deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-23 14:23:38 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
Files
c19fa00cc3ec2d444be06aec695c70a841f15c40
windows-itpro-docs/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts.md
Ben Alfasi 895143b9cc files
2020-01-06 15:44:52 +02:00

2.5 KiB
Raw Blame History

title, description, keywords, search.product, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic
title description keywords search.product ms.prod ms.mktglfcycl ms.sitesec ms.pagetype ms.author author ms.localizationpriority manager audience ms.collection ms.topic
Get file related alerts API Retrieves a collection of alerts related to a given file hash. apis, graph api, supported apis, get, file, hash eADQiWindows 10XVcnh w10 deploy library security macapara mjcaparas medium dansimp ITPro M365-security-compliance article

Get file related alerts API

Applies to: Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

API description

Retrieves a collection of alerts related to a given file hash.

Limitations

  1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

Permissions

One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Use Microsoft Defender ATP APIs

Permission type Permission Permission display name
Application Alert.Read.All 'Read all alerts'
Application Alert.ReadWrite.All 'Read and write all alerts'
Delegated (work or school account) Alert.Read 'Read alerts'
Delegated (work or school account) Alert.ReadWrite 'Read and write alerts'

Note

When obtaining a token using user credentials:

  • The user needs to have at least the following role permission: 'View Data' (See Create and manage roles for more information)
  • Response will include only alerts, associated with machines, that the user have access to, based on machine group settings (See Create and manage machine groups for more information)

HTTP request

GET /api/files/{id}/alerts

Request headers

Name Type Description
Authorization String Bearer {token}. Required.

Request body

Empty

Response

If successful and file exists - 200 OK with list of alert entities in the body. If file do not exist - 404 Not Found.

Example

Request

Here is an example of the request.

[!includeImprove request performance]

GET https://api.securitycenter.windows.com/api/files/6532ec91d513acc05f43ee0aa3002599729fd3e1/alerts