mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 20:33:42 +00:00
update image
This commit is contained in:
Joey Caparas
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Find machine information by interal IP API
|
||||
description: Use this API to create calls related to finding a machine entry around a specific timestamp by FQDN or interal IP.
|
||||
keywords: apis, graph api, supported apis, find machine, machine information, IP
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Find machine information by interal IP
|
||||
Find a machine entity around a specific timestamp by FQDN or internal IP.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machines/find(timestamp={time},key={IP/FQDN})
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and machine exists - 200 OK.
|
||||
If no machine found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machines/find(timestamp={time},key={IP/FQDN})
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "04c99d46599f078f1c3da3783cf5b95f01ac61bb",
|
||||
"computerDnsName": "",
|
||||
"firstSeen": "2017-07-06T01:25:04.9480498Z",
|
||||
"osPlatform": "Windows10",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Get actor information API
|
||||
description: Retrieves an actor information report.
|
||||
keywords: apis, graph api, supported apis, get, actor, information
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get Actor Information
|
||||
Retrieves an actor information report.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/actor/{id}/
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and actor exists - 200 OK.
|
||||
If actor does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/actors/zinc
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Actors/$entity",
|
||||
"id": "zinc",
|
||||
"linkToReport": "link-to-pdf"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Get actor related alerts API
|
||||
description: Retrieves all alerts related to a given actor.
|
||||
keywords: apis, graph api, supported apis, get, actor, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get actor related alerts
|
||||
Retrieves all alerts related to a given actor.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/actor/{id}/alerts
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert exists - 200 OK.
|
||||
If actor does not exist or no related alerts - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/actors/zinc/alerts
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts",
|
||||
"@odata.count": 3,
|
||||
"value": [
|
||||
{
|
||||
"id": "636390437845006321_-1646055784",
|
||||
"severity": "Medium",
|
||||
"status": "Resolved",
|
||||
"description": "Malware associated with ZINC has been detected.",
|
||||
"recommendedAction": "1.\tContact your incident response team.",
|
||||
"alertCreationTime": "2017-08-23T00:09:43.9057955Z",
|
||||
"category": "Malware",
|
||||
"title": "Malware associated with the activity group ZINC was discovered",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Get alert information by ID API
|
||||
description: Retrieves an alert by its ID.
|
||||
keywords: apis, graph api, supported apis, get, alert, information, id
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alert information by ID
|
||||
Retrieves an alert by its ID.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert exists - 200 OK.
|
||||
If alert not found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts/{id}
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts/$entity",
|
||||
"id": "636396039176847743_89954699",
|
||||
"severity": "Informational",
|
||||
"status": "New",
|
||||
"description": "Readily available tools, such as commercial spyware, monitoring software, and hacking programs",
|
||||
"recommendedAction": "Collect artifacts and determine scope.",
|
||||
"alertCreationTime": "2017-08-29T11:45:17.5754165Z",
|
||||
…
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,69 @@
|
||||
---
|
||||
title: Get alert related actor information API
|
||||
description: Retrieves the actor information related to the specific alert.
|
||||
keywords: apis, graph api, supported apis, get, alert, actor, information, related
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alert related actor information
|
||||
Retrieves the actor information related to the specific alert.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts/{id}/actor
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert and actor exist - 200 OK.
|
||||
If alert not found or actor not found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts/{id}/actor
|
||||
Content-type: application/json
|
||||
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Actors/$entity",
|
||||
"id": "zinc",
|
||||
"linkToReport": "link-to-pdf"
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,71 @@
|
||||
---
|
||||
title: Get alert related domain information
|
||||
description: Retrieves all domains related to a specific alert.
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related domain
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alert related domain information
|
||||
Retrieves all domains related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts/{id}/domains
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert and domain exist - 200 OK.
|
||||
If alert not found or domain not found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts/{id}/domains
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Domains",
|
||||
"value": [
|
||||
{
|
||||
"host": "www.walla.co.il"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Get alert related files information
|
||||
description: Retrieves all files related to a specific alert.
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related files
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alert related files information
|
||||
Retrieves all files related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts/{id}/files
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert and files exist - 200 OK.
|
||||
If alert not found or files not found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts/{id}/files
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Files",
|
||||
"value": [
|
||||
{
|
||||
"sha1": "121c7060dada38275d7082a4b9dc62641b255c36",
|
||||
"sha256": "c815e0abb8273ba4ea6ca92d430d9e4d065dbb52877a9ce6a8371e5881bd7a94",
|
||||
"md5": "776c970dfd92397b3c7d74401c85cd40",
|
||||
"globalPrevalence": null,
|
||||
"globalFirstObserved": null,
|
||||
…
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Get alert related IP information
|
||||
description: Retrieves all IPs related to a specific alert.
