [alert](alerts.md) object i
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference
POST https://api.securitycenter.microsoft.com/api/alerts/CreateAlertByReference
```
```json
{

11
windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Deletes an [Indicator](ti-indicator.md) entity by ID.
@ -45,12 +49,9 @@ Application | Ti.ReadWrite.All | 'Read and write Indicators'
## HTTP request
```
Delete https://api.securitycenter.windows.com/api/indicators/{id}
Delete https://api.securitycenter.microsoft.com/api/indicators/{id}
```
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Request headers
Name | Type | Description
@ -72,5 +73,5 @@ If Indicator with the specified id was not found - 404 Not Found.
Here is an example of the request.
```
DELETE https://api.securitycenter.windows.com/api/indicators/995
DELETE https://api.securitycenter.microsoft.com/api/indicators/995
```

8
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md
View File

@ -26,6 +26,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
This page describes how to create an application to get programmatic access to Defender for Endpoint on behalf of a user.
If you need programmatic access Microsoft Defender for Endpoint without a user, refer to [Access Microsoft Defender for Endpoint with application context](exposed-apis-create-app-webapp.md).
@ -112,10 +116,6 @@ This page explains how to create an AAD application, get an access token to Micr
For more information on AAD tokens, see [Azure AD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds)
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
### Using C#
- Copy/Paste the below class in your application.

9
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md
View File

@ -25,6 +25,11 @@ ms.topic: article
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
This page describes how to create an Azure Active Directory (Azure AD) application to get programmatic access to Microsoft Defender for Endpoint on behalf of your customers.
@ -129,10 +134,6 @@ The following steps will guide you how to create an Azure AD application, get an
<br>For more information on AAD token, see [AAD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds)
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
### Using PowerShell
```

8
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md
View File

@ -26,6 +26,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
This page describes how to create an application to get programmatic access to Defender for Endpoint without a user. If you need programmatic access to Defender for Endpoint on behalf of a user, see [Get access with user context](exposed-apis-create-app-nativeapp.md). If you are not sure which access you need, see [Get started](apis-intro.md).
Microsoft Defender for Endpoint exposes much of its data and actions through a set of programmatic APIs. Those APIs will help you automate work flows and innovate based on Defender for Endpoint capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
@ -107,10 +111,6 @@ This article explains how to create an Azure AD application, get an access token
For more information on Azure AD tokens, see the [Azure AD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds).
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
### Use PowerShell
```

10
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md
View File

@ -25,6 +25,10 @@ ms.date: 09/24/2018
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Full scenario using multiple APIs from Microsoft Defender for Endpoint.
@ -63,7 +67,7 @@ $appSecret = '22222222-2222-2222-2222-222222222222' # Paste your own app secret
$suspiciousUrl = 'www.suspiciousUrl.com' # Paste your own URL here
$resourceAppIdUri = 'https://securitycenter.onmicrosoft.com/windowsatpservice'
$oAuthUri = "https://login.windows.net/$TenantId/oauth2/token"
$oAuthUri = "https://login.microsoftonline.com/$TenantId/oauth2/token"
$authBody = [Ordered] @{
resource = "$resourceAppIdUri"
client_id = "$appId"
@ -75,7 +79,7 @@ $aadToken = $authResponse.access_token
#Get latest alert
$alertUrl = "https://api.securitycenter.windows.com/api/alerts?`$top=10"
$alertUrl = "https://api.securitycenter.microsoft.com/api/alerts?`$top=10"
$headers = @{
'Content-Type' = 'application/json'
Accept = 'application/json'
@ -108,7 +112,7 @@ $query = "NetworkCommunicationEvents
| where RemoteUrl == `"$suspiciousUrl`"
| summarize ConnectionsCount = count() by MachineId"
$queryUrl = "https://api.securitycenter.windows.com/api/advancedqueries/run"
$queryUrl = "https://api.securitycenter.microsoft.com/api/advancedqueries/run"
$queryBody = ConvertTo-Json -InputObject @{ 'Query' = $query }
$queryResponse = Invoke-WebRequest -Method Post -Uri $queryUrl -Headers $headers -Body $queryBody -ErrorAction Stop

4
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md
View File

@ -45,10 +45,10 @@ ms.topic: article
> If you don't specify any version (e.g. https://api.securitycenter.microsoft.com/api/alerts ) you will get to the latest version.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses.

4
windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md
View File

@ -26,10 +26,10 @@ ms.topic: article
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
If you are not familiar with OData queries, see: [OData V4 queries](https://www.odata.org/documentation/)
Not all properties are filterable.

5
windows/security/threat-protection/microsoft-defender-atp/files.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Represent a file entity in Defender for Endpoint.
## Methods

8
windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Find [Machines](machine.md) seen with the requested internal IP in the time range of 15 minutes prior and after a given timestamp.
@ -75,8 +79,6 @@ If the timestamp is not in the past 30 days - 400 Bad Request.
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/machines/findbyip(ip='10.248.240.38',timestamp=2019-09-22T08:44:05Z)
GET https://api.securitycenter.microsoft.com/api/machines/findbyip(ip='10.248.240.38',timestamp=2019-09-22T08:44:05Z)
```

4
windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves specific [Alert](alerts.md) by its ID.

10
windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves all domains related to a specific alert.
@ -72,10 +76,8 @@ If successful and alert and domain exist - 200 OK. If alert not found - 404 Not
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/alerts/636688558380765161_2136280442/domains
GET https://api.securitycenter.microsoft.com/alerts/636688558380765161_2136280442/domains
```
**Response**
@ -86,7 +88,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/$metadata#Domains",
"@odata.context": "https://api.securitycenter.microsoft.com/$metadata#Domains",
"value": [
{
"host": "www.example.com"

