Windows Defender Advanced Threat Protection Deprecated

Deprecated. Use the Microsoft Defender for Endpoint pack instead.

Endpoint · Windows Defender Advanced Threat Protection (Deprecated)

Details

IDWindows Defender Advanced Threat Protection
ProviderMicrosoft
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/crypto:1.0.0.3539024
Supported ModulesAgentix

Configuration parameters

  • url — Host URL (e.g. https://api.securitycenter.windows.com) (required)
  • auth_id — ID (received from the admin consent - see Detailed Instructions (?) (required)
  • tenant_id — Token (received from the admin consent - see Detailed Instructions (?) section) (required)
  • enc_key — Key (received from the admin consent - see Detailed Instructions (?) (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • fetch_status — Status to filter out alerts for fetching as incidents. The property values are: New,InProgress,Resolved (Comma separated values supported, e.g. New,Resolved)
  • fetch_severity — Severity to filter out alerts for fetching as incidents. The property values are: Informational,Low,Medium,High (Comma separated values supported, e.g. Medium,High)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (11)

  • microsoft-atp-advanced-hunting Deprecated

    Allows you to run programmatic queries like in Windows Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days, The results will include a maximum of 10,000 rows, The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).

  • microsoft-atp-create-alert Deprecated

    Create a new alert entity using event data, as obtained from the Advanced Hunting.

  • microsoft-atp-get-alert-related-user Deprecated

    Retrieves the user associated to a specific alert.

  • microsoft-atp-get-file-related-machines Deprecated

    Get a collection of machines related to a given file hash.

  • microsoft-atp-get-machine-details Deprecated

    Get a machine details by its identity.

  • microsoft-atp-get-machines Deprecated

    Retrieves a collection of machines that have communicated with WDATP cloud on the last 30 days.

  • microsoft-atp-isolate-machine Deprecated

    Isolates a machine from accessing external network.

  • microsoft-atp-list-alerts Deprecated

    Get a list of alerts present on the system.

  • microsoft-atp-run-antivirus-scan Deprecated

    Initiate Windows Defender Antivirus scan on a machine.

  • microsoft-atp-unisolate-machine Deprecated

    Undo an isolation of a machine.

  • microsoft-atp-update-alert Deprecated

    Update the properties of an alert entity.