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related ip
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alert related domain information
|
||||
Retrieves all IPs related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts/{id}/ips
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert and an IP exist - 200 OK.
|
||||
If alert not found or IPs not found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts/{id}/ips
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Ips",
|
||||
"value": [
|
||||
{
|
||||
"id": "104.80.104.128"
|
||||
},
|
||||
{
|
||||
"id": "23.203.232.228
|
||||
…
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
title: Get alert related machine information
|
||||
description: Retrieves all machines related to a specific alert.
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related machine
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alert related machine information
|
||||
Retrieves all machines related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts/{id}/machine
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert and machine exist - 200 OK.
|
||||
If alert not found or machine not found - 404 Not Found.
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts/{id}/machine
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines/$entity",
|
||||
"id": "207575116e44741d2b22b6a81429b3ca4fd34608",
|
||||
"computerDnsName": "minint-8qke471.europe.corp.microsoft.com",
|
||||
"firstSeen": "2015-12-01T11:31:53.7016691Z",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,71 @@
|
||||
---
|
||||
title: Get alert related user information
|
||||
description: Retrieves the user associated to a specific alert.
|
||||
keywords: apis, graph api, supported apis, get, alert, information, related, user
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alert related user information
|
||||
Retrieves the user associated to a specific alert.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts/{id}/user
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alert and a user exists - 200 OK.
|
||||
If alert not found or user not found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts/{id}/user
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Users/$entity",
|
||||
"id": "UserPII_487a7e2aa8b0a24e429b0be88e5cf5e91be1a8f4\\DomainPII_aca88e6ed7dc68a69c35019ca947745f3858c868",
|
||||
"accountSid": null,
|
||||
"accountName": "DomainPII_aca88e6ed7dc68a69c35019ca947745f3858c868",
|
||||
"accountDomainName": "UserPII_487a7e2aa8b0a24e429b0be88e5cf5e91be1a8f4",
|
||||
…
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,75 @@
|
||||
---
|
||||
title: Get alerts API
|
||||
description: Retrieves top recent alerts.
|
||||
keywords: apis, graph api, supported apis, get, alerts, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get alerts
|
||||
Retrieves top recent alerts.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/alerts
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and alerts exists - 200 OK.
|
||||
If no recent alerts found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/alerts
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts",
|
||||
"@odata.count": 5000,
|
||||
"@odata.nextLink": "https://graph.microsoft.com/testwdatppreview/alerts?$skip=5000",
|
||||
"value": [
|
||||
{
|
||||
"id": "636396039176847743_89954699",
|
||||
"severity": "Informational",
|
||||
"status": "New",
|
||||
"description": "Readily available tools, such as commercial spyware, monitoring software, and hacking programs",
|
||||
"recommendedAction": "Collect artifacts and determine scope",
|
||||
"alertCreationTime": "2017-08-29T11:45:17.5754165Z",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Get domain related alerts API
|
||||
description: Retrieves a collection of alerts related to a given domain address.
|
||||
keywords: apis, graph api, supported apis, get, domain, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get domain related alerts
|
||||
Retrieves a collection of alerts related to a given domain address.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/domains/{id}/alerts
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and domain and alert exists - 200 OK.
|
||||
If domain or alert does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/domains/{id}/alerts
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts",
|
||||
"@odata.count": 9,
|
||||
"value": [
|
||||
{
|
||||
"id": "636396023170943366_-36088267",
|
||||
"severity": "Medium",
|
||||
"status": "New",
|
||||
"description": "Built-in Microsoft command-line utility Regsvr32.exe executes a suspicious script that leads to malicious actions. The commands trigger additional downloads and execution of uncommon executable (PE) files or scripts. There are rare cases where this is tied to legitimate behavior.",
|
||||
"recommendedAction": "Update AV signatures and run a full scan.",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Get domain related machines API
|
||||
description: Retrieves a collection of machines related to a given domain address.
|
||||
keywords: apis, graph api, supported apis, get, domain, related, machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get domain related machines
|
||||
Retrieves a collection of machines related to a given domain address.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/domains/{id}/machines
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and domain and machine exists - 200 OK.