10
windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves all files related to a specific alert.
@ -72,10 +76,8 @@ If successful and alert and files exist - 200 OK. If alert not found - 404 Not F
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442/files
GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_2136280442/files
```
**Response**
@ -87,7 +89,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Files",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Files",
"value": [
{
"sha1": "f2a00fd2f2de1be0214b8529f1e9f67096c1aa70",

10
windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves all IPs related to a specific alert.
@ -73,10 +77,8 @@ If successful and alert and an IP exist - 200 OK. If alert not found - 404 Not F
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/alerts/636688558380765161_2136280442/ips
GET https://api.securitycenter.microsoft.com/alerts/636688558380765161_2136280442/ips
```
**Response**
@ -88,7 +90,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/$metadata#Ips",
"@odata.context": "https://api.securitycenter.microsoft.com/$metadata#Ips",
"value": [
{
"id": "104.80.104.128"

11
windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves [Device](machine.md) related to a specific alert.
@ -74,11 +78,8 @@ If successful and alert and device exist - 200 OK. If alert not found or device
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442/machine
GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_2136280442/machine
```
**Response**
@ -90,7 +91,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
"computerDnsName": "mymachine1.contoso.com",
"firstSeen": "2018-08-02T14:55:03.7791856Z",

11
windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves the User related to a specific alert.
@ -73,11 +77,8 @@ If successful and alert and a user exists - 200 OK with user in the body. If ale
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442/user
GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_2136280442/user
```
**Response**
@ -89,7 +90,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Users/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Users/$entity",
"id": "contoso\\user1",
"accountName": "user1",
"accountDomain": "contoso",

7
windows/security/threat-protection/microsoft-defender-atp/get-alerts.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of Alerts.
@ -87,9 +91,6 @@ Here is an example of the request.
GET https://api.securitycenter.microsoft.com/api/alerts
```
[!include[Improve request performance](../../includes/improve-request-performance.md)]
**Response**
Here is an example of the response.

9
windows/security/threat-protection/microsoft-defender-atp/get-all-recommendations.md
View File

@ -23,6 +23,11 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a list of all security recommendations affecting the organization.
@ -61,7 +66,7 @@ If successful, this method returns 200 OK with the list of security recommendati
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/recommendations
GET https://api.securitycenter.microsoft.com/api/recommendations
```
**Response**
@ -71,7 +76,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Recommendations",
"value": [
{
"id": "va-_-microsoft-_-windows_10",

9
windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities-by-machines.md
View File

@ -23,6 +23,11 @@ ms.topic: article
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieves a list of all the vulnerabilities affecting the organization per [machine](machine.md) and [software](software.md).
- If the vulnerability has a fixing KB, it will appear in the response.
- Supports [OData V4 queries](https://www.odata.org/documentation/).
@ -65,7 +70,7 @@ If successful, this method returns 200 OK with the list of vulnerabilities in th
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/vulnerabilities/machinesVulnerabilities
GET https://api.securitycenter.microsoft.com/api/vulnerabilities/machinesVulnerabilities
```
**Response**
@ -75,7 +80,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.PublicAssetVulnerabilityDto)",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.PublicAssetVulnerabilityDto)",
"value": [
{
"id": "5afa3afc92a7c63d4b70129e0a6f33f63a427e21-_-CVE-2020-6494-_-microsoft-_-edge_chromium-based-_-81.0.416.77-_-",

9
windows/security/threat-protection/microsoft-defender-atp/get-all-vulnerabilities.md
View File

@ -23,6 +23,11 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a list of all the vulnerabilities affecting the organization.
@ -61,7 +66,7 @@ If successful, this method returns 200 OK with the list of vulnerabilities in th
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Vulnerabilities
GET https://api.securitycenter.microsoft.com/api/Vulnerabilities
```
**Response**
@ -71,7 +76,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Vulnerabilities",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Vulnerabilities",
"value": [
{
"id": "CVE-2019-0608",

9
windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieves your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). A higher Microsoft Secure Score for Devices means your endpoints are more resilient from cybersecurity threat attacks.
## Permissions
@ -63,7 +68,7 @@ If successful, this method returns 200 OK, with the device secure score data in
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/configurationScore
GET https://api.securitycenter.microsoft.com/api/configurationScore
```
### Response
@ -75,7 +80,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ConfigurationScore/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#ConfigurationScore/$entity",
"time": "2019-12-03T09:15:58.1665846Z",
"score": 340
}

8
windows/security/threat-protection/microsoft-defender-atp/get-discovered-vulnerabilities.md
View File

@ -24,6 +24,10 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieves a collection of discovered vulnerabilities related to a given device ID.
## Permissions
@ -62,7 +66,7 @@ If successful, this method returns 200 OK with the discovered vulnerability info
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/vulnerabilities
GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/vulnerabilities
```
### Response
@ -71,7 +75,7 @@ Here is an example of the response.
```
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
"value": [
{
"id": "CVE-2019-1348",

8
windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of [Alerts](alerts.md) related to a given domain address.
@ -74,8 +78,6 @@ If successful and domain exists - 200 OK with list of [alert](alerts.md) entitie
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```http
GET https://api.securitycenter.windows.com/api/domains/client.wns.windows.com/alerts
GET https://api.securitycenter.microsoft.com/api/domains/client.wns.windows.com/alerts
```

9
windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of [Machines](machine.md) that have communicated to or from a given domain address.
@ -75,9 +79,6 @@ If successful and domain exists - 200 OK with list of [machine](machine.md) enti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```http
GET https://api.securitycenter.windows.com/api/domains/api.securitycenter.windows.com/machines
GET https://api.securitycenter.microsoft.com/api/domains/api.securitycenter.microsoft.com/machines
```

10
windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves the statistics on the given domain.
@ -71,10 +75,8 @@ If successful and domain exists - 200 OK, with statistics object in the response
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/domains/example.com/stats
GET https://api.securitycenter.microsoft.com/api/domains/example.com/stats
```
**Response**
@ -86,7 +88,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgDomainStats",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgDomainStats",
"host": "example.com",
"orgPrevalence": "4070",
"orgFirstSeen": "2017-07-30T13:23:48Z",

