deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 05:17:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
windows-itpro-docs/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md
Dani Halfin 8a5f22ba03 last wave of fixes for this one
2019-08-09 15:09:53 -07:00

8.4 KiB
Raw Blame History

title, ms.reviewer, description, keywords, search.product, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic
title ms.reviewer description keywords search.product ms.prod ms.mktglfcycl ms.sitesec ms.pagetype ms.author author ms.localizationpriority manager audience ms.collection ms.topic
OData queries with Microsoft Defender ATP OData queries with Microsoft Defender ATP apis, supported apis, odata, query eADQiWindows 10XVcnh w10 deploy library security macapara mjcaparas medium dansimp ITPro M365-security-compliance article

OData queries with Microsoft Defender ATP

Applies to:

If you are not familiar with OData queries, see: OData V4 queries

Not all properties are filterable.

Properties that supports $filter:

  • Alert: Id, IncidentId, AlertCreationTime, Status, Severity and Category.
  • Machine: Id, ComputerDnsName, LastSeen, LastIpAddress, HealthStatus, OsPlatform, RiskScore, MachineTags and RbacGroupId.
  • MachineAction: Id, Status, MachineId, Type, Requestor and CreationDateTimeUtc.

Example 1

  • Get all the machines with the tag 'ExampleTag'
HTTP GET  https://api.securitycenter.windows.com/api/machines?$filter=machineTags/any(tag: tag eq 'ExampleTag')

Response:

HTTP/1.1 200 OK
Content-type: application/json
{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
    "value": [
        {
            "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
            "computerDnsName": "mymachine1.contoso.com",
            "firstSeen": "2018-08-02T14:55:03.7791856Z",
            "lastSeen": "2018-08-02T14:55:03.7791856Z",
            "osPlatform": "Windows10",
            "osVersion": "10.0.0.0",
            "lastIpAddress": "172.17.230.209",
            "lastExternalIpAddress": "167.220.196.71",
            "agentVersion": "10.5830.18209.1001",
            "osBuild": 18209,
            "healthStatus": "Active",
            "rbacGroupId": 140,
            "rbacGroupName": "The-A-Team",
            "riskScore": "High",
            "aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9",
            "machineTags": [ "test tag 1", "test tag 2", "ExampleTag" ]
        },
        .
        .
        .
    ]
}

Example 2

  • Get all the alerts that created after 2018-10-20 00:00:00
HTTP GET  https://api.securitycenter.windows.com/api/alerts?$filter=alertCreationTime gt 2018-11-22T00:00:00Z

Response:

HTTP/1.1 200 OK
Content-type: application/json
{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts",
    "value": [
        {
            "id": "121688558380765161_2136280442",
            "incidentId": 7696,
            "assignedTo": "secop@contoso.com",
            "severity": "High",
            "status": "New",
            "classification": "TruePositive",
            "determination": "Malware",
            "investigationState": "Running",
            "category": "MalwareDownload",
            "detectionSource": "WindowsDefenderAv",
            "threatFamilyName": "Mikatz",
            "title": "Windows Defender AV detected 'Mikatz', high-severity malware",
            "description": "Some description",
            "alertCreationTime": "2018-11-26T16:19:21.8409809Z",
            "firstEventTime": "2018-11-26T16:17:50.0948658Z",
            "lastEventTime": "2018-11-26T16:18:01.809871Z",
            "resolvedTime": null,
            "machineId": "9d80fbbc1bdbc5ce968f1d37c72384cbe17ee337"
        },
        .
        .
        .
    ]
}

Example 3

  • Get all the machines with 'High' 'RiskScore'
HTTP GET  https://api.securitycenter.windows.com/api/machines?$filter=riskScore eq 'High'

Response:

