windows-itpro-docs/windows/security/threat-protection/microsoft-defender-atp/machine.md

title, description, keywords, search.product, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic

title	description	keywords	search.product	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	ms.author	author	ms.localizationpriority	manager	audience	ms.collection	ms.topic
Machine resource type	Retrieves top machines	apis, supported apis, get, machines	eADQiWindows 10XVcnh	w10	deploy	library	security	macapara	mjcaparas	medium	dansimp	ITPro	M365-security-compliance	article

Machine resource type

Applies to:

• Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

Methods

Method	Return Type	Description
List machines	machine collection	List set of machine entities in the org.
Get machine	machine	Get a machine by its identity.
Get logged on users	user collection	Get the set of User that logged on to the machine.
Get related alerts	alert collection	Get the set of alert entities that were raised on the machine.
Add or Remove machine tags	machine	Add or Remove tag to a specific machine.
Find machines by IP	machine collection	Find machines seen with IP.

Properties

Property	Type	Description
id	String	machine identity.
computerDnsName	String	machine fully qualified name.
firstSeen	DateTimeOffset	First date and time where the machine was observed by Microsoft Defender ATP.
lastSeen	DateTimeOffset	Last date and time where the machine was observed by Microsoft Defender ATP.
osPlatform	String	OS platform.
osVersion	String	OS Version.
lastIpAddress	String	Last IP on local NIC on the machine.
lastExternalIpAddress	String	Last IP through which the machine accessed the internet.
agentVersion	String	Version of Microsoft Defender ATP agent.
osBuild	Nullable long	OS build number.
healthStatus	Enum	machine health status. Possible values are: "Active", "Inactive", "ImpairedCommunication", "NoSensorData" and "NoSensorDataImpairedCommunication"
rbacGroupId	Int	RBAC Group ID.
rbacGroupName	String	RBAC Group Name.
riskScore	Nullable Enum	Risk score as evaluated by Microsoft Defender ATP. Possible values are: 'None', 'Low', 'Medium' and 'High'.
aadDeviceId	Nullable Guid	AAD Device ID (when machine is Aad Joined).
machineTags	String collection	Set of machine tags.