Windows Defender Advanced Threat Protection Deprecated

Deprecated. Use the Microsoft Defender for Endpoint pack instead.

Endpoint · Windows Defender Advanced Threat Protection (Deprecated)

Details

IDWindows Defender Advanced Threat Protection
ProviderMicrosoft
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/crypto:1.0.0.3539024
Supported ModulesAgentix

Configuration parameters

  • url — Host URL (e.g. https://api.securitycenter.windows.com) (required)
  • auth_id — ID (received from the admin consent - see Detailed Instructions (?) (required)
  • tenant_id — Token (received from the admin consent - see Detailed Instructions (?) section) (required)
  • enc_key — Key (received from the admin consent - see Detailed Instructions (?) (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • fetch_status — Status to filter out alerts for fetching as incidents. The property values are: New,InProgress,Resolved (Comma separated values supported, e.g. New,Resolved)
  • fetch_severity — Severity to filter out alerts for fetching as incidents. The property values are: Informational,Low,Medium,High (Comma separated values supported, e.g. Medium,High)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (11)

  • microsoft-atp-advanced-hunting Deprecated

    Allows you to run programmatic queries like in Windows Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days, The results will include a maximum of 10,000 rows, The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).

  • microsoft-atp-create-alert Deprecated

    Create a new alert entity using event data, as obtained from the Advanced Hunting.

  • microsoft-atp-get-alert-related-user Deprecated

    Retrieves the user associated to a specific alert.

  • microsoft-atp-get-file-related-machines Deprecated

    Get a collection of machines related to a given file hash.

  • microsoft-atp-get-machine-details Deprecated

    Get a machine details by its identity.

  • microsoft-atp-get-machines Deprecated

    Retrieves a collection of machines that have communicated with WDATP cloud on the last 30 days.

  • microsoft-atp-isolate-machine Deprecated

    Isolates a machine from accessing external network.

  • microsoft-atp-list-alerts Deprecated

    Get a list of alerts present on the system.

  • microsoft-atp-run-antivirus-scan Deprecated

    Initiate Windows Defender Antivirus scan on a machine.

  • microsoft-atp-unisolate-machine Deprecated

    Undo an isolation of a machine.

  • microsoft-atp-update-alert Deprecated

    Update the properties of an alert entity.

Source

WindowsDefenderAdvancedThreatProtection.py WindowsDefenderAdvancedThreatProtection_test.py WindowsDefenderAdvancedThreatProtection.yml WindowsDefenderAdvancedThreatProtection_description.md
Download History Raw 
To allow us access to Windows Defender, an admin has to approve our app using an admin consent flow, by clicking on the following [link](https://oproxy.demisto.ninja/ms-defender-atp).
After authorizing the Demisto app, you will get an ID, Token, and Key, which should be inserted in the integration instance configuration's corresponding fields.