mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 22:37:22 +00:00
1
This commit is contained in:
Ben Alfasi
parent
a74718d26b
commit
cfc9e9774a
@ -27,6 +27,7 @@ Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get alert](get-alert-info-by-id.md) | [Alert](alerts.md) | Get a single [alert](alerts.md) object.
|
||||
[List alerts](get-alerts.md) | [Alert](alerts.md) collection | List [alert](alerts.md) collection.
|
||||
[Update alert](get-alerts.md) | [Alert](update-alert.md) | Update specific [alert](alerts.md).
|
||||
[Create alert](create-alert-by-reference.md)|[Alert](alerts.md)|Create an alert based on event data obtained from [Advanced Hunting](run-advanced-query-api.md).
|
||||
[List related domains](get-alert-related-domain-info.md)|Domain collection| List URLs associated with the alert.
|
||||
[List related files](get-alert-related-files-info.md) | [File](files.md) collection | List the [file](files.md) entities that are associated with the [alert](alerts.md).
|
||||
@ -59,19 +60,8 @@ detectionSource | String | Detection source.
|
||||
threatFamilyName | String | Threat family.
|
||||
machineId | String | ID of a [machine](machine.md) entity that is associated with the alert.
|
||||
comments | List of Alert comments | Alert Comment is an object that contains: comment string, createdBy string and createTime date time.
|
||||
alertFiles | List of Alert Files | **This list will be populated on $expand option, see example below** Alert File is an object that contains: sha1, sha256, filePath and fileName.
|
||||
alertIPs | List of Alert IPs | **This list will be populated on $expand option, see example below** Alert IP is an object that contains: ipAddress string field.
|
||||
alertDomains | List of Alert Domains | **This list will be populated on $expand option, see example below** Alert Domain is an object that contains: host string field.
|
||||
|
||||
|
||||
|
||||
## JSON representation:
|
||||
|
||||
- When querying for alert list the regular way (without expand option, e.g. /api/alerts) the expandable properties will not get populated (empty lists)
|
||||
- To expand expandable properties use $expand option (e.g. to expand all send /api/alerts?$expand=files,ips,domains).
|
||||
- When querying single alert all expandable properties will be expanded.
|
||||
- Check out [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md) for more OData examples.
|
||||
|
||||
### Response example for getting single alert:
|
||||
|
||||
```
|
||||
@ -83,12 +73,12 @@ GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-2929
|
||||
"id": "da637084217856368682_-292920499",
|
||||
"incidentId": 66860,
|
||||
"investigationId": 4416234,
|
||||
"investigationState": "Running",
|
||||
"assignedTo": "secop@contoso.com",
|
||||
"severity": "Low",
|
||||
"status": "New",
|
||||
"classification": "TruePositive",
|
||||
"determination": null,
|
||||
"investigationState": "Running",
|
||||
"detectionSource": "WindowsDefenderAtp",
|
||||
"category": "CommandAndControl",
|
||||
"threatFamilyName": null,
|
||||
@ -106,24 +96,6 @@ GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-2929
|
||||
"createdBy": "secop@contoso.com",
|
||||
"createdTime": "2019-11-05T14:08:37.8404534Z"
|
||||
}
|
||||
],
|
||||
"alertFiles": [
|
||||
{
|
||||
"sha1": "77e862797dd525fd3e9c3058153247945d0d4cfd",
|
||||
"sha256": "c05823562aee5e6d000b0e041197d5b8303f5aa4eecb49820879b705c926e16e",
|
||||
"filePath": "C:\\Users\\test1212\\AppData\\Local\\Temp\\nsf61D3.tmp.exe",
|
||||
"fileName": "nsf61D3.tmp.exe"
|
||||
}
|
||||
],
|
||||
"alertDomains": [
|
||||
{
|
||||
"host": "login.bullguard.com"
|
||||
}
|
||||
],
|
||||
"alertIps": [
|
||||
{
|
||||
"ipAddress": "91.231.212.53"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
@ -22,14 +22,20 @@ ms.topic: article
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
## API description
|
||||
|
||||
Retrieves a collection of Alerts.
|
||||
|
||||
Supports [OData V4 queries](https://www.odata.org/documentation/).
|
||||
|
||||
The OData's Filter query is supported on: "alertCreationTime", "incidentId", "InvestigationId", "status", "severity" and "category".
|
||||
|
||||
See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
|
||||
## Limitations
|
||||
1. You can get alerts last updated in the past 30 days.
|
||||
2. The maximum page size is 10,000.
|
||||
3. The rate limitations of this API is 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
@ -50,10 +56,6 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
|
||||
GET /api/alerts
|
||||
```
|
||||
|
||||
## Optional query parameters
|
||||
Method supports $top, $select, $filter, $expand and $skip query parameters.
|
||||
<br>$expand is available on Files, IPs and Domains. e.g. $expand=files,domains
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
@ -120,10 +122,7 @@ Here is an example of the response.
|
||||
"createdBy": "secop@contoso.com",
|
||||
"createdTime": "2019-11-05T14:08:37.8404534Z"
|
||||
}
|
||||
],
|
||||
"alertFiles": [],
|
||||
"alertDomains": [],
|
||||
"alertIps": []
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user