Source

WindowsDefenderAdvancedThreatProtection.py WindowsDefenderAdvancedThreatProtection_test.py WindowsDefenderAdvancedThreatProtection.yml WindowsDefenderAdvancedThreatProtection_description.md
Download History Raw 
category: Endpoint
provider: Microsoft
commonfields:
  id: Windows Defender Advanced Threat Protection
  version: -1
configuration:
- defaultvalue: https://api.securitycenter.windows.com
  display: Host URL (e.g. https://api.securitycenter.windows.com)
  name: url
  required: true
  type: 0
- display: ID (received from the admin consent - see Detailed Instructions (?)
  name: auth_id
  required: true
  type: 4
- display: Token (received from the admin consent - see Detailed Instructions (?) section)
  name: tenant_id
  required: true
  type: 4
- display: Key (received from the admin consent - see Detailed Instructions (?)
  name: enc_key
  required: true
  type: 4
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- defaultvalue: New
  display: 'Status to filter out alerts for fetching as incidents. The property values are: New,InProgress,Resolved (Comma separated values supported, e.g. New,Resolved)'
  name: fetch_status
  type: 0
  required: false
- defaultvalue: Informational,Low,Medium,High
  display: 'Severity to filter out alerts for fetching as incidents. The property values are: Informational,Low,Medium,High (Comma separated values supported, e.g. Medium,High)'
  name: fetch_severity
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. Use the Microsoft Defender for Endpoint pack instead.
display: Windows Defender Advanced Threat Protection (Deprecated)
name: Windows Defender Advanced Threat Protection
script:
  commands:
  - arguments:
    - default: true
      description: Machine ID to be used for isolation. e.g. 0a3250e0693a109f1affc9217be9459028aa8426.
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    - auto: PREDEFINED
      description: Full isolation or selective isolation (Restrict only limited set of applications from accessing the network).
      name: isolation_type
      predefined:
      - Full
      - Selective
    deprecated: true
    description: Isolates a machine from accessing external network.
    execution: true
    name: microsoft-atp-isolate-machine
    outputs:
    - contextPath: MicrosoftATP.Machine.Isolation.Requestor
      description: Machine isolation requestor.
      type: string
    - contextPath: MicrosoftATP.Machine.Isolation.RequestorComment
      description: Machine isolation requestor comment.
      type: string
    - contextPath: MicrosoftATP.Machine.ID
      description: Machine ID.
      type: string
    - contextPath: MicrosoftATP.Machine.Isolation.Isolated
      description: True if machine is isolated, else false.
      type: boolean
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: Machine ID to be used to stop the isolation. e.g. 0a3250e0693a109f1affc9217be9459028aa8426.
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    deprecated: true
    description: Undo an isolation of a machine.
    name: microsoft-atp-unisolate-machine
    outputs:
    - contextPath: MicrosoftATP.Machine.Isolation.Requestor
      description: Machine un-isolation requestor.
      type: string
    - contextPath: MicrosoftATP.Machine.Isolation.RequestorComment
      description: Machine un-isolation requestor comment.
      type: string
    - contextPath: MicrosoftATP.Machine.ID
      description: Machine ID.
      type: Unknown
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: Computer DNS name.
      name: hostname
    - description: Machine last external IP address.
      name: ip
    - auto: PREDEFINED
      description: Machine risk score.
      name: risk_score
      predefined:
      - Low
      - Medium
      - High
    - auto: PREDEFINED
      description: Machine health status.
      name: health_status
      predefined:
      - Active
      - Inactive
    deprecated: true
    description: Retrieves a collection of machines that have communicated with WDATP cloud on the last 30 days.
    name: microsoft-atp-get-machines
    outputs:
    - contextPath: MicrosoftATP.Machine.ID
      description: Machine ID.
      type: string
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: Machine DNS name.
      type: string
    - contextPath: MicrosoftATP.Machine.AgentVersion
      description: Machine agent version.
      type: string
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: Machine first seen date.
      type: date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: Machine last seen date.
      type: string
    - contextPath: MicrosoftATP.Machine.HelathStatus
      description: Machine health status.
      type: string
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, else false.
      type: boolean
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: Machine last external IP address.
      type: string
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: Machine last IP address.
      type: string
    - contextPath: MicrosoftATP.Machine.Tags
      description: Machine tags.
      type: string
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: Machine OS build.
      type: number
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: Machine OS platform.
      type: string
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: Machine RBAC group ID.
      type: string
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: Machine risk score.
      type: string
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: Machine RBAC group name.
      type: string
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: Machine AAD device ID.
      type: string
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: Machine OS version.
      type: string
    - contextPath: Endpoint.Hostname
      description: Machine DNS name.
      type: string
    - contextPath: Endpoint.IPAddress
      description: Machine last IP address.
      type: string
    - contextPath: Endpoint.OS
      description: Machine OS platform.
      type: string
    - contextPath: Endpoint.OSVersion
      description: Machine OS version.
      type: string
  - arguments:
    - description: File hash to get machines related to.
      name: file
      required: true
    deprecated: true
    description: Get a collection of machines related to a given file hash.
    name: microsoft-atp-get-file-related-machines
    outputs:
    - contextPath: MicrosoftATP.Machine.ID
      description: Machine ID.
      type: string
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: Machine DNS name.
      type: string
