mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-19 00:37:22 +00:00
Small fixes to Advanced Hunting API
This commit is contained in:
parent
85db261735
commit
8f54c5dc38
@ -97,7 +97,7 @@
|
|||||||
#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
#### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||||
#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
#### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||||
|
|
||||||
### [Use the Windows Defender ATP APIs](exposed-apis-windows-defender-advanced-threat-protection-new.md)
|
### [Use Windows Defender ATP APIs](exposed-apis-windows-defender-advanced-threat-protection-new.md)
|
||||||
#### Supported Windows Defender ATP APIs
|
#### Supported Windows Defender ATP APIs
|
||||||
##### [Advanced Hunting](run-advanced-query-windows-defender-advanced-threat-protection.md)
|
##### [Advanced Hunting](run-advanced-query-windows-defender-advanced-threat-protection.md)
|
||||||
|
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: Use the Windows Defender Advanced Threat Protection APIs
|
title: Use Windows Defender Advanced Threat Protection APIs
|
||||||
description: Use the exposed data and actions using a set of progammatic APIs that are part of the Microsoft Intelligence Security Graph.
|
description: Use the exposed data and actions using a set of progammatic APIs that are part of the Microsoft Intelligence Security Graph.
|
||||||
keywords: apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file, advanced hunting, query
|
keywords: apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file, advanced hunting, query
|
||||||
search.product: eADQiWindows 10XVcnh
|
search.product: eADQiWindows 10XVcnh
|
||||||
@ -13,7 +13,7 @@ ms.localizationpriority: medium
|
|||||||
ms.date: 10/23/2017
|
ms.date: 10/23/2017
|
||||||
---
|
---
|
||||||
|
|
||||||
# Use the Windows Defender ATP APIs
|
# Use Windows Defender ATP APIs
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
@ -27,7 +27,7 @@ ms.date: 10/23/2017
|
|||||||
|
|
||||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||||
|
|
||||||
Windows Defender ATP exposes much of the available data and actions using a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Windows Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
Windows Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Windows Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||||
|
|
||||||
In general, you’ll need to take the following steps to use the APIs:
|
In general, you’ll need to take the following steps to use the APIs:
|
||||||
- Create an app
|
- Create an app
|
||||||
@ -91,6 +91,7 @@ Before using the APIs, you’ll need to create an app that you’ll use to authe
|
|||||||
9. Set your application to be multi-tenanted
|
9. Set your application to be multi-tenanted
|
||||||
|
|
||||||
This is **required** for 3rd party apps (i.e., if you create an application that is intended to run in multiple customers tenant).
|
This is **required** for 3rd party apps (i.e., if you create an application that is intended to run in multiple customers tenant).
|
||||||
|
|
||||||
This is **not required** if you create a service that you want to run in your tenant only (i.e., if you create an application for your own usage that will only interact with your own data)
|
This is **not required** if you create a service that you want to run in your tenant only (i.e., if you create an application for your own usage that will only interact with your own data)
|
||||||
|
|
||||||
Click **Properties** > **Yes** > **Save**.
|
Click **Properties** > **Yes** > **Save**.
|
||||||
|
Binary file not shown.
Before Width: | Height: | Size: 62 KiB After Width: | Height: | Size: 32 KiB |
Binary file not shown.
Before Width: | Height: | Size: 16 KiB After Width: | Height: | Size: 11 KiB |
Binary file not shown.
Before Width: | Height: | Size: 7.0 KiB After Width: | Height: | Size: 7.6 KiB |
@ -13,18 +13,17 @@ ms.localizationpriority: medium
|
|||||||
ms.date: 12/08/2017
|
ms.date: 12/08/2017
|
||||||
---
|
---
|
||||||
|
|
||||||
# Collect investigation package API
|
# Advanced Hunting API
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Run advanced query.
|
Run advanced query.
|
||||||
|
|
||||||
## Permissions
|
## Permissions
|
||||||
Application needs 'Run advanced queries' role.
|
Application needs 'Run advanced queries' role (See [How to select a permission](exposed-apis-windows-defender-advanced-threat-protection-new#create-an-app)).
|
||||||
|
|
||||||
## HTTP request
|
## HTTP request
|
||||||
```
|
```
|
||||||
@ -35,7 +34,7 @@ POST /advancedqueries/query
|
|||||||
|
|
||||||
Header | Value
|
Header | Value
|
||||||
:---|:---
|
:---|:---
|
||||||
Authorization | Bearer {token}. Required.
|
Authorization | Bearer {token}. **Required**.
|
||||||
Content-Type | application/json
|
Content-Type | application/json
|
||||||
|
|
||||||
## Request body
|
## Request body
|
||||||
|
Loading…
x
Reference in New Issue
Block a user