Microsoft defender threat intelligence
The Microsoft Defender Threat Intelligence connector enables automated access to threat intelligence data, facilitating proactive cybersecurity measures.
Microsoft Defender Threat Intelligence offers a comprehensive suite of threat detection and analysis tools. This connector enables Swimlane Turbine users to integrate with Microsoft's threat intelligence capabilities, allowing for the retrieval and analysis of SSL certificates, passive DNS records, and WHOIS information. By leveraging this integration, security teams can enhance their threat detection and response workflows, gaining access to Microsoft's rich threat intelligence data directly within Swimlane Turbine playbooks.
Limitations
When using $filter and $orderby in the same query to get messages, make sure to specify properties in the following ways:
- Properties that appear in $orderby must also appear in $filter.
- Properties that appear in $orderby are in the same order as in $filter.
- Properties that are present in $orderby appear in $filter before any properties that aren't.
Failing to do this results in the following error:
- Error code: InefficientFilter
- Error message: The restriction or sort order is too complex for this operation.
Supported Versions
This Microsoft Defender Threat Intelligence connector uses the Version 1.0 API.
Additional Docs
Configuration
Prerequisites
To effectively utilize the Microsoft Defender Threat Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites:
- OAuth 2.0 client credentials for secure authentication, which include:
- URL: Endpoint URL for API access
- Client ID: Unique identifier for the application making the request
- Client Secret: A secret key known only to the application and the authorization server
- Token URL: Endpoint URL to obtain the access token
- Scope: Permissions the application requires
Client Credential Flow Authentication
Authentication uses Azure application OAuth2. You will need an admin account in Azure to create the application.
Recommended Application Permissions (feel free use custom permissions if you only use certain actions):
- ThreatIntelligence.Read.All
In order to set up the asset, you need the following:
- Azure Application Client ID
- Azure Application Client Secret
- Azure Tenant ID
Steps to create the Azure app:
- Go to the App Registration page in the Azure portal.
- Click New Registration.
- Enter a name for your new application and choose Accounts in this organizational directory only, then click Register at the bottom.
- Navigate to the API permissions tab on the left navigation menu.
- Select Add a permission.
- Select Microsoft Graph.
- Select Application permissions, then mark all the permissions you need for the actions you are using (See suggested permissions at the top of the asset setup section).
- Click the Add permissions button at the bottom of the page.
- Select Grant admin consent for your organization, then your permissions should look as below.
- Navigate to the Certificates & secrets tab and select New client secret.
- Fill out the description and expiration, then click the Add button at the bottom.
- The Value of the secret you just created is the Client Secret needed for the Swimlane asset.
- Navigate to the Overview tab on the left menu.
- The Client ID and Tenant ID needed in the asset are shown on this page.
The Client ID, Tenant ID, and Client Secret described in the steps above are the credentials you need for the asset.
Authentication Methods
OAuth 2.0 Client Credentials
To effectively utilize the Microsoft Defender Threat Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites:
- OAuth 2.0 client credentials authentication with the following parameters:
- URL: Endpoint for the Microsoft Defender Threat Intelligence API.
- Client ID: Unique identifier for the application seeking access.
- Client Secret: A secret known only to the application and the authorization server.
- Token URL: Endpoint to obtain the OAuth 2.0 tokens.
- Scope: Permissions the application requires.