    - contextPath: MicrosoftATP.Machine.AgentVersion
      description: Machine agent version.
      type: string
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: Machine first seen date.
      type: date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: Machine last seen date.
      type: string
    - contextPath: MicrosoftATP.Machine.HelathStatus
      description: Machine health status.
      type: string
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, else false.
      type: boolean
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: Machine last external IP address.
      type: string
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: Machine last IP address.
      type: string
    - contextPath: MicrosoftATP.Machine.Tags
      description: Machine tags.
      type: string
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: Machine OS build.
      type: number
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: Machine OS platform.
      type: string
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: Machine RBAC group ID.
      type: string
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: Machine risk score.
      type: string
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: Machine RBAC group name.
      type: string
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: Machine AAD device ID.
      type: string
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: Machine OS version.
      type: string
    - contextPath: Endpoint.Hostname
      description: Machine DNS name.
      type: string
    - contextPath: Endpoint.IPAddress
      description: Machine last IP address.
      type: string
    - contextPath: Endpoint.OS
      description: Machine OS platform.
      type: string
    - contextPath: Endpoint.OSVersion
      description: Machine OS version.
      type: string
    - contextPath: MicrosoftATP.Machine.RelatedFile
      description: Machine related file hash.
      type: string
  - arguments:
    - default: true
      description: Machine id to be used for getting the machine details, e.g. 0a3250e0693a109f1affc9217be9459028aa8426.
      name: machine_id
      required: true
    deprecated: true
    description: Get a machine details by its identity.
    name: microsoft-atp-get-machine-details
    outputs:
    - contextPath: MicrosoftATP.Machine.ID
      description: Machine ID.
      type: string
    - contextPath: MicrosoftATP.Machine.ComputerDNSName
      description: Machine DNS name.
      type: string
    - contextPath: MicrosoftATP.Machine.AgentVersion
      description: Machine agent version.
      type: string
    - contextPath: MicrosoftATP.Machine.FirstSeen
      description: Machine first seen date.
      type: date
    - contextPath: MicrosoftATP.Machine.LastSeen
      description: Machine last seen date.
      type: string
    - contextPath: MicrosoftATP.Machine.HelathStatus
      description: Machine health status.
      type: string
    - contextPath: MicrosoftATP.Machine.IsAADJoined
      description: True if machine is AAD joined, else false.
      type: boolean
    - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
      description: Machine last external IP address.
      type: string
    - contextPath: MicrosoftATP.Machine.LastIPAddress
      description: Machine last IP address.
      type: string
    - contextPath: MicrosoftATP.Machine.Tags
      description: Machine tags.
      type: string
    - contextPath: MicrosoftATP.Machine.OSBuild
      description: Machine OS build.
      type: number
    - contextPath: MicrosoftATP.Machine.OSPlatform
      description: Machine OS platform.
      type: string
    - contextPath: MicrosoftATP.Machine.RBACGroupID
      description: Machine RBAC group ID.
      type: string
    - contextPath: MicrosoftATP.Machine.RiskScore
      description: Machine risk score.
      type: string
    - contextPath: MicrosoftATP.Machine.RBACGroupName
      description: Machine RBAC group name.
      type: string
    - contextPath: MicrosoftATP.Machine.AADDeviceID
      description: Machine AAD device ID.
      type: string
    - contextPath: MicrosoftATP.Machine.OSVersion
      description: Machine OS version.
      type: string
    - contextPath: Endpoint.Hostname
      description: Machine DNS name.
      type: string
    - contextPath: Endpoint.IPAddress
      description: Machine last IP address.
      type: string
    - contextPath: Endpoint.OS
      description: Machine OS platform.
      type: string
    - contextPath: Endpoint.OSVersion
      description: Machine OS version.
      type: string
  - arguments:
    - description: Machine ID to run the scan on.
      name: machine_id
      required: true
    - description: Comment to associate with the action.
      name: comment
      required: true
    - auto: PREDEFINED
      description: Defines the type of the scan.
      name: scan_type
      predefined:
      - Quick
      - Full
      required: true
    deprecated: true
    description: Initiate Windows Defender Antivirus scan on a machine.
    name: microsoft-atp-run-antivirus-scan
  - arguments:
    - auto: PREDEFINED
      description: Alert severity.
      name: severity
      predefined:
      - High
      - Medium
      - Low
      - Informational
    - auto: PREDEFINED
      description: Alert status.
      name: status
      predefined:
      - New
      - InProgress
      - Resolved
    deprecated: true
    description: Get a list of alerts present on the system.
    name: microsoft-atp-list-alerts
    outputs:
    - contextPath: MicrosoftATP.Alert.DetectionSource
      description: Alert detection source.
      type: string
    - contextPath: MicrosoftATP.Alert.MachineID
      description: Alert machine ID.
      type: string
    - contextPath: MicrosoftATP.Alert.Classification
      description: Alert classification.
      type: string
    - contextPath: MicrosoftATP.Alert.AlertCreationTime
      description: Alert creation time.
      type: date
    - contextPath: MicrosoftATP.Alert.RecommendedAction
      description: Alert recommended action.
      type: string
    - contextPath: MicrosoftATP.Alert.LastEventTime
      description: Alert last event time.
      type: date
    - contextPath: MicrosoftATP.Alert.Status
      description: Alert status.
      type: string
    - contextPath: MicrosoftATP.Alert.FirstEventTime
      description: Alert first event time.
      type: string
    - contextPath: MicrosoftATP.Alert.Title
      description: Alert title.
      type: string
    - contextPath: MicrosoftATP.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MicrosoftATP.Alert.Description