HTTP/1.1 200 OK
Content-type: application/json
{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
    "value": [
        {
            "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
            "computerDnsName": "mymachine1.contoso.com",
            "firstSeen": "2018-08-02T14:55:03.7791856Z",
            "lastSeen": "2018-08-02T14:55:03.7791856Z",
            "osPlatform": "Windows10",
            "osVersion": "10.0.0.0",
            "lastIpAddress": "172.17.230.209",
            "lastExternalIpAddress": "167.220.196.71",
            "agentVersion": "10.5830.18209.1001",
            "osBuild": 18209,
            "healthStatus": "Active",
            "rbacGroupId": 140,
            "rbacGroupName": "The-A-Team",
            "riskScore": "High",
            "aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9",
            "machineTags": [ "test tag 1", "test tag 2", "ExampleTag" ]
        },
        .
        .
        .
    ]
}

Example 4

  • Get top 100 machines with 'HealthStatus' not equals to 'Active'
HTTP GET  https://api.securitycenter.windows.com/api/machines?$filter=healthStatus ne 'Active'&$top=100

Response:

HTTP/1.1 200 OK
Content-type: application/json
{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
    "value": [
        {
            "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
            "computerDnsName": "mymachine1.contoso.com",
            "firstSeen": "2018-08-02T14:55:03.7791856Z",
            "lastSeen": "2018-08-02T14:55:03.7791856Z",
            "osPlatform": "Windows10",
            "osVersion": "10.0.0.0",
            "lastIpAddress": "172.17.230.209",
            "lastExternalIpAddress": "167.220.196.71",
            "agentVersion": "10.5830.18209.1001",
            "osBuild": 18209,
            "healthStatus": "Active",
            "rbacGroupId": 140,
            "rbacGroupName": "The-A-Team",
            "riskScore": "High",
            "aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9",
            "machineTags": [ "test tag 1", "test tag 2", "ExampleTag" ]
        },
        .
        .
        .
    ]
}

Example 5

  • Get all the machines that last seen after 2018-10-20
HTTP GET  https://api.securitycenter.windows.com/api/machines?$filter=lastSeen gt 2018-08-01Z

Response:

HTTP/1.1 200 OK
Content-type: application/json
{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
    "value": [
        {
            "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
            "computerDnsName": "mymachine1.contoso.com",
            "firstSeen": "2018-08-02T14:55:03.7791856Z",
            "lastSeen": "2018-08-02T14:55:03.7791856Z",
            "osPlatform": "Windows10",
            "osVersion": "10.0.0.0",
            "lastIpAddress": "172.17.230.209",
            "lastExternalIpAddress": "167.220.196.71",
            "agentVersion": "10.5830.18209.1001",
            "osBuild": 18209,
            "healthStatus": "Active",
            "rbacGroupId": 140,
            "rbacGroupName": "The-A-Team",
            "riskScore": "High",
            "aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9",
            "machineTags": [ "test tag 1", "test tag 2", "ExampleTag" ]
        },
        .
        .
        .
    ]
}

Example 6

HTTP GET  https://api.securitycenter.windows.com/api/machineactions?$filter=requestor eq 'Analyst@WcdTestPrd.onmicrosoft.com' and type eq 'RunAntiVirusScan'

Response:

HTTP/1.1 200 OK
Content-type: application/json
{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions",
    "value": [
        {
            "id": "5c3e3322-d993-1234-1111-dfb136ebc8c5",
            "type": "RunAntiVirusScan",
            "requestor": "Analyst@examples.onmicrosoft.com",
            "requestorComment": "1533",
            "status": "Succeeded",
            "machineId": "123321c10e44a82877af76b1d0161a17843f688a",
            "creationDateTimeUtc": "2018-11-12T13:33:24.5755657Z",
            "lastUpdateDateTimeUtc": "2018-11-12T13:34:32.0319826Z",
            "relatedFileInfo": null
        },
        .
        .
        .
    ]
}

Example 7

  • Get the count of open alerts for a specific machine:
HTTP GET  https://api.securitycenter.windows.com/api/machines/123321d0c675eaa415b8e5f383c6388bff446c62/alerts/$count?$filter=status ne 'Resolved'

Response:

HTTP/1.1 200 OK
Content-type: application/json

4

Related topic