MicrosoftAtpEndpoint

A polling wrapper script; retrieves machines that have communicated with Microsoft Defender for Endpoint cloud. At least one of the following arguments is required: IP, hostname, or ID. Otherwise, an error appears.

python · Microsoft Defender for Endpoint

Details

ID	`MicrosoftAtpEndpoint`
Language	python
From Version	6.1.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	Utilities

Source

MicrosoftAtpEndpoint.py MicrosoftAtpEndpoint_test.py MicrosoftAtpEndpoint.yml

Download History Raw

commonfields:
  id: MicrosoftAtpEndpoint
  version: -1
name: MicrosoftAtpEndpoint
script: ''
type: python
tags:
  - Utilities
comment: "A polling wrapper script; retrieves machines that have communicated with Microsoft Defender for Endpoint cloud. At least one of the following arguments is required: IP, hostname, or ID. Otherwise, an error appears."
enabled: true
args:
  - name: id
    description: The endpoint ID.
    isArray: true
  - name: ip
    description: The endpoint IP address.
    default: true
    isArray: true
  - description: The endpoint hostname.
    isArray: true
    name: hostname
  - deprecated: true
    description: Flag for the rate limit retry.
    name: ran_once_flag
outputs:
  - contextPath: Endpoint.ID
    description: The endpoint's identifier.
    type: String
  - contextPath: Endpoint.Hostname
    description: The hostname of the endpoint.
    type: String
  - contextPath: Endpoint.OS
    description: The endpoint's operating system.
    type: String
  - contextPath: Endpoint.OSVersion
    description: The endpoint's operating system's version.
    type: String
  - contextPath: Endpoint.IPAddress
    description: The endpoint's IP address.
    type: String
  - contextPath: Endpoint.Status
    description: The health status of the endpoint.
    type: String
  - contextPath: Endpoint.MACAddress
    description: The endpoint's MAC address.
    type: String
  - contextPath: Endpoint.Vendor
    description: The integration name of the endpoint vendor.
    type: String
  - contextPath: MicrosoftATP.Machine.ID
    description: The machine ID.
    type: String
  - contextPath: MicrosoftATP.Machine.ComputerDNSName
    description: The machine DNS name.
    type: String
  - contextPath: MicrosoftATP.Machine.FirstSeen
    description: The first date and time the machine was observed by Microsoft Defender ATP.
    type: Date
  - contextPath: MicrosoftATP.Machine.LastSeen
    description: The last date and time the machine was observed by Microsoft Defender ATP.
    type: Date
  - contextPath: MicrosoftATP.Machine.OSPlatform
    description: The operating system platform.
    type: String
  - contextPath: MicrosoftATP.Machine.OSVersion
    description: The operating system version.
    type: String
  - contextPath: MicrosoftATP.Machine.OSProcessor
    description: The operating system processor.
    type: String
  - contextPath: MicrosoftATP.Machine.LastIPAddress
    description: The last IP on the machine.
    type: String
  - contextPath: MicrosoftATP.Machine.LastExternalIPAddress
    description: The last machine IP to access the internet.
    type: String
  - contextPath: MicrosoftATP.Machine.OSBuild
    description: The operating system build number.
    type: Number
  - contextPath: MicrosoftATP.Machine.HealthStatus
    description: The machine health status.
    type: String
  - contextPath: MicrosoftATP.Machine.RBACGroupID
    description: The machine RBAC group ID.
    type: Number
  - contextPath: MicrosoftATP.Machine.RBACGroupName
    description: The machine RBAC group name.
    type: String
  - contextPath: MicrosoftATP.Machine.RiskScore
    description: The machine risk score.
    type: String
  - contextPath: MicrosoftATP.Machine.ExposureLevel
    description: The machine exposure score.
    type: String
  - contextPath: MicrosoftATP.Machine.IsAADJoined
    description: Whether the machine is AAD joined.
    type: Boolean
  - contextPath: MicrosoftATP.Machine.AADDeviceID
    description: The AAD Device ID.
    type: String
  - contextPath: MicrosoftATP.Machine.MachineTags
    description: The set of machine tags.
    type: String
  - contextPath: MicrosoftATP.Machine.IPAddresses.ipAddress
    description: The machine IP address.
    type: String
  - contextPath: MicrosoftATP.Machine.IPAddresses.MACAddress
    description: The machine MAC address.
    type: String
  - contextPath: MicrosoftATP.Machine.IPAddresses.operationalStatus
    description: The machine operational status.
    type: String
  - contextPath: MicrosoftATP.Machine.IPAddresses.type
    description: The machine IP address type.
    type: String
  - contextPath: MicrosoftATP.Machine.AgentVersion
    description: The machine Agent version.
    type: String
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.13.10116658
dependson:
  must:
  - "Microsoft Defender Advanced Threat Protection|||endpoint"
fromversion: 6.1.0
isInternal: true
tests:
  - No tests (auto formatted)
marketplaces:
  - platform