      description: Alert description.
      type: string
    - contextPath: MicrosoftATP.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: MicrosoftATP.Alert.Category
      description: Alert category.
      type: string
  - arguments:
    - description: Alert ID to update.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: Alert status to update.
      name: status
      predefined:
      - New
      - InProgress
      - Resolved
    - description: Owner of the alert.
      name: assigned_to
    - auto: PREDEFINED
      description: Specifies the specification of the alert.
      name: classification
      predefined:
      - Unknown
      - FalsePositive
      - TruePositive
    - auto: PREDEFINED
      description: Specifies the determination of the alert.
      name: determination
      predefined:
      - NotAvailable
      - Apt
      - Malware
      - SecurityPersonnel
      - SecurityTesting
      - UnwantedSoftware
      - Other
    deprecated: true
    description: Update the properties of an alert entity.
    name: microsoft-atp-update-alert
    outputs:
    - contextPath: MicrosoftATP.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MicrosoftATP.Alert.Status
      description: Alert status.
      type: string
    - contextPath: MicrosoftATP.Alert.Classification
      description: Alert classification.
      type: string
    - contextPath: MicrosoftATP.Alert.Determination
      description: Alert determination.
      type: string
  - arguments:
    - default: true
      description: The query to run.
      name: query
      required: true
    deprecated: true
    description: 'Allows you to run programmatic queries like in Windows Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days, The results will include a maximum of 10,000 rows, The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).'
    name: microsoft-atp-advanced-hunting
    outputs:
    - contextPath: MicrosoftATP.Hunt.Result
      description: Results of the query.
      type: Unknown
  - arguments:
    - description: Id of the machine on which the event was identified. Required.
      name: machine_id
      required: true
    - auto: PREDEFINED
      description: Severity of the alert.
      name: severity
      predefined:
      - Low
      - Medium
      - High
      required: true
    - description: Title for the alert.
      name: title
      required: true
    - description: Description of the alert.
      name: description
      required: true
    - description: Action that is recommended to be taken by security officer when analyzing the alert.
      name: recommended_action
      required: true
    - description: The time of the event, as obtained from the advanced query.
      name: event_time
      required: true
    - description: The reportId, as obtained from the advanced query.
      name: report_id
      required: true
    - auto: PREDEFINED
      defaultValue: None
      description: Category of the alert.
      name: category
      predefined:
      - None
      - SuspiciousActivity
      - Malware
      - CredentialTheft
      - Exploit
      - WebExploit
      - DocumentExploit
      - PrivilegeEscalation
      - Persistence
      - RemoteAccessTool
      - CommandAndControl
      - SuspiciousNetworkTraffic
      - Ransomware
      - MalwareDownload
      - Reconnaissance
      - WebFingerprinting
      - Weaponization
      - Delivery
      - SocialEngineering
      - CredentialStealing
      - Installation
      - Backdoor
      - Trojan
      - TrojanDownloader
      - LateralMovement
      - ExplorationEnumeration
      - NetworkPropagation
      - Exfiltration
      - NotApplicable
      - EnterprisePolicy
      - General
    deprecated: true
    description: Create a new alert entity using event data, as obtained from the Advanced Hunting.
    name: microsoft-atp-create-alert
    outputs:
    - contextPath: MicrosoftATP.Alert.MachineID
      description: Alert machine ID.
      type: string
    - contextPath: MicrosoftATP.Alert.RecommendedAction
      description: Alert recommended action.
      type: string
    - contextPath: MicrosoftATP.Alert.Title
      description: Alert title.
      type: string
    - contextPath: MicrosoftATP.Alert.Description
      description: Alert description.
      type: string
    - contextPath: MicrosoftATP.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: MicrosoftATP.Alert.Category
      description: Alert category.
      type: string
    - contextPath: MicrosoftATP.Alert.ReportID
      description: Alert report ID.
      type: string
    - contextPath: MicrosoftATP.Alert.EventTime
      description: Event time of the alert, as created by the user.
      type: date
    - contextPath: MicrosoftATP.Alert.ID
      description: ID of the created alert.
      type: string
    - contextPath: MicrosoftATP.Alert.Status
      description: Status of the alert.
      type: string
  - arguments:
    - description: ID of the alert.
      name: id
      required: true
    deprecated: true
    description: Retrieves the user associated to a specific alert.
    name: microsoft-atp-get-alert-related-user
    outputs:
    - contextPath: MicrosoftATP.User.ID
      description: ID of the related user.
      type: string
    - contextPath: MicrosoftATP.User.AlertID
      description: ID of the alert.
      type: string
    - contextPath: MicrosoftATP.User.FirstSeen
      description: First seen date of the related user.
      type: date
    - contextPath: MicrosoftATP.User.LastSeen
      description: Last seen date of the related user.
      type: date
    - contextPath: MicrosoftATP.User.MostPrevalentMachineID
      description: The most prevalent machine ID related to the user.
      type: string
    - contextPath: MicrosoftATP.User.LogonTypes
      description: Types of logon for the related user.
      type: string
    - contextPath: MicrosoftATP.User.LogonCount
      description: Log on machine count.
      type: string
    - contextPath: MicrosoftATP.User.DomainAdmin
      description: Flag for user domain admin - set to true if related user is domain admin.
      type: boolean
    - contextPath: MicrosoftATP.User.NetworkUser
      description: Flag for network user only - set to true if related user is only network user.
      type: boolean
  dockerimage: demisto/crypto:1.0.0.3539024
  isfetch: true
  script: '-'
  type: python
  subtype: python3
deprecated: true
tests:
- No Tests - Deprected (Test - Windows Defender Advanced Threat Protection is in NonCircleTests directory)

fromversion: 5.0.0
supportedModules:
- xsiam
- agentix