9
windows/security/threat-protection/microsoft-defender-atp/get-exposure-score.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves the organizational exposure score.
@ -65,7 +70,7 @@ If successful, this method returns 200 OK, with the exposure data in the respons
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/exposureScore
GET https://api.securitycenter.microsoft.com/api/exposureScore
```
### Response
@ -77,7 +82,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ExposureScore/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#ExposureScore/$entity",
"time": "2019-12-03T07:23:53.280499Z",
"score": 33.491554051195706
}

10
windows/security/threat-protection/microsoft-defender-atp/get-file-information.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a [File](files.md) by identifier Sha1, or Sha256
@ -71,10 +75,8 @@ If successful and file exists - 200 OK with the [file](files.md) entity in the b
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/files/4388963aaa83afe2042a46a3c017ad50bdcdafb3
GET https://api.securitycenter.microsoft.com/api/files/4388963aaa83afe2042a46a3c017ad50bdcdafb3
```
**Response**
@ -86,7 +88,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Files/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Files/$entity",
"sha1": "4388963aaa83afe2042a46a3c017ad50bdcdafb3",
"sha256": "413c58c8267d2c8648d8f6384bacc2ae9c929b2b96578b6860b5087cd1bd6462",
"globalPrevalence": 180022,

8
windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of alerts related to a given file hash.
@ -74,8 +78,6 @@ If successful and file exists - 200 OK with list of [alert](alerts.md) entities
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/files/6532ec91d513acc05f43ee0aa3002599729fd3e1/alerts
GET https://api.securitycenter.microsoft.com/api/files/6532ec91d513acc05f43ee0aa3002599729fd3e1/alerts
```

8
windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of [Machines](machine.md) related to a given file hash.
@ -74,8 +78,6 @@ If successful and file exists - 200 OK with list of [machine](machine.md) entiti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/files/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/machines
GET https://api.securitycenter.microsoft.com/api/files/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/machines
```

10
windows/security/threat-protection/microsoft-defender-atp/get-file-statistics.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves the statistics for the given file.
@ -71,10 +75,8 @@ If successful and file exists - 200 OK with statistical data in the body. If fil
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/files/0991a395da64e1c5fbe8732ed11e6be064081d9f/stats
GET https://api.securitycenter.microsoft.com/api/files/0991a395da64e1c5fbe8732ed11e6be064081d9f/stats
```
**Response**
@ -86,7 +88,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgFileStats",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgFileStats",
"sha1": "0991a395da64e1c5fbe8732ed11e6be064081d9f",
"orgPrevalence": "14850",
"orgFirstSeen": "2019-12-07T13:44:16Z",

8
windows/security/threat-protection/microsoft-defender-atp/get-installed-software.md
View File

@ -23,6 +23,10 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a collection of installed software related to a given device ID.
@ -61,7 +65,7 @@ If successful, this method returns 200 OK with the installed software informatio
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/software
GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/software
```
**Response**
@ -71,7 +75,7 @@ Here is an example of the response.
```
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Software",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Software",
"value": [
{
"id": "microsoft-_-internet_explorer",

15
windows/security/threat-protection/microsoft-defender-atp/get-investigation-collection.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of [Investigations](investigation.md).
@ -54,7 +58,7 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
## HTTP request
```
GET https://api.securitycenter.windows.com/api/investigations
GET https://api.securitycenter.microsoft.com/api/investigations
```
## Request headers
@ -71,30 +75,25 @@ Empty
If successful, this method returns 200, Ok response code with a collection of [Investigations](investigation.md) entities.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Example
**Request**
Here is an example of a request to get all investigations:
```
GET https://api.securitycenter.windows.com/api/investigations
GET https://api.securitycenter.microsoft.com/api/investigations
```
**Response**
Here is an example of the response:
```
HTTP/1.1 200 Ok
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Investigations",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Investigations",
"value": [
{
"id": "63017",

7
windows/security/threat-protection/microsoft-defender-atp/get-investigation-object.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves specific [Investigation](investigation.md) by its ID.
<br> ID can be the investigation ID or the investigation triggering alert ID.
@ -50,7 +55,7 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
## HTTP request
```
GET https://api.securitycenter.windows.com/api/investigations/{id}
GET https://api.securitycenter.microsoft.com/api/investigations/{id}
```
## Request headers

9
windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of alerts related to a given IP address.
@ -74,9 +78,6 @@ If successful and IP exists - 200 OK with list of [alert](alerts.md) entities in
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/alerts
GET https://api.securitycenter.microsoft.com/api/ips/10.209.67.177/alerts
```

10
windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves the statistics for the given IP.
@ -71,10 +75,8 @@ If successful and ip exists - 200 OK with statistical data in the body. IP do no
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/stats
GET https://api.securitycenter.microsoft.com/api/ips/10.209.67.177/stats
```
**Response**
@ -86,7 +88,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgIPStats",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgIPStats",
"ipAddress": "10.209.67.177",
"orgPrevalence": "63515",
"orgFirstSeen": "2017-07-30T13:36:06Z",

10
windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves specific [Machine](machine.md) by its device ID or computer name.
@ -77,10 +81,8 @@ If machine with the specified ID was not found - 404 Not Found.
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```http
GET https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07
GET https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07
```
**Response**
@ -92,7 +94,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machine",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machine",
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
"computerDnsName": "mymachine1.contoso.com",
"firstSeen": "2018-08-02T14:55:03.7791856Z",

9
windows/security/threat-protection/microsoft-defender-atp/get-machine-group-exposure-score.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a collection of alerts related to a given domain address.
@ -65,7 +70,7 @@ If successful, this method returns 200 OK, with a list of exposure score per dev
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/exposureScore/ByMachineGroups
GET https://api.securitycenter.microsoft.com/api/exposureScore/ByMachineGroups
```
### Response
@ -75,7 +80,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#ExposureScore",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#ExposureScore",
"value": [
{
"time": "2019-12-03T09:51:28.214338Z",

