fix product name

This commit is contained in:
Joey Caparas
2019-03-14 11:36:50 -07:00
parent 26f1ddabf7
commit dbc9714655
16 changed files with 29 additions and 31 deletions

View File

@ -14,7 +14,6 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: article ms.topic: article
ms.date: 12/08/2017
--- ---
# Alert resource type # Alert resource type
@ -23,7 +22,7 @@ ms.date: 12/08/2017
[!include[Prerelease<73>information](prerelease.md)] [!include[Prerelease<73>information](prerelease.md)]
Represents an alert entity in WDATP. Represents an alert entity in Windows Defender ATP.
# Methods # Methods
Method|Return Type |Description Method|Return Type |Description

View File

@ -14,12 +14,12 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: conceptual ms.topic: conceptual
ms.date: 09/03/2018
--- ---
# Windows Defender ATP API overview # Windows Defender ATP API overview
**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) **Applies to:**
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
> Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) > Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)

View File

@ -22,7 +22,6 @@ ms.date: 10/16/2017
**Applies to:** **Applies to:**
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)

View File

@ -1,5 +1,5 @@
--- ---
title: Delete Indicator. title: Delete Indicator API.
description: Deletes Indicator entity by ID. description: Deletes Indicator entity by ID.
keywords: apis, public api, supported apis, delete, ti indicator, entity, id keywords: apis, public api, supported apis, delete, ti indicator, entity, id
search.product: eADQiWindows 10XVcnh search.product: eADQiWindows 10XVcnh
@ -14,12 +14,12 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: article ms.topic: article
ms.date: 12/08/2017
--- ---
# Delete Indicator API # Delete Indicator API
**Applies to:** Windows Defender Advanced Threat Protection (Windows Defender ATP) **Applies to:**
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
[!include[Prerelease<73>information](prerelease.md)] [!include[Prerelease<73>information](prerelease.md)]

View File

@ -26,7 +26,7 @@ ms.date: 09/03/2018
[!include[Prerelease information](prerelease.md)] [!include[Prerelease information](prerelease.md)]
This page describe how to create an application to get programmatic access to Windows Defender ATP on behalf of a user. This page describes how to create an application to get programmatic access to Windows Defender ATP on behalf of a user.
If you need programmatic access Windows Defender ATP without a user, refer to [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md). If you need programmatic access Windows Defender ATP without a user, refer to [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md).