Capabilities
This Microsoft Defender Threat Intelligence connector provides the following capabilities:
- Get Host SSL Certificate
- Get Passive DNS Record
- Get SSL Certificate
- Get WHOIS History Record
- Get WHOIS Record by Host ID
- Get WHOIS Record by WHOIS Record ID
- List Host SSL Certificates
- List Related Hosts
- List SSL Certificates
- List WHOIS History Records by Host ID
- List WHOIS History Records by ID
- List WHOIS Records
Get Host SSL Certificate
Get the properties and relationships of a host SSL Certificate object.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
Get Passive DNS Record
Read the properties and relationships of a passive DNS Record object.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
Get SSL Certificate
Get the properties and relationships of an SSL Certificate object.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
Get WHOIS History Record
Get WHOIS history record.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
Get WHOIS Record by Host ID
To get the current WHOIS Record for the specified host.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
Get WHOIS Record by WHOIS Record ID
Get the specified WHOIS Record resource by WHOIS record ID.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
List Host SSL Certificates
Get a list of host SSL Certificate objects from the host navigation property.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
List Related Hosts
Get a list of related host resources associated with an SSL Certificate.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
List SSL Certificates
Get a list of SSL Certificate objects and their properties.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
List WHOIS History Records by Host ID
Get the history for a WHOIS Record, as represented by a collection of whoisHistoryRecord resources.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
List WHOIS History Records by ID
Get the history for a WHOIS Record, as represented by a collection of WHOIS History Record resources.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
List WHOIS Records
Get a list of WHOIS record objects.
Microsoft Defender Threat Intelligence documentation for this action can be found here.
Configurations
MS Defender Threat Intelligence Oauth Client Creds
Authenticates using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token_url | Must start with https://login.microsoftonline.com/ and then continue with the tenant_id, and then be prepended with /oauth2/v2.0/token. | string | Required |
client_id | The client ID. | string | Required |
client_secret | The client secret. | string | Required |
scope | List of permission scopes for this action. | array | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Host SSL Certificate
Retrieve properties and relationships of a specific host SSL Certificate in Microsoft Defender Threat Intelligence using the certificate ID.
Endpoint
- URL: /v1.0/security/threatIntelligence/hostSslCertificates/{{hostSslCertificateId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.hostSslCertificateId | string | Required | The host SSL certificate ID. |
parameters.$count | boolean | Optional | Retrieves the total count of matching resources. |
parameters.$orderby | array | Optional | Orders results. |
parameters.$select | string | Optional | Returns results based on search criteria. |
parameters.$skip | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. |
parameters.$top | number | Optional | Sets the page size of results. |
Input Example
{"parameters":{"$count":true,"$orderby":[""],"$select":"","$skip":15,"$top":10},"path_parameters":{"hostSslCertificateId":"Y29udG9zby5jb20xNTUwMGZiOTY1NTE1MDVmMWVkYjI0ZGQzYjM2ZmNmZmRiNzY1ODMzYjgxMTg="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | object | Value for the parameter |
value.id | string | Unique identifier |
value.firstSeenDateTime | string | Value for the parameter |
value.lastSeenDateTime | string | Value for the parameter |
value.ports | array | Value for the parameter |
value.ports.port | number | Value for the parameter |
value.ports.firstSeenDateTime | string | Value for the parameter |
value.ports.lastSeenDateTime | string | Value for the parameter |
value.host | object | Value for the parameter |
string | Response data | |
value.host.id | string | Unique identifier |
value.sslCertificate | object | Value for the parameter |
string | Response data | |
value.sslCertificate.id | string | Unique identifier |
value.sslCertificate.firstSeenDateTime | string | Value for the parameter |
value.sslCertificate.lastSeenDateTime | string | Value for the parameter |
value.sslCertificate.fingerprint | string | Value for the parameter |
value.sslCertificate.sslVersion | string | Value for the parameter |
value.sslCertificate.expirationDateTime | string | Value for the parameter |
value.sslCertificate.issueDateTime | string | Value for the parameter |
value.sslCertificate.sha1 | string | Value for the parameter |
value.sslCertificate.serialNumber | string | Value for the parameter |
value.sslCertificate.subject | object | Value for the parameter |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
Get Passive DNS Record
Retrieve details and relationships of a specific passive DNS Record object in Microsoft Defender Threat Intelligence using the record ID.