10
windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of logged on users on a specific device.
@ -73,10 +77,8 @@ If successful and device exists - 200 OK with list of [user](user.md) entities i
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```http
GET https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/logonusers
GET https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/logonusers
```
**Response**
@ -88,7 +90,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Users",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Users",
"value": [
{
"id": "contoso\\user1",

4
windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves all [Alerts](alerts.md) related to a specific device.

12
windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves specific [Machine Action](machineaction.md) by its ID.
@ -50,7 +54,7 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine
## HTTP request
```
GET https://api.securitycenter.windows.com/api/machineactions/{id}
GET https://api.securitycenter.microsoft.com/api/machineactions/{id}
```
## Request headers
@ -72,10 +76,8 @@ If successful, this method returns 200, Ok response code with a [Machine Action]
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/machineactions/2e9da30d-27f6-4208-81f2-9cd3d67893ba
GET https://api.securitycenter.microsoft.com/api/machineactions/2e9da30d-27f6-4208-81f2-9cd3d67893ba
```
**Response**
@ -87,7 +89,7 @@ Here is an example of the response.
HTTP/1.1 200 Ok
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions/$entity",
"id": "5382f7ea-7557-4ab7-9782-d50480024a4e",
"type": "Isolate",
"scope": "Selective",

18
windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of [Machine Actions](machineaction.md).
@ -54,7 +58,7 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine
## HTTP request
```
GET https://api.securitycenter.windows.com/api/machineactions
GET https://api.securitycenter.microsoft.com/api/machineactions
```
## Request headers
@ -77,10 +81,8 @@ If successful, this method returns 200, Ok response code with a collection of [m
Here is an example of the request on an organization that has three MachineActions.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/machineactions
GET https://api.securitycenter.microsoft.com/api/machineactions
```
**Response**
@ -92,7 +94,7 @@ Here is an example of the response.
HTTP/1.1 200 Ok
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions",
"value": [
{
"id": "69dc3630-1ccc-4342-acf3-35286eec741d",
@ -147,20 +149,18 @@ Content-type: application/json
Here is an example of a request that filters the MachineActions by machine ID and shows the latest two MachineActions.
```
GET https://api.securitycenter.windows.com/api/machineactions?$filter=machineId eq 'f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f'&$top=2
GET https://api.securitycenter.microsoft.com/api/machineactions?$filter=machineId eq 'f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f'&$top=2
```
**Response**
Here is an example of the response.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
HTTP/1.1 200 Ok
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions",
"value": [
{
"id": "69dc3630-1ccc-4342-acf3-35286eec741d",

6
windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md
View File

@ -24,9 +24,13 @@ ms.date: 10/07/2018
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieves a collection of RBAC device groups.
## Permissions

9
windows/security/threat-protection/microsoft-defender-atp/get-machines-by-software.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieve a list of device references that has this software installed.
@ -62,7 +67,7 @@ If successful, this method returns 200 OK and a list of devices with the softwar
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/machineReferences
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/machineReferences
```
**Response**
@ -72,7 +77,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#MachineReferences",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineReferences",
"value": [
{
"id": "7c7e1896fa39efb0a32a2cf421d837af1b9bf762",

9
windows/security/threat-protection/microsoft-defender-atp/get-machines-by-vulnerability.md
View File

@ -24,6 +24,11 @@ ms.topic: article
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a list of devices affected by a vulnerability.
@ -62,7 +67,7 @@ If successful, this method returns 200 OK with the vulnerability information in
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/vulnerabilities/CVE-2019-0608/machineReferences
GET https://api.securitycenter.microsoft.com/api/vulnerabilities/CVE-2019-0608/machineReferences
```
**Response**
@ -72,7 +77,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineReferences",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineReferences",
"value": [
{
"id": "235a2e6278c63fcf85bab9c370396972c58843de",

13
windows/security/threat-protection/microsoft-defender-atp/get-machines.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of [Machines](machine.md) that have communicated with Microsoft Defender for Endpoint cloud.
@ -56,7 +60,7 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine
## HTTP request
```http
GET https://api.securitycenter.windows.com/api/machines
GET https://api.securitycenter.microsoft.com/api/machines
```
## Request headers
@ -79,11 +83,8 @@ If successful and machines exists - 200 OK with list of [machine](machine.md) en
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```http
GET https://api.securitycenter.windows.com/api/machines
GET https://api.securitycenter.microsoft.com/api/machines
```
**Response**
@ -94,7 +95,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines",
"value": [
{
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",

6
windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieves missing KBs (security updates) by device ID
## HTTP request
@ -54,7 +58,7 @@ If successful, this method returns 200 OK, with the specified device missing kb
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/machines/2339ad14a01bd0299afb93dfa2550136057bff96/getmissingkbs
GET https://api.securitycenter.microsoft.com/api/machines/2339ad14a01bd0299afb93dfa2550136057bff96/getmissingkbs
```
### Response

7
windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieves missing KBs (security updates) by software ID
## Permissions
@ -63,7 +68,7 @@ If successful, this method returns 200 OK, with the specified software missing k
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/getmissingkbs
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/getmissingkbs
```
### Response

