mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 20:03:40 +00:00
s
This commit is contained in:
@ -22,7 +22,7 @@ ms.date: 09/24/2018
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
## Get Windows Defender ATP Alerts using a simple PowerShell script
|
||||
## Get Alerts using a simple PowerShell script
|
||||
|
||||
### How long it takes to go through this example?
|
||||
It only takes 5 minutes done in two steps:
|
||||
@ -40,7 +40,7 @@ For the App registration stage, you must have a Global administrator role in you
|
||||
|
||||

|
||||
|
||||
3. In the Create window, enter the following information then click **Create**.
|
||||
3. In the registration form, enter the following information then click **Create**.
|
||||
|
||||
- **Name:** Choose your own name.
|
||||
- **Application type:** Web app / API
|
||||
@ -48,6 +48,55 @@ For the App registration stage, you must have a Global administrator role in you
|
||||
|
||||

|
||||
|
||||
4. Allow to App to access Windows Defender ATP and assign it 'Read all alerts' permission:
|
||||
|
||||
- Click **Settings** > **Required permissions** > **Add**.
|
||||
|
||||

|
||||
|
||||
- Click **Select an API** > **WindowsDefenderATP**, then click **Select**.
|
||||
|
||||
**Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear.
|
||||
|
||||

|
||||
|
||||
- Click **Select permissions** > **Read all alerts** > **Select**.
|
||||
|
||||

|
||||
|
||||
- Click **Done**
|
||||
|
||||

|
||||
|
||||
- Click **Grant permissions**
|
||||
|
||||
**Note**: Every time you add permission you must click on **Grant permissions**.
|
||||
|
||||

|
||||
|
||||
5. Create a key for your App:
|
||||
|
||||
- Click **Keys**, type a key name and click **Save**.
|
||||
|
||||

|
||||
|
||||
6. Write down your App ID and your Tenant ID:
|
||||
|
||||
- App ID:
|
||||
|
||||

|
||||
|
||||
- Tenant ID: Navigate to **Azure Active Directory** > **Properties**
|
||||
|
||||

|
||||
|
||||
|
||||
Done! You have successfully registered an application!
|
||||
|
||||
### Step 2 - Get a token using the App and use this token to access the API.
|
||||
|
||||
-
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
|
@ -53,7 +53,7 @@ You can access Windows Defender ATP API with **Application Context** or **User C
|
||||
Steps that needs to be taken to access Windows Defender ATP API with application context:
|
||||
1) Create AAD Native-Application.
|
||||
2) Assign the desired permission to the application, e.g 'Read Alerts', 'Isolate Machines' etc.
|
||||
3) Get token using the application with and user credentials.
|
||||
3) Get token using the application with user credentials.
|
||||
4) Use the token to access Windows Defender ATP API
|
||||
|
||||
See - [Get access with user context](exposed-apis-create-app-nativeapp.md).
|
||||
|
@ -94,7 +94,7 @@ This page explains how to create an app, get an access token to Windows Defender
|
||||
|
||||

|
||||
|
||||
9. Click **Keys** and type a key name and click **Save**.
|
||||
9. Click **Keys**, type a key name and click **Save**.
|
||||
|
||||
**Important**: After you save, **copy the key value**. You won't be able to retrieve after you leave!
|
||||
|
||||
|
Binary file not shown.
After Width: | Height: | Size: 180 KiB |
Binary file not shown.
After Width: | Height: | Size: 62 KiB |
Binary file not shown.
After Width: | Height: | Size: 30 KiB |
Reference in New Issue
Block a user