Endpoint
- URL: /v1.0/security/threatIntelligence/passiveDnsRecords/{{passiveDnsRecordId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.passiveDnsRecordId | string | Required | The passive DNS record ID. |
parameters.$count | boolean | Optional | Retrieves the total count of matching resources. |
parameters.$orderby | array | Optional | Orders results. |
parameters.$search | string | Optional | Returns results based on search criteria. |
parameters.$select | string | Optional | Filters properties (columns). |
parameters.$skip | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. |
parameters.$top | number | Optional | Sets the page size of results. |
parameters.$expand | array | Optional | Retrieves related resources. |
parameters.$format | string | Optional | Returns the results in the specified media format. |
parameters.$filter | string | Optional | Filters results (rows). |
Input Example
{"parameters":{"$count":true,"$orderby":[""],"$search":"","$select":"","$skip":15,"$top":10,"$expand":["children"],"$format":"json","$filter":""},"path_parameters":{"passiveDnsRecordId":"Y29udG9zby5jb20kJDIwLjEwMy44NS4zMyQkZmFsc2U="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | object | Value for the parameter |
string | Response data | |
value.id | string | Unique identifier |
value.firstSeenDateTime | string | Value for the parameter |
value.lastSeenDateTime | string | Value for the parameter |
value.collectedDateTime | string | Value for the parameter |
value.recordType | string | Type of the resource |
value.parentHost | object | Value for the parameter |
value.parentHost.id | string | Unique identifier |
value.artifact | object | Value for the parameter |
string | Response data | |
value.artifact.id | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
Get SSL Certificate
Retrieve properties and relationships of an SSL Certificate object in Microsoft Defender Threat Intelligence using the sslCertificateId.
Endpoint
- URL: /v1.0/security/threatIntelligence/sslCertificates/{{sslCertificateId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.sslCertificateId | string | Required | The SSL certificate ID. |
parameters.$count | boolean | Optional | Retrieves the total count of matching resources. |
parameters.$orderby | array | Optional | Orders results. |
parameters.$search | string | Optional | Returns results based on search criteria. |
parameters.$select | string | Optional | Filters properties (columns). |
parameters.$skip | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. |
parameters.$top | number | Optional | Sets the page size of results. |
Input Example
{"parameters":{"$count":true,"$orderby":[""],"$search":"","$select":"","$skip":15,"$top":10},"path_parameters":{"sslCertificateId":"ZmI5NjU1MTUwNWYxZWRiMjRkZDNiMzZmY2ZmZGI3NjU4MzNiODExOA=="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | object | Value for the parameter |
value.id | string | Unique identifier |
value.firstSeenDateTime | string | Value for the parameter |
value.lastSeenDateTime | string | Value for the parameter |
value.fingerprint | string | Value for the parameter |
value.sslVersion | string | Value for the parameter |
value.expirationDateTime | string | Value for the parameter |
value.issueDateTime | string | Value for the parameter |
value.sha1 | string | Value for the parameter |
value.serialNumber | string | Value for the parameter |
value.subject | object | Value for the parameter |
value.subject.commonName | string | Name of the resource |
value.subject.address | object | Value for the parameter |
value.subject.address.city | string | Value for the parameter |
value.subject.address.countryOrRegion | string | Value for the parameter |
value.subject.address.postalCode | object | Value for the parameter |
value.subject.address.postOfficeBox | object | Value for the parameter |
value.subject.address.state | string | Value for the parameter |
value.subject.address.street | object | Value for the parameter |
value.subject.email | object | Value for the parameter |
value.subject.givenName | object | Name of the resource |
value.subject.organizationName | string | Name of the resource |
value.subject.organizationUnitName | object | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
Get WHOIS History Record
Retrieve the history record for a domain's WHOIS information using its unique identifier in Microsoft Defender Threat Intelligence.