|
||||
If domain or machines do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/domains/{id}/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "0a3250e0693a109f1affc9217be9459028aa8426",
|
||||
"computerDnsName": "ComputerPII_4aa5f8f4509b90675a13183742f1b1ad67cf62b0.DomainPII_23208d0fe863968308c0c8e67dc0004bd1257631",
|
||||
"firstSeen": "2017-07-05T08:21:00.0572159Z",
|
||||
"osPlatform": "Windows10",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,69 @@
|
||||
---
|
||||
title: Get domain statistics API
|
||||
description: Retrieves the prevalence for the given domain.
|
||||
keywords: apis, graph api, supported apis, get, domain, domain related machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get domain statistics
|
||||
Retrieves the prevalence for the given domain.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/domains/{id}/stats
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and domain exists - 200 OK.
|
||||
If domain does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/domains/{id}/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#microsoft.graph.InOrgDomainStats",
|
||||
"host": "walla.com",
|
||||
"orgPrevalence": "4070",
|
||||
"orgFirstSeen": "2017-07-30T13:23:48Z",
|
||||
"orgLastSeen": "2017-08-29T13:09:05Z"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,70 @@
|
||||
---
|
||||
title: Get file information API
|
||||
description: Retrieves a file by identifier Sha1, Sha256, or MD5.
|
||||
keywords: apis, graph api, supported apis, get, file, information, sha1, sha256, md5
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get file information
|
||||
Retrieves a file by identifier Sha1, Sha256, or MD5.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/files/{id}/
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and file exists - 200 OK.
|
||||
If file does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/files/{id}
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Files/$entity",
|
||||
"sha1": "adae3732709d2178c8895c9be39c445b5e76d587",
|
||||
"sha256": "34fcb083cd01b1bd89fc467fd3c2cd292de92f915a5cb43a36edaed39ce2689a",
|
||||
"md5": "d387a06cd4bf5fcc1b50c3882f41a44e",
|
||||
"globalPrevalence": 40790196,
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Get file related alerts API
|
||||
description: Retrieves a collection of alerts related to a given file hash.
|
||||
keywords: apis, graph api, supported apis, get, file, hash
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get file related alerts
|
||||
Retrieves a collection of alerts related to a given file hash.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/files/{id}/alerts
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and file and alert exists - 200 OK.
|
||||
If file or alerts do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/files/{id}/alerts
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts",
|
||||
"@odata.count": 9,
|
||||
"value": [
|
||||
{
|
||||
"id": "636396023170943366_-36088267",
|
||||
"severity": "Medium",
|
||||
"status": "New",
|
||||
"description": "Built-in Microsoft command-line utility Regsvr32.exe executes a suspicious script that leads to malicious actions. The commands trigger additional downloads and execution of uncommon executable (PE) files or scripts. There are rare cases where this is tied to legitimate behavior.",
|
||||
"recommendedAction": "Update AV signatures and run a full scan.",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Get file related machines API
|
||||
description: Retrieves a collection of machines related to a given file hash.
|
||||
keywords: apis, graph api, supported apis, get, machines, hash
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get file related machines
|
||||
Retrieves a collection of machines related to a given file hash.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/files/{id}/machines
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and file and machines exists - 200 OK.
|
||||
If file or machines do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/files/{id}/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "0a3250e0693a109f1affc9217be9459028aa8426",
|
||||
"computerDnsName": "ComputerPII_4aa5f8f4509b90675a13183742f1b1ad67cf62b0.DomainPII_23208d0fe863968308c0c8e67dc0004bd1257631",
|
||||
"firstSeen": "2017-07-05T08:21:00.0572159Z",
|
||||
"osPlatform": "Windows10",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Get file statistics API
|
||||
description: Retrieves the prevalence for the given file.
|
||||
keywords: apis, graph api, supported apis, get, file, statistics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get file statistics
|
||||
Retrieves the prevalence for the given file.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/files/{id}/stats
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and file exists - 200 OK.
|
||||
If file do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/files/{id}/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#microsoft.windowsDefenderATP.api.InOrgFileStats",
|
||||
"sha1": "adae3732709d2178c8895c9be39c445b5e76d587",
|
||||
"orgPrevalence": "106398",
|
||||
"orgFirstSeen": "2017-07-30T13:29:50Z",
|
||||
"orgLastSeen": "2017-08-29T13:29:31Z",
|
||||
"topFileNames": [
|
||||
"chrome.exe",
|
||||
"old_chrome.exe"
|
||||
]
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Get IP related alerts API
|
||||
description: Retrieves a collection of alerts related to a given IP address.