13
windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Get a URI that allows downloading of an [Investigation package](collect-investigation-package.md).
@ -45,7 +49,7 @@ Delegated (work or school account) | Machine.CollectForensics | 'Collect forensi
## HTTP request
```
GET https://api.securitycenter.windows.com/api/machineactions/{machine action id}/getPackageUri
GET https://api.securitycenter.microsoft.com/api/machineactions/{machine action id}/getPackageUri
```
## Request headers
@ -69,7 +73,7 @@ If successful, this method returns 200, Ok response code with object that holds
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673/GetPackageUri
GET https://api.securitycenter.microsoft.com/api/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673/GetPackageUri
```
@ -77,15 +81,12 @@ GET https://api.securitycenter.windows.com/api/machineactions/7327b54fd718525cbc
Here is an example of the response.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
HTTP/1.1 200 Ok
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Edm.String",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Edm.String",
"value": "\"https://userrequests-us.securitycenter.windows.com:443/safedownload/WDATP_Investigation_Package.zip?token=gbDyj7y%2fbWGAZjn2sFiZXlliBTXOCVG7yiJ6mXNaQ9pLByC2Wxeno9mENsPFP3xMk5l%2bZiJXjLvqAyNEzUNROxoM2I1er9dxzfVeBsxSmclJjPsAx%2btiNyxSz1Ax%2b5jaT5cL5bZg%2b8wgbwY9urXbTpGjAKh6FB1e%2b0ypcWkPm8UkfOwsmtC%2biZJ2%2bPqnkkeQk7SKMNoAvmh9%2fcqDIPKXGIBjMa0D9auzypOqd8bQXp7p2BnLSH136BxST8n9IHR4PILvRjAYW9kvtHkBpBitfydAsUW4g2oDZSPN3kCLBOoo1C4w4Lkc9Bc3GNU2IW6dfB7SHcp7G9p4BDkeJl3VuDs6esCaeBorpn9FKJ%2fXo7o9pdcI0hUPZ6Ds9hiPpwPUtz5J29CBE3QAopCK%2fsWlf6OW2WyXsrNRSnF1tVE5H3wXpREzuhD7S4AIA3OIEZKzC4jIPLeMu%2bazZU9xGwuc3gICOaokbwMJiZTqcUuK%2fV9YdBdjdg8wJ16NDU96Pl6%2fgew2KYuk6Wo7ZuHotgHI1abcsvdlpe4AvixDbqcRJthsg2PpLRaFLm5av44UGkeK6TJpFvxUn%2f9fg6Zk5yM1KUTHb8XGmutoCM8U9er6AzXZlY0gGc3D3bQOg41EJZkEZLyUEbk1hXJB36ku2%2bW01cG71t7MxMBYz7%2bdXobxpdo%3d%3bRWS%2bCeoDfTyDcfH5pkCg6hYDmCOPr%2fHYQuaUWUBNVnXURYkdyOzVHqp%2fe%2f1BNyPdVoVkpQHpz1pPS3b5g9h7IMmNKCk5gFq5m2nPx6kk9EYtzx8Ndoa2m9Yj%2bSaf8zIFke86YnfQL4AYewsnQNJJh4wc%2bXxGlBq7axDcoiOdX91rKzVicH3GSBkFoLFAKoegWWsF%2fEDZcVpF%2fXUA1K8HvB6dwyfy4y0sAqnNPxYTQ97mG7yHhxPt4Pe9YF2UPPAJVuEf8LNlQ%2bWHC9%2f7msF6UUI4%2fca%2ftpjFs%2fSNeRE8%2fyQj21TI8YTF1SowvaJuDc1ivEoeopNNGG%2bGI%2fX0SckaVxU9Hdkh0zbydSlT5SZwbSwescs0IpzECitBbaLUz4aT8KTs8T0lvx8D7Te3wVsKAJ1r3iFMQZrlk%2bS1WW8rvac7oHRx2HKURn1v7fDIQWgJr9aNsNlFz4fLJ50T2qSHuuepkLVbe93Va072aMGhvr09WVKoTpAf1j2bcFZZU6Za5PxI32mr0k90FgiYFJ1F%2f1vRDrGwvWVWUkR3Z33m4g0gHa52W1FMxQY0TJIwbovD6FaSNDx7xhKZSd5IJ7r6P91Gez49PaZRcAZPjd%2bfbul3JNm1VqQPTLohT7wa0ymRiXpSST74xtFzuEBzNSNATdbngj3%2fwV4JesTjZjIj5Dc%3d%3blumqauVlFuuO8MQffZgs0tLJ4Fq6fpeozPTdDf8Ll6XLegi079%2b4mSPFjTK0y6eohstxdoOdom2wAHiZwk0u4KLKmRkfYOdT1wHY79qKoBQ3ZDHFTys9V%2fcwKGl%2bl8IenWDutHygn5IcA1y7GTZj4g%3d%3d\""
}

12
windows/security/threat-protection/microsoft-defender-atp/get-recommendation-by-id.md
View File

@ -20,7 +20,13 @@ ms.topic: article
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
@ -60,7 +66,7 @@ If successful, this method returns 200 OK with the security recommendations in t
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome
```
**Response**
@ -69,7 +75,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Recommendations/$entity",
"id": "va-_-google-_-chrome",
"productName": "chrome",
"recommendationName": "Update Chrome",

10
windows/security/threat-protection/microsoft-defender-atp/get-recommendation-machines.md
View File

@ -21,9 +21,13 @@ ms.topic: article
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a list of devices associated with the security recommendation.
@ -62,7 +66,7 @@ If successful, this method returns 200 OK with the list of devices associated wi
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/machineReferences
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome/machineReferences
```
**Response**
@ -71,7 +75,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineReferences",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineReferences",
"value": [
{
"id": "e058770379bc199a9c179ce52a23e16fd44fd2ee",

10
windows/security/threat-protection/microsoft-defender-atp/get-recommendation-software.md
View File

@ -21,9 +21,13 @@ ms.topic: article
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a security recommendation related to a specific software.
@ -62,7 +66,7 @@ If successful, this method returns 200 OK with the software associated with the
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/software
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome/software
```
**Response**
@ -71,7 +75,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Analytics.Contracts.PublicAPI.PublicProductDto",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Analytics.Contracts.PublicAPI.PublicProductDto",
"id": "google-_-chrome",
"name": "chrome",
"vendor": "google",