Endpoint
- URL: /v1.0/security/threatIntelligence/whoisHistoryRecord/{{whoisHistoryRecordId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.whoisHistoryRecordId | string | Required | The WHOIS History Record ID. |
parameters.$select | string | Optional | Select is supported to limit the properties returned in this query. |
Input Example
{"path_parameters":{"whoisHistoryRecordId":"Y29udG9zby5jb20kJDY5NjQ3ODEyMDc3NDY1NzI0MzM="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
@odata.type | string | Response data |
id | string | Unique identifier |
expirationDateTime | string | Time value |
registrationDateTime | string | Time value |
firstSeenDateTime | object | Time value |
lastSeenDateTime | object | Time value |
lastUpdateDateTime | string | Time value |
billing | object | Output field: billing |
noc | object | Output field: noc |
zone | object | Output field: zone |
whoisServer | string | Output field: whoisServer |
domainStatus | string | Status value |
rawWhoisText | string | Output field: rawWhoisText |
abuse | object | Output field: abuse |
abuse.email | string | Output field: abuse.email |
abuse.name | object | Name of the resource |
abuse.organization | object | Output field: abuse.organization |
abuse.telephone | string | Output field: abuse.telephone |
abuse.fax | object | Output field: abuse.fax |
abuse.address | object | Output field: abuse.address |
abuse.address.city | object | Output field: abuse.address.city |
abuse.address.countryOrRegion | object | Output field: abuse.address.countryOrRegion |
abuse.address.postalCode | object | Output field: abuse.address.postalCode |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
Get WHOIS Record by Host ID
Retrieve the current WHOIS record for a specified host using its unique identifier, requiring the hostId as a path parameter.
Endpoint
- URL: /v1.0/security/threatIntelligence/hosts/{{hostId}}/whois
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.hostId | string | Required | The host ID. |
parameters.$select | string | Optional | Select is supported to limit the properties returned in this query. |
Input Example
{"path_parameters":{"hostId":"contoso.com"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
@odata.context | string | Response data |
id | string | Unique identifier |
expirationDateTime | string | Time value |
registrationDateTime | string | Time value |
firstSeenDateTime | object | Time value |
lastSeenDateTime | object | Time value |
lastUpdateDateTime | string | Time value |
billing | object | Output field: billing |
noc | object | Output field: noc |
zone | object | Output field: zone |
whoisServer | string | Output field: whoisServer |
domainStatus | string | Status value |
rawWhoisText | string | Output field: rawWhoisText |
abuse | object | Output field: abuse |
abuse.email | string | Output field: abuse.email |
abuse.name | object | Name of the resource |
abuse.organization | object | Output field: abuse.organization |
abuse.telephone | string | Output field: abuse.telephone |
abuse.fax | object | Output field: abuse.fax |
abuse.address | object | Output field: abuse.address |
abuse.address.city | object | Output field: abuse.address.city |
abuse.address.countryOrRegion | object | Output field: abuse.address.countryOrRegion |
abuse.address.postalCode | object | Output field: abuse.address.postalCode |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
Get WHOIS Record by WHOIS Record ID
Retrieve a specific WHOIS Record resource using the provided WHOIS record ID in Microsoft Defender Threat Intelligence.
Endpoint
- URL: /v1.0/security/threatIntelligence/whoisRecords/{{whoisRecordId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.whoisRecordId | string | Required | The WHOIS record ID. |
parameters.$select | string | Optional | Select is supported to limit the properties returned in this query. |
Input Example
{"path_parameters":{"whoisRecordId":"Y29udG9zby5jb20kJDY5NjQ3ODEyMDc3NDY1NzI0MzM="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
@odata.type | string | Response data |
id | string | Unique identifier |
expirationDateTime | string | Time value |
registrationDateTime | string | Time value |
firstSeenDateTime | object | Time value |
lastSeenDateTime | object | Time value |
lastUpdateDateTime | string | Time value |
billing | object | Output field: billing |
noc | object | Output field: noc |
zone | object | Output field: zone |
whoisServer | string | Output field: whoisServer |
domainStatus | string | Status value |
rawWhoisText | string | Output field: rawWhoisText |
abuse | object | Output field: abuse |
abuse.email | string | Output field: abuse.email |
abuse.name | object | Name of the resource |
abuse.organization | object | Output field: abuse.organization |
abuse.telephone | string | Output field: abuse.telephone |
abuse.fax | object | Output field: abuse.fax |
abuse.address | object | Output field: abuse.address |
abuse.address.city | object | Output field: abuse.address.city |
abuse.address.countryOrRegion | object | Output field: abuse.address.countryOrRegion |
abuse.address.postalCode | object | Output field: abuse.address.postalCode |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
List Host SSL Certificates
Retrieve a list of SSL Certificate objects associated with a given host ID in Microsoft Defender Threat Intelligence.
