Windows Defender Advanced Threat Protection
Deprecated. Use the Microsoft Defender for Endpoint pack instead.
- Category
- Endpoint
- Pack
- WindowsDefenderAdvancedThreatProtection
Configuration parameters
- url — Host URL (e.g. https://api.securitycenter.windows.com) (required)
- auth_id — ID (received from the admin consent - see Detailed Instructions (?) (required)
- tenant_id — Token (received from the admin consent - see Detailed Instructions (?) section) (required)
- enc_key — Key (received from the admin consent - see Detailed Instructions (?) (required)
- isFetch — Fetch incidents
- incidentType — Incident type
- fetch_status — Status to filter out alerts for fetching as incidents. The property values are: New,InProgress,Resolved (Comma separated values supported, e.g. New,Resolved)
- fetch_severity — Severity to filter out alerts for fetching as incidents. The property values are: Informational,Low,Medium,High (Comma separated values supported, e.g. Medium,High)
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
Commands (11)
- microsoft-atp-advanced-hunting — Allows you to run programmatic queries like in Windows Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days, The results will include a maximum of 10,000 rows, The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).
- microsoft-atp-create-alert — Create a new alert entity using event data, as obtained from the Advanced Hunting.
- microsoft-atp-get-alert-related-user — Retrieves the user associated to a specific alert.
- microsoft-atp-get-file-related-machines — Get a collection of machines related to a given file hash.
- microsoft-atp-get-machine-details — Get a machine details by its identity.
- microsoft-atp-get-machines — Retrieves a collection of machines that have communicated with WDATP cloud on the last 30 days.
- microsoft-atp-isolate-machine — Isolates a machine from accessing external network.
- microsoft-atp-list-alerts — Get a list of alerts present on the system.
- microsoft-atp-run-antivirus-scan — Initiate Windows Defender Antivirus scan on a machine.
- microsoft-atp-unisolate-machine — Undo an isolation of a machine.
- microsoft-atp-update-alert — Update the properties of an alert entity.