10
windows/security/threat-protection/microsoft-defender-atp/get-recommendation-vulnerabilities.md
View File

@ -21,9 +21,13 @@ ms.topic: article
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a list of vulnerabilities associated with the security recommendation.
@ -62,7 +66,7 @@ If successful, this method returns 200 OK, with the list of vulnerabilities asso
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/recommendations/va-_-google-_-chrome/vulnerabilities
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome/vulnerabilities
```
**Response**
@ -71,7 +75,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
"value": [
{
"id": "CVE-2019-13748",

8
windows/security/threat-protection/microsoft-defender-atp/get-security-recommendations.md
View File

@ -24,6 +24,10 @@ ms.topic: article
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a collection of security recommendations related to a given device ID.
@ -62,7 +66,7 @@ If successful, this method returns 200 OK with the security recommendations in t
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/recommendations
GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/recommendations
```
**Response**
@ -72,7 +76,7 @@ Here is an example of the response.
```
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Recommendations",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Recommendations",
"value": [
{
"id": "va-_-git-scm-_-git",

9
windows/security/threat-protection/microsoft-defender-atp/get-software-by-id.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves software details by ID.
@ -62,7 +67,7 @@ If successful, this method returns 200 OK with the specified software data in th
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge
```
**Response**
@ -72,7 +77,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Software/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Software/$entity",
"id": "microsoft-_-edge",
"name": "edge",
"vendor": "microsoft",

9
windows/security/threat-protection/microsoft-defender-atp/get-software-ver-distribution.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves a list of your organization's software version distribution.
@ -62,7 +67,7 @@ If successful, this method returns 200 OK with a list of software distributions
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/distributions
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/distributions
```
**Response**
@ -72,7 +77,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Distributions",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Distributions",
"value": [
{
"version": "11.0.17134.1039",

9
windows/security/threat-protection/microsoft-defender-atp/get-software.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieves the organization software inventory.
## Permissions
@ -61,7 +66,7 @@ If successful, this method returns 200 OK with the software inventory in the bod
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Software
GET https://api.securitycenter.microsoft.com/api/Software
```
**Response**
@ -71,7 +76,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Software",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Software",
"value": [
{
"id": "microsoft-_-edge",

16
windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of all active [Indicators](ti-indicator.md).
@ -48,11 +52,9 @@ Delegated (work or school account) | Ti.ReadWrite | 'Read and write Indicators'
## HTTP request
```
GET https://api.securitycenter.windows.com/api/indicators
GET https://api.securitycenter.microsoft.com/api/indicators
```
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Request headers
Name | Type | Description
@ -76,7 +78,7 @@ If successful, this method returns 200, Ok response code with a collection of [I
Here is an example of a request that gets all Indicators
```
GET https://api.securitycenter.windows.com/api/indicators
GET https://api.securitycenter.microsoft.com/api/indicators
```
**Response**
@ -87,7 +89,7 @@ Here is an example of the response.
HTTP/1.1 200 Ok
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Indicators",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators",
"value": [
{
"id": "995",
@ -139,7 +141,7 @@ Content-type: application/json
Here is an example of a request that gets all Indicators with 'AlertAndBlock' action
```
GET https://api.securitycenter.windows.com/api/indicators?$filter=action+eq+'AlertAndBlock'
GET https://api.securitycenter.microsoft.com/api/indicators?$filter=action+eq+'AlertAndBlock'
```
**Response**
@ -150,7 +152,7 @@ Here is an example of the response.
HTTP/1.1 200 Ok
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Indicators",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators",
"value": [
{
"id": "997",

10
windows/security/threat-protection/microsoft-defender-atp/get-user-information.md
View File

@ -23,6 +23,10 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Retrieve a User entity by key (user name).
@ -58,10 +62,8 @@ If successful and user exists - 200 OK with [user](user.md) entity in the body.
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/users/user1
GET https://api.securitycenter.microsoft.com/api/users/user1
Content-type: application/json
```
@ -74,7 +76,7 @@ Here is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Users/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Users/$entity",
"id": "user1",
"firstSeen": "2018-08-02T00:00:00Z",
"lastSeen": "2018-08-04T00:00:00Z",

8
windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of alerts related to a given user ID.
@ -76,8 +80,6 @@ If successful and user exists - 200 OK. If the user does not exist - 404 Not Fou
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/users/user1/alerts
GET https://api.securitycenter.microsoft.com/api/users/user1/alerts
```

8
windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Retrieves a collection of devices related to a given user ID.
@ -77,8 +81,6 @@ If successful and user exists - 200 OK with list of [machine](machine.md) entiti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
GET https://api.securitycenter.windows.com/api/users/user1/machines
GET https://api.securitycenter.microsoft.com/api/users/user1/machines
```

9
windows/security/threat-protection/microsoft-defender-atp/get-vuln-by-software.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieve a list of vulnerabilities in the installed software.
@ -62,7 +67,7 @@ If successful, this method returns 200 OK with a a list of vulnerabilities expos
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/vulnerabilities
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/vulnerabilities
```
**Response**
@ -72,7 +77,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
"value": [
{
"id": "CVE-2017-0140",

9
windows/security/threat-protection/microsoft-defender-atp/get-vulnerability-by-id.md
View File