Endpoint
- URL: /v1.0/security/threatIntelligence/hosts/{{hostId}}/sslCertificates
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.hostId | string | Required | The host ID. |
parameters.$count | boolean | Optional | Retrieves the total count of matching resources. |
parameters.$orderby | array | Optional | Orders results. |
parameters.$select | string | Optional | Returns results based on search criteria. |
parameters.$skip | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. |
parameters.$top | number | Optional | Sets the page size of results. |
Input Example
{"parameters":{"$count":true,"$orderby":[""],"$select":"","$skip":15,"$top":10},"path_parameters":{"hostId":"contoso.com"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | array | Value for the parameter |
value.id | string | Unique identifier |
value.firstSeenDateTime | string | Value for the parameter |
value.lastSeenDateTime | string | Value for the parameter |
value.ports | array | Value for the parameter |
value.ports.port | number | Value for the parameter |
value.ports.firstSeenDateTime | string | Value for the parameter |
value.ports.lastSeenDateTime | string | Value for the parameter |
value.host | object | Value for the parameter |
string | Response data | |
value.host.id | string | Unique identifier |
value.sslCertificate | object | Value for the parameter |
string | Response data | |
value.sslCertificate.id | string | Unique identifier |
value.sslCertificate.firstSeenDateTime | string | Value for the parameter |
value.sslCertificate.lastSeenDateTime | string | Value for the parameter |
value.sslCertificate.fingerprint | string | Value for the parameter |
value.sslCertificate.sslVersion | string | Value for the parameter |
value.sslCertificate.expirationDateTime | string | Value for the parameter |
value.sslCertificate.issueDateTime | string | Value for the parameter |
value.sslCertificate.sha1 | string | Value for the parameter |
value.sslCertificate.serialNumber | string | Value for the parameter |
value.sslCertificate.subject | object | Value for the parameter |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
List Related Hosts
Retrieve a list of host resources related to a specified SSL Certificate ID in Microsoft Defender Threat Intelligence.
Endpoint
- URL: /v1.0/security/threatIntelligence/sslCertificates/{{sslCertificateId}}/relatedHosts
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.sslCertificateId | string | Required | The SSL Certificate ID. |
parameters.$count | boolean | Optional | Retrieves the total count of matching resources. |
parameters.$skip | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. |
parameters.$top | number | Optional | Sets the page size of results. |
Input Example
{"parameters":{"$count":true,"$skip":15,"$top":10},"path_parameters":{"sslCertificateId":"MDJjODMzNDIzYzYwOTIzNjM1YTA0OTRhMmI2NThjYWM5NDFmM2FmMA=="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
@odata.context | string | Response data |
value | array | Value for the parameter |
string | Response data | |
value.id | string | Unique identifier |
value.firstSeenDateTime | object | Value for the parameter |
value.lastSeenDateTime | object | Value for the parameter |
value.countryOrRegion | object | Value for the parameter |
value.netblock | object | Value for the parameter |
value.autonomousSystem | object | Value for the parameter |
value.hostingProvider | object | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
List SSL Certificates
Retrieve a list of SSL Certificate objects with their properties from Microsoft Defender Threat Intelligence using search parameters.