|
||||
keywords: apis, graph api, supported apis, get, ip, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get IP related alerts
|
||||
Retrieves a collection of alerts related to a given IP address.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/ips/{id}/alerts
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and IP and alert exists - 200 OK.
|
||||
If IP and alerts do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/ips/{id}/alerts
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts",
|
||||
"@odata.count": 9,
|
||||
"value": [
|
||||
{
|
||||
"id": "636396023170943366_-36088267",
|
||||
"severity": "Medium",
|
||||
"status": "New",
|
||||
"description": "Built-in Microsoft command-line utility Regsvr32.exe executes a suspicious script that leads to malicious actions. The commands trigger additional downloads and execution of uncommon executable (PE) files or scripts. There are rare cases where this is tied to legitimate behavior.",
|
||||
"recommendedAction": "Update AV signatures and run a full scan.",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Get IP related machines API
|
||||
description: Retrieves a collection of machines related to a given IP address.
|
||||
keywords: apis, graph api, supported apis, get, ip, related, machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get IP related machines
|
||||
Retrieves a collection of alerts related to a given IP address.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/ips/{id}/machines
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and IP and machines exists - 200 OK.
|
||||
If IP or machines do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/ips/{id}/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "0a3250e0693a109f1affc9217be9459028aa8426",
|
||||
"computerDnsName": "ComputerPII_4aa5f8f4509b90675a13183742f1b1ad67cf62b0.DomainPII_23208d0fe863968308c0c8e67dc0004bd1257631",
|
||||
"firstSeen": "2017-07-05T08:21:00.0572159Z",
|
||||
"osPlatform": "Windows10",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,69 @@
|
||||
---
|
||||
title: Get IP statistics API
|
||||
description: Retrieves the prevalence for the given IP.
|
||||
keywords: apis, graph api, supported apis, get, ip, statistics, prevalence
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get IP statistics
|
||||
Retrieves the prevalence for the given IP.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/ips/{id}/stats
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and IP and domain exists - 200 OK.
|
||||
If domain does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/ips/{id}/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#microsoft.windowsDefenderATP.api.InOrgIPStats",
|
||||
"ipAddress": "192.168.1.1",
|
||||
"orgPrevalence": "63515",
|
||||
"orgFirstSeen": "2017-07-30T13:36:06Z",
|
||||
"orgLastSeen": "2017-08-29T13:32:59Z"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Get machine by ID API
|
||||
description: Retrieves a machine entity by ID.
|
||||
keywords: apis, graph api, supported apis, get, machines, entity, id
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get machines
|
||||
Retrieves a machine entity by ID.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machines/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and machine exists - 200 OK.
|
||||
If no machine found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machines/{id}
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines/$entity",
|
||||
"id": "fadd8a46f4cc722a0391fdee82a7503b9591b3b9",
|
||||
"computerDnsName": "",
|
||||
"firstSeen": "2015-03-15T00:18:20.6588778Z",
|
||||
"osPlatform": "Windows10",
|
||||
"osVersion": "10.0.0.0",
|
||||
…
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,71 @@
|
||||
---
|
||||
title: Get machine log on users API
|
||||
description: Retrieves a collection of logged on users.
|
||||
keywords: apis, graph api, supported apis, get, machine, log on, users
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get machine log on users
|
||||
Retrieves a collection of logged on users.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machines/{id}/logonusers
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and machine and user exist - 200 OK.
|
||||
If no machine found or no users found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machines/{id}/logonusers
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Users",
|
||||
"value": [
|
||||
{
|
||||
"id": "m",
|
||||
"accountSid": null,
|
||||
"accountName": "",
|
||||
"accountDomainName": "northamerica",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Get machine related alerts API
|
||||
description: Retrieves a collection of alerts related to a given machine ID.
|
||||
keywords: apis, graph api, supported apis, get, machines, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get machine related alerts
|
||||
Retrieves a collection of alerts related to a given machine ID.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machines/{id}/alerts
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and machine and alert exists - 200 OK.
|
||||
If no machine or no alerts found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machines/{id}/alerts
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts",
|
||||
"@odata.count": 1,
|
||||
"value": [
|
||||
{
|
||||
"id": "636396066728379047_-395412459",
|
||||
"severity": "Medium",
|
||||
"status": "New",
|
||||
"description": "A reverse shell created from PowerShell was detected. A reverse shell allows an attacker to access the compromised machine without authenticating.",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
title: Get machines API
|
||||
description: Retrieves a collection of recently seen machines.
