Windows Defender Advanced Threat Protection Deprecated

Deprecated. Use the Microsoft Defender for Endpoint pack instead.

Endpoint · Windows Defender Advanced Threat Protection (Deprecated)

Details

IDWindows Defender Advanced Threat Protection
ProviderMicrosoft
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/crypto:1.0.0.3539024
Supported ModulesAgentix

Configuration parameters

  • url — Host URL (e.g. https://api.securitycenter.windows.com) (required)
  • auth_id — ID (received from the admin consent - see Detailed Instructions (?) (required)
  • tenant_id — Token (received from the admin consent - see Detailed Instructions (?) section) (required)
  • enc_key — Key (received from the admin consent - see Detailed Instructions (?) (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • fetch_status — Status to filter out alerts for fetching as incidents. The property values are: New,InProgress,Resolved (Comma separated values supported, e.g. New,Resolved)
  • fetch_severity — Severity to filter out alerts for fetching as incidents. The property values are: Informational,Low,Medium,High (Comma separated values supported, e.g. Medium,High)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (11)

  • microsoft-atp-advanced-hunting Deprecated

    Allows you to run programmatic queries like in Windows Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days, The results will include a maximum of 10,000 rows, The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).

  • microsoft-atp-create-alert Deprecated

    Create a new alert entity using event data, as obtained from the Advanced Hunting.

  • microsoft-atp-get-alert-related-user Deprecated

    Retrieves the user associated to a specific alert.

  • microsoft-atp-get-file-related-machines Deprecated

    Get a collection of machines related to a given file hash.

  • microsoft-atp-get-machine-details Deprecated

    Get a machine details by its identity.

  • microsoft-atp-get-machines Deprecated

    Retrieves a collection of machines that have communicated with WDATP cloud on the last 30 days.

  • microsoft-atp-isolate-machine Deprecated

    Isolates a machine from accessing external network.

  • microsoft-atp-list-alerts Deprecated

    Get a list of alerts present on the system.

  • microsoft-atp-run-antivirus-scan Deprecated

    Initiate Windows Defender Antivirus scan on a machine.

  • microsoft-atp-unisolate-machine Deprecated

    Undo an isolation of a machine.

  • microsoft-atp-update-alert Deprecated

    Update the properties of an alert entity.

Source

WindowsDefenderAdvancedThreatProtection.py WindowsDefenderAdvancedThreatProtection_test.py WindowsDefenderAdvancedThreatProtection.yml WindowsDefenderAdvancedThreatProtection_description.md
Download History Raw 
import demistomock as demisto
import json


def mock_demisto(mocker):
    mocker.patch.object(demisto, 'params', return_value={'proxy': True,
                                                         'url': 'https://api.securitycenter.windows.com',
                                                         'tenant_id': '1234',
                                                         'enc_key': 'key',
                                                         'auth_id': '1234567@1234567',
                                                         'fetch_severity': 'Informational,Low,Medium,High',
                                                         'fetch_status': 'New'})
    mocker.patch.object(demisto, 'getLastRun', return_value={'last_alert_fetched_time': "2018-11-26T16:19:21.840980"})
    mocker.patch.object(demisto, 'incidents')


def atp_mocker(mocker):
    import WindowsDefenderAdvancedThreatProtection as atp
    with open('./test_data/alerts.json', 'r') as f:
        alerts = json.loads(f.read())
    mocker.patch.object(atp, 'list_alerts', return_value=alerts)


def test_fetch(mocker):
    mock_demisto(mocker)
    import WindowsDefenderAdvancedThreatProtection as atp
    atp_mocker(mocker)
    atp.fetch_incidents()
    # Check that all 3 incidents are extracted
    assert 3 == len(demisto.incidents.call_args[0][0])
    assert 'Windows Defender ATP Alert da636983472338927033_-2077013687' == \
           demisto.incidents.call_args[0][0][2].get('name')

    # Check that incident isn't extracted again
    mocker.patch.object(demisto, 'getLastRun', return_value={'last_alert_fetched_time': "2019-09-01T13:31:08.025286",
                                                             'last_ids': ['da637029414680409372_735564929']})
    atp.fetch_incidents()
    assert [] == demisto.incidents.call_args[0][0]

    # Check that new incident is extracted
    mocker.patch.object(demisto, 'getLastRun', return_value={'last_alert_fetched_time': "2019-09-01T13:29:37.235691",
                                                             'last_ids': ['da637029413772554314_295039533']})
    atp.fetch_incidents()
    assert 'Windows Defender ATP Alert da637029414680409372_735564929' ==\
           demisto.incidents.call_args[0][0][0].get('name')