Endpoint
- URL: /v1.0/security/threatIntelligence/sslCertificates
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.$count | boolean | Optional | Returns a holistic count of the number of SSL Certificate objects. |
parameters.$orderby | array | Optional | Supports some properties of the SSL Certificate resource. |
parameters.$search | string | Required | Currently supports searching by only one property in a call. Do not include any colon (':') in the search string; simply remove any colon from the property value in the search string, if it exists. |
parameters.$select | string | Optional | Limits the properties returned in this query. |
parameters.$skip | number | Optional | Skips over elements in pages. You can combine with $top to perform pagination or use the URL returned in @odata.nextLink for server-side pagination. |
parameters.$top | number | Optional | Limits the number of elements per page. You can combine with $skip to perform pagination or use the URL returned in @odata.nextLink for server-side pagination. |
Input Example
{"parameters":{"$count":true,"$orderby":["firstSeenDateTime desc"],"$search":"issuer/commonName:Contoso","$select":"","$skip":15,"$top":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | array | Value for the parameter |
value.id | string | Unique identifier |
value.firstSeenDateTime | string | Value for the parameter |
value.lastSeenDateTime | string | Value for the parameter |
value.fingerprint | string | Value for the parameter |
value.sslVersion | string | Value for the parameter |
value.expirationDateTime | string | Value for the parameter |
value.issueDateTime | string | Value for the parameter |
value.sha1 | string | Value for the parameter |
value.serialNumber | string | Value for the parameter |
value.subject | object | Value for the parameter |
value.subject.commonName | string | Name of the resource |
value.subject.address | object | Value for the parameter |
value.subject.address.city | string | Value for the parameter |
value.subject.address.countryOrRegion | string | Value for the parameter |
value.subject.address.postalCode | object | Value for the parameter |
value.subject.address.postOfficeBox | object | Value for the parameter |
value.subject.address.state | string | Value for the parameter |
value.subject.address.street | object | Value for the parameter |
value.subject.email | object | Value for the parameter |
value.subject.givenName | object | Name of the resource |
value.subject.organizationName | string | Name of the resource |
value.subject.organizationUnitName | object | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
List WHOIS History Records by Host ID
Retrieve the WHOIS record history for a specified host ID in Microsoft Defender Threat Intelligence.
Endpoint
- URL: /v1.0/security/threatIntelligence/hosts/{{hostId}}/whois/history
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.hostId | string | Required | The host ID. |
parameters.$count | boolean | Optional | Count is supported to return a holistic count of the number of whoisHistoryRecord objects. |
parameters.$select | string | Optional | Select is supported to limit the properties returned in this query. |
parameters.$skip | number | Optional | Skip is supported to skip over elements in pages. Combine with $top to perform pagination or use the @odata.nextLink for server-side pagination. |
parameters.$top | number | Optional | Top is supported to limit the number of elements per page. Combine with $skip to perform pagination or use the @odata.nextLink for server-side pagination. |
Input Example
{"parameters":{"$count":true,"$select":"","$skip":15,"$top":10},"path_parameters":{"hostId":"contoso.com"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | array | Value for the parameter |
string | Response data | |
value.id | string | Unique identifier |
value.expirationDateTime | string | Value for the parameter |
value.registrationDateTime | string | Value for the parameter |
value.firstSeenDateTime | object | Value for the parameter |
value.lastSeenDateTime | object | Value for the parameter |
value.lastUpdateDateTime | string | Value for the parameter |
value.billing | object | Value for the parameter |
value.noc | object | Value for the parameter |
value.zone | object | Value for the parameter |
value.whoisServer | string | Value for the parameter |
value.domainStatus | string | Status value |
value.rawWhoisText | string | Value for the parameter |
value.abuse | object | Value for the parameter |
value.abuse.email | string | Value for the parameter |
value.abuse.name | object | Name of the resource |
value.abuse.organization | object | Value for the parameter |
value.abuse.telephone | string | Value for the parameter |
value.abuse.fax | object | Value for the parameter |
value.abuse.address | object | Value for the parameter |
value.abuse.address.city | object | Value for the parameter |
value.abuse.address.countryOrRegion | object | Value for the parameter |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
List WHOIS History Records by ID
Retrieve the historical WHOIS record data for a given ID in Microsoft Defender Threat Intelligence.