@ -23,6 +23,11 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
Retrieves vulnerability information by its ID.
@ -61,7 +66,7 @@ If successful, this method returns 200 OK with the vulnerability information in
Here is an example of the request.
```
GET https://api.securitycenter.windows.com/api/Vulnerabilities/CVE-2019-0608
GET https://api.securitycenter.microsoft.com/api/Vulnerabilities/CVE-2019-0608
```
**Response**
@ -70,7 +75,7 @@ Here is an example of the response.
```json
{
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Vulnerabilities/$entity",
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Vulnerabilities/$entity",
"id": "CVE-2019-0608",
"name": "CVE-2019-0608",
"description": "A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.The update addresses the vulnerability by correcting how Microsoft Browsers parses HTTP responses.",

6
windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Start automated investigation on a device.
@ -79,8 +83,6 @@ If successful, this method returns 201 - Created response code and [Investigatio
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/startInvestigation
Content-type: application/json

5
windows/security/threat-protection/microsoft-defender-atp/investigation.md
View File

@ -27,6 +27,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Represent an Automated Investigation entity in Defender for Endpoint.
<br> See [Overview of automated investigations](automated-investigations.md) for more information.

10
windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Isolates a device from accessing external network.
@ -52,7 +56,7 @@ Delegated (work or school account) | Machine.Isolate | 'Isolate machine'
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/isolate
POST https://api.securitycenter.microsoft.com/api/machines/{id}/isolate
```
## Request headers
@ -85,10 +89,8 @@ If successful, this method returns 201 - Created response code and [Machine Acti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```console
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/isolate
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/isolate
Content-type: application/json
{
"Comment": "Isolate machine due to alert 1234",

4
windows/security/threat-protection/microsoft-defender-atp/machine.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
## Methods

5
windows/security/threat-protection/microsoft-defender-atp/machineaction.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
- For more information, see [Response Actions](respond-machine-alerts.md).
| Method | Return Type | Description |

10
windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Offboard device from Defender for Endpoint.
@ -55,7 +59,7 @@ Delegated (work or school account) | Machine.Offboard | 'Offboard machine'
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/offboard
POST https://api.securitycenter.microsoft.com/api/machines/{id}/offboard
```
## Request headers
@ -82,10 +86,8 @@ If successful, this method returns 201 - Created response code and [Machine Acti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/offboard
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/offboard
Content-type: application/json
{
"Comment": "Offboard machine by automation"

7
windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md
View File

@ -25,6 +25,11 @@ ms.topic: article
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Create a notification rule so that when a local onboarding or offboardiing script is used, you'll be notified.
## Before you begin
@ -56,7 +61,7 @@ You'll need to have access to:
5. Enter the following HTTP fields:
- Method: "GET" as a value to get the list of devices.
- URI: Enter `https://api.securitycenter.windows.com/api/machines`.
- URI: Enter `https://api.securitycenter.microsoft.com/api/machines`.
- Authentication: Select "Active Directory OAuth".
- Tenant: Sign-in to https://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
- Audience: `https://securitycenter.onmicrosoft.com/windowsatpservice\`

11
windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Submits or Updates new [Indicator](ti-indicator.md) entity.
@ -47,12 +51,9 @@ Delegated (work or school account) | Ti.ReadWrite | 'Read and write Indicators'
## HTTP request
```
POST https://api.securitycenter.windows.com/api/indicators
POST https://api.securitycenter.microsoft.com/api/indicators
```
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Request headers
Name | Type | Description
@ -88,7 +89,7 @@ rbacGroupNames | String | Comma-separated list of RBAC group names the indicator
Here is an example of the request.
```
POST https://api.securitycenter.windows.com/api/indicators
POST https://api.securitycenter.microsoft.com/api/indicators
Content-type: application/json
{
"indicatorValue": "220e7d15b011d7fac48f2bd61114db1022197f7f",

6
windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
View File

@ -203,7 +203,7 @@ Here is an example return value:
The following code examples demonstrate how to obtain an access token for calling the Microsoft Defender for Endpoint SIEM API.
```csharp
AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}", tenantId));
AuthenticationContext context = new AuthenticationContext(string.Format("https://login.microsoftonline.com/{0}", tenantId));
ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret);
AuthenticationResult authenticationResult = context.AcquireTokenAsync(detectionsResource, clientCredentials).GetAwaiter().GetResult();
```
@ -218,7 +218,7 @@ $appId = '' ### Paste your Application ID here
$appSecret = '' ### Paste your Application secret here
$resourceAppIdUri = 'https://graph.windows.net'
$oAuthUri = "https://login.windows.net/$tenantId/oauth2/token"
$oAuthUri = "https://login.microsoftonline.com/$tenantId/oauth2/token"
$authBody = [Ordered] @{
resource = "$resourceAppIdUri"
client_id = "$appId"
@ -237,7 +237,7 @@ tenantId='' ### Paste your tenant ID here
appId='' ### Paste your Application ID here
appSecret='' ### Paste your Application secret here
resourceAppIdUri='https://graph.windows.net'
oAuthUri="https://login.windows.net/$tenantId/oauth2/token"
oAuthUri="https://login.microsoftonline.com/$tenantId/oauth2/token"
scriptDir=$(pwd)
apiResponse=$(curl -s X POST "$oAuthUri" -d "resource=$resourceAppIdUri&client_id=$appId&client_secret=$appSecret&\

5
windows/security/threat-protection/microsoft-defender-atp/recommendation.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
## Methods

8
windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Restrict execution of all applications on the device except a predefined set.
@ -51,7 +55,7 @@ Delegated (work or school account) | Machine.RestrictExecution | 'Restrict code
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/restrictCodeExecution
POST https://api.securitycenter.microsoft.com/api/machines/{id}/restrictCodeExecution
```
## Request headers
@ -79,7 +83,7 @@ If successful, this method returns 201 - Created response code and [Machine Acti
Here is an example of the request.
```
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/restrictCodeExecution
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/restrictCodeExecution
Content-type: application/json
{
"Comment": "Restrict code execution due to alert 1234"

5
windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md
View File

@ -28,6 +28,8 @@ ms.topic: article
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Limitations
1. You can only run a query on data from the last 30 days.
2. The results will include a maximum of 100,000 rows.
@ -79,9 +81,6 @@ Request
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.microsoft.com/api/advancedqueries/run
Content-type: application/json