View File

@ -101,7 +101,7 @@ This page explains how to create an AAD application, get an access token to Wind
![Image of created app id](images/webapp-app-id1.png) ![Image of created app id](images/webapp-app-id1.png)
11. **For WDATP Partners only** - Set your application to be multi-tenanted 11. **For Windows Defender ATP Partners only** - Set your application to be multi-tenanted
This is **required** for 3rd party apps (for example, if you create an application that is intended to run in multiple customers tenant). This is **required** for 3rd party apps (for example, if you create an application that is intended to run in multiple customers tenant).
@ -113,7 +113,7 @@ This page explains how to create an AAD application, get an access token to Wind
- Application consent for your multi-tenant App: - Application consent for your multi-tenant App:
You need your application to be approved in each tenant where you intend to use it. This is because your application interacts with WDATP application on behalf of your customer. You need your application to be approved in each tenant where you intend to use it. This is because your application interacts with Windows Defender ATP application on behalf of your customer.
You (or your customer if you are writing a 3rd party application) need to click the consent link and approve your application. The consent should be done with a user who has admin privileges in the active directory. You (or your customer if you are writing a 3rd party application) need to click the consent link and approve your application. The consent should be done with a user who has admin privileges in the active directory.
@ -199,7 +199,7 @@ Refer to [Get token using Python](run-advanced-query-sample-python.md#get-token)
- Open a command window - Open a command window
- Set CLIENT_ID to your Azure application ID - Set CLIENT_ID to your Azure application ID
- Set CLIENT_SECRET to your Azure application secret - Set CLIENT_SECRET to your Azure application secret
- Set TENANT_ID to the Azure tenant ID of the customer that wants to use your application to access WDATP application - Set TENANT_ID to the Azure tenant ID of the customer that wants to use your application to access Windows Defender ATP application
- Run the below command: - Run the below command:
``` ```
@ -217,7 +217,7 @@ You will get an answer of the form:
Sanity check to make sure you got a correct token: Sanity check to make sure you got a correct token:
- Copy/paste into [JWT](https://jwt.ms) the token you get in the previous step in order to decode it - Copy/paste into [JWT](https://jwt.ms) the token you get in the previous step in order to decode it
- Validate you get a 'roles' claim with the desired permissions - Validate you get a 'roles' claim with the desired permissions
- In the screenshot below you can see a decoded token acquired from an app with permissions to all of Wdatp's roles: - In the screenshot below you can see a decoded token acquired from an app with permissions to all of Windows Defender ATP's roles:
![Image of token validation](images/webapp-decoded-token.png) ![Image of token validation](images/webapp-decoded-token.png)

View File

@ -48,7 +48,7 @@ Set-ExecutionPolicy -ExecutionPolicy Bypass
- Run the below - Run the below
> - $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant) > - $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
> - $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to WDATP) > - $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Windows Defender ATP)
> - $appSecret: Secret of your AAD app > - $appSecret: Secret of your AAD app
> - $suspiciousUrl: The URL > - $suspiciousUrl: The URL

View File

@ -21,7 +21,7 @@ ms.date: 12/08/2017
[!include[Prerelease information](prerelease.md)] [!include[Prerelease information](prerelease.md)]
Represent a file entity in WDATP. Represent a file entity in Windows Defender ATP.
# Methods # Methods
Method|Return Type |Description Method|Return Type |Description
@ -49,5 +49,5 @@ fileProductName | String | Product name.
signer | String | File signer. signer | String | File signer.
issuer | String | File issuer. issuer | String | File issuer.
signerHash | String | Hash of the signing certificate. signerHash | String | Hash of the signing certificate.
isValidCertificate | Boolean | Was signing certificate successfully verified by WDATP agent. isValidCertificate | Boolean | Was signing certificate successfully verified by Windows Defender ATP agent.

View File

@ -25,7 +25,7 @@ ms.date: 12/08/2017
[!include[Prerelease<73>information](prerelease.md)] [!include[Prerelease<73>information](prerelease.md)]
- Retrieves a collection of machines that have communicated with WDATP cloud on the last 30 days. - Retrieves a collection of machines that have communicated with Windows Defender ATP cloud on the last 30 days.
- Get Machines collection API supports [OData V4 queries](https://www.odata.org/documentation/). - Get Machines collection API supports [OData V4 queries](https://www.odata.org/documentation/).
- The OData's Filter query is supported on: "Id", "ComputerDnsName", "LastSeen", "LastIpAddress", "HealthStatus", "OsPlatform", "RiskScore", "MachineTags" and "RbacGroupId". - The OData's Filter query is supported on: "Id", "ComputerDnsName", "LastSeen", "LastIpAddress", "HealthStatus", "OsPlatform", "RiskScore", "MachineTags" and "RbacGroupId".
- See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md) - See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md)

View File

@ -57,7 +57,7 @@ When accessing [Windows Defender Security Center](https://SecurityCenter.Windows
1. Each time you access the portal you will need to validate that you are authorized to access the product. This **Set up your permissions** step will only be available if you are not currently authorized to access the product. 1. Each time you access the portal you will need to validate that you are authorized to access the product. This **Set up your permissions** step will only be available if you are not currently authorized to access the product.
![Image of Set up your permissions for WDATP](images\atp-setup-permissions-wdatp-portal.png) ![Image of Set up your permissions for Windows Defender ATP](images\atp-setup-permissions-wdatp-portal.png)
Once the authorization step is completed, the **Welcome** screen will be displayed. Once the authorization step is completed, the **Welcome** screen will be displayed.

View File

@ -14,10 +14,11 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: article ms.topic: article
ms.date: 11/11/2018
--- ---
# Machine resource type # Machine resource type
**Applies to:**
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
# Methods # Methods
@ -35,17 +36,17 @@ Property | Type | Description
:---|:---|:--- :---|:---|:---
id | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) identity. id | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) identity.
computerDnsName | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) fully qualified name. computerDnsName | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) fully qualified name.
firstSeen | DateTimeOffset | First date and time where the [machine](machine-windows-defender-advanced-threat-protection-new.md) was observed by WDATP. firstSeen | DateTimeOffset | First date and time where the [machine](machine-windows-defender-advanced-threat-protection-new.md) was observed by Windows Defender ATP.
lastSeen | DateTimeOffset | Last date and time where the [machine](machine-windows-defender-advanced-threat-protection-new.md) was observed by WDATP. lastSeen | DateTimeOffset | Last date and time where the [machine](machine-windows-defender-advanced-threat-protection-new.md) was observed by Windows Defender ATP.
osPlatform | String | OS platform. osPlatform | String | OS platform.
osVersion | String | OS Version. osVersion | String | OS Version.
lastIpAddress | String | Last IP on local NIC on the [machine](machine-windows-defender-advanced-threat-protection-new.md). lastIpAddress | String | Last IP on local NIC on the [machine](machine-windows-defender-advanced-threat-protection-new.md).
lastExternalIpAddress | String | Last IP through which the [machine](machine-windows-defender-advanced-threat-protection-new.md) accessed the internet. lastExternalIpAddress | String | Last IP through which the [machine](machine-windows-defender-advanced-threat-protection-new.md) accessed the internet.
agentVersion | String | Version of WDATP agent. agentVersion | String | Version of Windows Defender ATP agent.
osBuild | Nullable long | OS build number. osBuild | Nullable long | OS build number.
healthStatus | Enum | [machine](machine-windows-defender-advanced-threat-protection-new.md) health status. Possible values are: "Active", "Inactive", "ImpairedCommunication", "NoSensorData" and "NoSensorDataImpairedCommunication" healthStatus | Enum | [machine](machine-windows-defender-advanced-threat-protection-new.md) health status. Possible values are: "Active", "Inactive", "ImpairedCommunication", "NoSensorData" and "NoSensorDataImpairedCommunication"
rbacGroupId | Int | RBAC Group ID. rbacGroupId | Int | RBAC Group ID.
rbacGroupName | String | RBAC Group Name. rbacGroupName | String | RBAC Group Name.
riskScore | Nullable Enum | Risk score as evaluated by WDATP. Possible values are: 'None', 'Low', 'Medium' and 'High'. riskScore | Nullable Enum | Risk score as evaluated by Windows Defender ATP. Possible values are: 'None', 'Low', 'Medium' and 'High'.
aadDeviceId | Nullable Guid | AAD Device ID (when [machine](machine-windows-defender-advanced-threat-protection-new.md) is Aad Joined). aadDeviceId | Nullable Guid | AAD Device ID (when [machine](machine-windows-defender-advanced-threat-protection-new.md) is Aad Joined).
machineTags | String collection | Set of [machine](machine-windows-defender-advanced-threat-protection-new.md) tags. machineTags | String collection | Set of [machine](machine-windows-defender-advanced-threat-protection-new.md) tags.

View File

@ -20,7 +20,7 @@ ms.date: 12/08/2017
# MachineAction resource type # MachineAction resource type
**Applies to:** **Applies to:**
- Windows Defender Advanced Threat Protection (Windows Defender ATP) - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
[!include[Prerelease<73>information](prerelease.md)] [!include[Prerelease<73>information](prerelease.md)]
@ -35,7 +35,7 @@ Method|Return Type |Description
[Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Restrict application execution. [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Restrict application execution.
[Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Remove application execution restriction. [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Remove application execution restriction.
[Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Run an AV scan using Windows Defender (when applicable). [Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Run an AV scan using Windows Defender (when applicable).
[Offboard machine](offboard-machine-api-windows-defender-advanced-threat-protection-new.md)|[Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Offboard [machine](machine-windows-defender-advanced-threat-protection-new.md) from WDATP. [Offboard machine](offboard-machine-api-windows-defender-advanced-threat-protection-new.md)|[Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Offboard [machine](machine-windows-defender-advanced-threat-protection-new.md) from Windows Defender ATP.
# Properties # Properties
Property | Type | Description Property | Type | Description

View File

@ -3,4 +3,4 @@ ms.date: 08/28/2017
author: zavidor author: zavidor
--- ---
>[!Note] >[!Note]
> This page focuses on performing a machine action via API. See [take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) for more information about response actions functionality via WDATP. > This page focuses on performing a machine action via API. See [take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) for more information about response actions functionality via Windows Defender ATP.

View File

@ -14,16 +14,15 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: article ms.topic: article
ms.date: 12/08/2017
--- ---
# Offboard machine API # Offboard machine API
**Applies to:** **Applies to:**
- Windows Defender Advanced Threat Protection (Windows Defender ATP) - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
[!include[Prerelease<73>information](prerelease.md)] [!include[Prerelease<73>information](prerelease.md)]
Offboard machine from WDATP. Offboard machine from Windows Defender ATP.
[!include[Machine actions note](machineactionsnote.md)] [!include[Machine actions note](machineactionsnote.md)]

View File

@ -65,7 +65,7 @@ $aadToken = $response.access_token
where where
- $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant) - $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
- $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to WDATP) - $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Windows Defender ATP)
- $appSecret: Secret of your AAD app - $appSecret: Secret of your AAD app
## Run query ## Run query

View File

@ -65,7 +65,7 @@ aadToken = jsonResponse["access_token"]
where where
- tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant) - tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
- appId: ID of your AAD app (the app must have 'Run advanced queries' permission to WDATP) - appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Windows Defender ATP)
- appSecret: Secret of your AAD app - appSecret: Secret of your AAD app
## Run query ## Run query