Endpoint
- URL: /v1.0/security/threatIntelligence/whoisRecords/{{id}}/history
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the List WHOIS History Records by ID action |
parameters.$count | boolean | Optional | Count is supported to return a holistic count of the number of whoisHistoryRecord objects. |
parameters.$select | string | Optional | Select is supported to limit the properties returned in this query. |
parameters.$skip | number | Optional | Skip is supported to skip over elements in pages. Combine with $top to perform pagination or use the @odata.nextLink for server-side pagination. |
parameters.$top | number | Optional | Top is supported to limit the number of elements per page. Combine with $skip to perform pagination or use the @odata.nextLink for server-side pagination. |
Input Example
{"parameters":{"$count":true,"$select":"","$skip":15,"$top":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | array | Value for the parameter |
string | Response data | |
value.id | string | Unique identifier |
value.expirationDateTime | string | Value for the parameter |
value.registrationDateTime | string | Value for the parameter |
value.firstSeenDateTime | object | Value for the parameter |
value.lastSeenDateTime | object | Value for the parameter |
value.lastUpdateDateTime | string | Value for the parameter |
value.billing | object | Value for the parameter |
value.noc | object | Value for the parameter |
value.zone | object | Value for the parameter |
value.whoisServer | string | Value for the parameter |
value.domainStatus | string | Status value |
value.rawWhoisText | string | Value for the parameter |
value.abuse | object | Value for the parameter |
value.abuse.email | string | Value for the parameter |
value.abuse.name | object | Name of the resource |
value.abuse.organization | object | Value for the parameter |
value.abuse.telephone | string | Value for the parameter |
value.abuse.fax | object | Value for the parameter |
value.abuse.address | object | Value for the parameter |
value.abuse.address.city | object | Value for the parameter |
value.abuse.address.countryOrRegion | object | Value for the parameter |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
List WHOIS Records
Retrieve a list of WHOIS record objects from Microsoft Defender Threat Intelligence using search parameters.
Endpoint
- URL: /v1.0/security/threatIntelligence/whoisRecords
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.$count | boolean | Optional | Count is supported to return a holistic count of the number of WHOIS Record objects. |
parameters.$orderby | array | Optional | Orderby supports some properties of the WHOIS Record resource. |
parameters.$search | string | Required | Search is required in the request URL of this API. The API currently only supports searching by one field in a call. |
parameters.$select | string | Optional | Select is supported to limit the properties returned in this query. |
parameters.$skip | number | Optional | Skip is supported to skip over elements in pages. Combine with $top to perform pagination or use the @odata.nextLink for server-side pagination. |
parameters.$top | number | Optional | Top is supported to limit the number of elements per page. Combine with $skip to perform pagination or use the @odata.nextLink for server-side pagination. |
Input Example
{"parameters":{"$count":true,"$orderby":["registrationDateTime desc"],"$search":"admin/address/state:WA","$select":"","$skip":15,"$top":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
value | array | Value for the parameter |
string | Response data | |
value.id | string | Unique identifier |
value.expirationDateTime | string | Value for the parameter |
value.registrationDateTime | string | Value for the parameter |
value.firstSeenDateTime | object | Value for the parameter |
value.lastSeenDateTime | object | Value for the parameter |
value.lastUpdateDateTime | string | Value for the parameter |
value.billing | object | Value for the parameter |
value.noc | object | Value for the parameter |
value.zone | object | Value for the parameter |
value.whoisServer | string | Value for the parameter |
value.domainStatus | string | Status value |
value.rawWhoisText | string | Value for the parameter |
value.abuse | object | Value for the parameter |
value.abuse.email | string | Value for the parameter |
value.abuse.name | object | Name of the resource |
value.abuse.organization | object | Value for the parameter |
value.abuse.telephone | string | Value for the parameter |
value.abuse.fax | object | Value for the parameter |
value.abuse.address | object | Value for the parameter |
value.abuse.address.city | object | Value for the parameter |
value.abuse.address.countryOrRegion | object | Value for the parameter |
Output Example
{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-store, must-revalidate, no-cache, max-age=0 |
client-request-id | HTTP response header: client-request-id | 33e59775-3b6f-4cf1-86a8-8a3cb1c4e301 |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 17 Oct 2024 12:51:44 GMT |
Expires | The date/time after which the response is considered stale | 0 |
Pragma | HTTP response header: Pragma | no-cache |
request-id | HTTP response header: request-id | 33e59775-3b6f-4cf1-86a8-8a3cb1c4e301 |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
Vary | HTTP response header: Vary | Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Accept-Encoding |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
x-ms-ags-diagnostic | HTTP response header: x-ms-ags-diagnostic | {"ServerInfo":{"DataCenter":"Central India","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"PN3PEPF000003CB"}} |