|
||||
keywords: apis, graph api, supported apis, get, machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get machines
|
||||
Retrieves a collection of recently seen machines.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machines
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and machines exists - 200 OK.
|
||||
If no recent machines - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"@odata.count": 5000,
|
||||
"@odata.nextLink": "https://graph.microsoft.com/testwdatppreview/machines?$skip=5000",
|
||||
"value": [
|
||||
{
|
||||
"id": "fadd8a46f4cc722a0391fdee82a7503b9591b3b9",
|
||||
"computerDnsName": "",
|
||||
"firstSeen": "2015-03-15T00:18:20.6588778Z",
|
||||
"osPlatform": "Windows10",
|
||||
"osVersion": "10.0.0.0",
|
||||
…
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,70 @@
|
||||
---
|
||||
title: Get user information API
|
||||
description: Retrieve a User entity by key such as user name or domain.
|
||||
keywords: apis, graph api, supported apis, get, user, user information
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get user information
|
||||
Retrieve a User entity by key (user name or domain\user).
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/users/{id}/
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and user exists - 200 OK.
|
||||
If user does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/users/{id}
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Users/$entity",
|
||||
"id": "",
|
||||
"accountSid": null,
|
||||
"accountName": "",
|
||||
"accountDomainName": "",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Get user related alerts API
|
||||
description: Retrieves a collection of alerts related to a given user ID.
|
||||
keywords: apis, graph api, supported apis, get, user, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get user related alerts
|
||||
Retrieves a collection of alerts related to a given user ID.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/users/{id}/alerts
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and user and alert exists - 200 OK.
|
||||
If user does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/users/{id}/alerts
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Alerts",
|
||||
"@odata.count": 9,
|
||||
"value": [
|
||||
{
|
||||
"id": "636396023170943366_-36088267",
|
||||
"severity": "Medium",
|
||||
"status": "New",
|
||||
"description": "Built-in Microsoft command-line utility Regsvr32.exe executes a suspicious script that leads to malicious actions. The commands trigger additional downloads and execution of uncommon executable (PE) files or scripts. There are rare cases where this is tied to legitimate behavior.",
|
||||
"recommendedAction": "Update AV signatures and run a full scan.",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Get user related machines API
|
||||
description: Retrieves a collection of alerts related to a given user ID.
|
||||
keywords: apis, graph api, supported apis, get, user, user related alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get user related alerts
|
||||
Retrieves a collection of alerts related to a given user ID.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/users/{id}/machines
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and user and machine exists - 200 OK.
|
||||
If user or machine does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/users/{id}/machines
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "0a3250e0693a109f1affc9217be9459028aa8426",
|
||||
"computerDnsName": "ComputerPII_4aa5f8f4509b90675a13183742f1b1ad67cf62b0.DomainPII_23208d0fe863968308c0c8e67dc0004bd1257631",
|
||||
"firstSeen": "2017-07-05T08:21:00.0572159Z",
|
||||
"osPlatform": "Windows10",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,66 @@
|
||||
---
|
||||
title: Is domain seen in org API
|
||||
description: Use this API to create calls related to checking whether a domain was seen in the organization.
|
||||
keywords: apis, graph api, supported apis, domain, domain seen
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Is domain seen in org
|
||||
Answers whether a domain was seen in the organization.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/domains/{id}/
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and domain exists - 200 OK.
|
||||
If domain does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/domains/{id}
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Domains/$entity",
|
||||
"host": "walla.com"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,66 @@
|
||||
---
|
||||
title: Is IP seen in org API
|
||||
description: Answers whether an IP was seen in the organization.
|
||||
keywords: apis, graph api, supported apis, is, ip, seen, org, organization
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Is IP seen in org
|
||||
Answers whether an IP was seen in the organization.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/ips/{id}/
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and IP exists - 200 OK.
|
||||
If IP do not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/ips/{id}
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Ips/$entity",
|
||||
"id": "192.168.1.1"
|
||||
}
|
||||
```
|
||||
@ -66,7 +66,7 @@ Clicking **View machines** in a specific recommendation opens up the **Machines
|
||||
|
||||
The following image shows an example list of machines where the EDR sensor is not turned on.
|
||||
|
||||
|
||||
|
||||
|
||||
### Endpoint detection and response (EDR) optimization
|
||||
This tile provides a specific list of actions you can take on Windows Defender ATP to improve how endpoints provide sensor data to the Windows Defender ATP service.
|
||||
|
||||
Reference in New Issue
Block a user