3
windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md
View File

@ -26,6 +26,7 @@ ms.topic: article
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md).
@ -74,8 +75,6 @@ where
Run the following query:
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
$query = 'RegistryEvents | limit 10' # Paste your own query here

4
windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md
View File

@ -28,6 +28,8 @@ ms.topic: article
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Run advanced queries using Python, see [Advanced Hunting API](run-advanced-query-api.md).
In this section, we share Python samples to retrieve a token and use it to run a query.
@ -38,8 +40,6 @@ In this section, we share Python samples to retrieve a token and use it to run a
- Run the following commands:
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
import json

8
windows/security/threat-protection/microsoft-defender-atp/run-av-scan.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Initiate Microsoft Defender Antivirus scan on a device.
@ -51,7 +55,7 @@ Delegated (work or school account) | Machine.Scan | 'Scan machine'
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/runAntiVirusScan
POST https://api.securitycenter.microsoft.com/api/machines/{id}/runAntiVirusScan
```
## Request headers
@ -87,7 +91,7 @@ If successful, this method returns 201, Created response code and _MachineAction
Here is an example of the request.
```
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/runAntiVirusScan
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/runAntiVirusScan
Content-type: application/json
{
"Comment": "Check machine for viruses due to alert 3212",

5
windows/security/threat-protection/microsoft-defender-atp/score.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
## Methods

5
windows/security/threat-protection/microsoft-defender-atp/set-device-value.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Set the device value of a specific [Machine](machine.md).<br>

5
windows/security/threat-protection/microsoft-defender-atp/software.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
## Methods

8
windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Stop execution of a file on a device and delete it.
@ -51,7 +55,7 @@ Delegated (work or school account) | Machine.StopAndQuarantine | 'Stop And Quara
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/StopAndQuarantineFile
POST https://api.securitycenter.microsoft.com/api/machines/{id}/StopAndQuarantineFile
```
## Request headers
@ -80,7 +84,7 @@ If successful, this method returns 201 - Created response code and [Machine Acti
Here is an example of the request.
```
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/StopAndQuarantineFile
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/StopAndQuarantineFile
Content-type: application/json
{
"Comment": "Stop and quarantine file on machine due to alert 441688558380765161_2136280442",

5
windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
- See the corresponding [Indicators page](https://securitycenter.windows.com/preferences2/custom_ti_indicators/files) in the portal.
Method|Return Type |Description

4
windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md
View File

@ -78,8 +78,8 @@ You'll need to allow the `securitycenter.windows.com` and all subdomains under i
## Portal communication issues
If you encounter issues with accessing the portal, missing data, or restricted access to portions of the portal, you'll need to verify that the following URLs are allowed and open for communication.
- `*.blob.core.windows.net
crl.microsoft.com`
- `*.blob.core.windows.net`
- `crl.microsoft.com`
- `https://*.microsoftonline-p.com`
- `https://*.securitycenter.windows.com`
- `https://automatediracs-eus-prd.securitycenter.windows.com`

10
windows/security/threat-protection/microsoft-defender-atp/unisolate-machine.md
View File

@ -26,6 +26,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Undo isolation of a device.
@ -52,7 +56,7 @@ Delegated (work or school account) | Machine.Isolate | 'Isolate machine'
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/unisolate
POST https://api.securitycenter.microsoft.com/api/machines/{id}/unisolate
```
## Request headers
@ -80,10 +84,8 @@ If successful, this method returns 201 - Created response code and [Machine Acti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unisolate
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unisolate
Content-type: application/json
{
"Comment": "Unisolate machine since it was clean and validated"

10
windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Enable execution of any application on the device.
@ -51,7 +55,7 @@ Delegated (work or school account) | Machine.RestrictExecution | 'Restrict code
## HTTP request
```
POST https://api.securitycenter.windows.com/api/machines/{id}/unrestrictCodeExecution
POST https://api.securitycenter.microsoft.com/api/machines/{id}/unrestrictCodeExecution
```
## Request headers
@ -77,10 +81,8 @@ If successful, this method returns 201 - Created response code and [Machine Acti
Here is an example of the request.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
```
POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unrestrictCodeExecution
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unrestrictCodeExecution
Content-type: application/json
{
"Comment": "Unrestrict code execution since machine was cleaned and validated"

8
windows/security/threat-protection/microsoft-defender-atp/update-alert.md
View File

@ -25,6 +25,10 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description
Updates properties of existing [Alert](alerts.md).
@ -76,8 +80,6 @@ classification | String | Specifies the specification of the alert. The property
determination | String | Specifies the determination of the alert. The property values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'
comment | String | Comment to be added to the alert.
[!include[Improve request performance](../../includes/improve-request-performance.md)]
## Response
If successful, this method returns 200 OK, and the [alert](alerts.md) entity in the response body with the updated properties. If alert with the specified id was not found - 404 Not Found.
@ -89,7 +91,7 @@ If successful, this method returns 200 OK, and the [alert](alerts.md) entity in
Here is an example of the request.
```
PATCH https://api.securitycenter.windows.com/api/alerts/121688558380765161_2136280442
PATCH https://api.securitycenter.microsoft.com/api/alerts/121688558380765161_2136280442
Content-Type: application/json
{

5
windows/security/threat-protection/microsoft-defender-atp/user.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
Method|Return Type |Description
:---|:---|:---
[List User related alerts](get-user-related-alerts.md) | [alert](alerts.md) collection | List all the alerts that are associated with a [user](user.md).

5
windows/security/threat-protection/microsoft-defender-atp/vulnerability.md
View File

@ -25,6 +25,11 @@ ms.topic: article
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)]
[!include[Prerelease information](../../includes/prerelease.md)]
## Methods