--- title: Microsoft defender threat intelligence slug: connectors/microsoft-defender-threat-intelligence docTags: createdAt: 2026-06-09T16:29:41.235Z --- The Microsoft Defender Threat Intelligence connector enables automated access to threat intelligence data, facilitating proactive cybersecurity measures. Microsoft Defender Threat Intelligence offers a comprehensive suite of threat detection and analysis tools. This connector enables Swimlane Turbine users to integrate with Microsoft's threat intelligence capabilities, allowing for the retrieval and analysis of SSL certificates, passive DNS records, and WHOIS information. By leveraging this integration, security teams can enhance their threat detection and response workflows, gaining access to Microsoft's rich threat intelligence data directly within Swimlane Turbine playbooks. ## Limitations When using **$filter** and **$orderby** in the same query to get messages, make sure to specify properties in the following ways: - Properties that appear in **$orderby** must also appear in $filter. - Properties that appear in **$orderby** are in the same order as in $filter. - Properties that are present in **$orderby** appear in **$filter** before any properties that aren't. Failing to do this results in the following error: - Error code: InefficientFilter - Error message: The restriction or sort order is too complex for this operation. ### Supported Versions This Microsoft Defender Threat Intelligence connector uses the Version 1.0 API. ### Additional Docs - [Microsoft Defender Threat Intelligence Authentication Link](https://learn.microsoft.com/en-us/graph/auth/auth-concepts) - [Microsoft Defender Threat Intelligence API Documentation](https://learn.microsoft.com/en-us/graph/api/resources/security-threatintelligence-overview?view=graph-rest-1.0) - [Microsoft Defender Threat Intelligence Permissions Link](https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http) - [Azure AD OAuth2 flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code) ## Configuration ### Prerequisites To effectively utilize the Microsoft Defender Threat Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites: - OAuth 2.0 client credentials for secure authentication, which include: - URL: Endpoint URL for API access - Client ID: Unique identifier for the application making the request - Client Secret: A secret key known only to the application and the authorization server - Token URL: Endpoint URL to obtain the access token - Scope: Permissions the application requires ## Client Credential Flow Authentication Authentication uses Azure application OAuth2. You will need an admin account in Azure to create the application. Recommended Application Permissions (feel free use custom permissions if you only use certain actions): - ThreatIntelligence.Read.All In order to set up the asset, you need the following: - Azure Application Client ID - Azure Application Client Secret - Azure Tenant ID Steps to create the Azure app: 1. Go to the [App Registration page](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) in the Azure portal. 2. Click **New Registration**. 3. Enter a name for your new application and choose **Accounts in this organizational directory only**, then click **Register** at the bottom. 4. Navigate to the **API permissions** tab on the left navigation menu. 5. Select **Add a permission**. 6. Select **Microsoft Graph**. 7. Select **Application permissions**, then mark all the permissions you need for the actions you are using (See suggested permissions at the top of the asset setup section). 8. Click the **Add permissions** button at the bottom of the page. 9. Select **Grant admin consent** for your organization, then your permissions should look as below. 10. Navigate to the **Certificates & secrets** tab and select **New client secret**. 11. Fill out the description and expiration, then click the **Add** button at the bottom. 12. The **Value** of the secret you just created is the **Client Secret** needed for the Swimlane asset. 13. Navigate to the **Overview** tab on the left menu. 14. The **Client ID** and **Tenant ID** needed in the asset are shown on this page. The **Client ID**, **Tenant ID**, and **Client Secret** described in the steps above are the credentials you need for the asset. ### Authentication Methods ### OAuth 2.0 Client Credentials To effectively utilize the Microsoft Defender Threat Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites: - OAuth 2.0 client credentials authentication with the following parameters: - URL: Endpoint for the Microsoft Defender Threat Intelligence API. - Client ID: Unique identifier for the application seeking access. - Client Secret: A secret known only to the application and the authorization server. - Token URL: Endpoint to obtain the OAuth 2.0 tokens. - Scope: Permissions the application requires. ## Capabilities This Microsoft Defender Threat Intelligence connector provides the following capabilities: - Get Host SSL Certificate - Get Passive DNS Record - Get SSL Certificate - Get WHOIS History Record - Get WHOIS Record by Host ID - Get WHOIS Record by WHOIS Record ID - List Host SSL Certificates - List Related Hosts - List SSL Certificates - List WHOIS History Records by Host ID - List WHOIS History Records by ID - List WHOIS Records ### Get Host SSL Certificate Get the properties and relationships of a host SSL Certificate object. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-hostsslcertificate-get?view=graph-rest-1.0\&tabs=http). ### Get Passive DNS Record Read the properties and relationships of a passive DNS Record object. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-passivednsrecord-get?view=graph-rest-1.0\&tabs=http). ### Get SSL Certificate Get the properties and relationships of an SSL Certificate object. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-sslcertificate-get?view=graph-rest-1.0\&tabs=http). ### Get WHOIS History Record Get WHOIS history record. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-whoishistoryrecord-get?view=graph-rest-1.0). ### Get WHOIS Record by Host ID To get the current WHOIS Record for the specified host. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-whoisrecord-get?view=graph-rest-1.0\&tabs=http). ### Get WHOIS Record by WHOIS Record ID Get the specified WHOIS Record resource by WHOIS record ID. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-whoisrecord-get?view=graph-rest-1.0\&tabs=http). ### List Host SSL Certificates Get a list of host SSL Certificate objects from the host navigation property. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-host-list-sslcertificates?view=graph-rest-1.0\&tabs=http). ### List Related Hosts Get a list of related host resources associated with an SSL Certificate. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-sslcertificate-list-relatedhosts?view=graph-rest-1.0\&tabs=http). ### List SSL Certificates Get a list of SSL Certificate objects and their properties. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-threatintelligence-list-sslcertificates?view=graph-rest-1.0\&tabs=http). ### List WHOIS History Records by Host ID Get the history for a WHOIS Record, as represented by a collection of whoisHistoryRecord resources. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-whoisrecord-list-history?view=graph-rest-1.0\&tabs=http). ### List WHOIS History Records by ID Get the history for a WHOIS Record, as represented by a collection of WHOIS History Record resources. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-whoisrecord-list-history?view=graph-rest-1.0\&tabs=http). ### List WHOIS Records Get a list of WHOIS record objects. Microsoft Defender Threat Intelligence documentation for this action can be found [here](https://learn.microsoft.com/en-us/graph/api/security-threatintelligence-list-whoisrecords?view=graph-rest-1.0\&tabs=http). # Configurations ## MS Defender Threat Intelligence Oauth Client Creds Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | Must start with [https://login.microsoftonline.com/](https://login.microsoftonline.com/) and then continue with the tenant\_id, and then be prepended with /oauth2/v2.0/token. | string | Required | | client\_id | The client ID. | string | Required | | client\_secret | The client secret. | string | Required | | scope | List of permission scopes for this action. | array | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Host SSL Certificate Retrieve properties and relationships of a specific host SSL Certificate in Microsoft Defender Threat Intelligence using the certificate ID. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/hostSslCertificates/{{hostSslCertificateId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.hostSslCertificateId` | string | Required | The host SSL certificate ID. | | `parameters.$count` | boolean | Optional | Retrieves the total count of matching resources. | | `parameters.$orderby` | array | Optional | Orders results. | | `parameters.$select` | string | Optional | Returns results based on search criteria. | | `parameters.$skip` | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. | | `parameters.$top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"$count":true,"$orderby":[""],"$select":"","$skip":15,"$top":10},"path_parameters":{"hostSslCertificateId":"Y29udG9zby5jb20xNTUwMGZiOTY1NTE1MDVmMWVkYjI0ZGQzYjM2ZmNmZmRiNzY1ODMzYjgxMTg="}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.id` | string | Unique identifier | | `value.firstSeenDateTime` | string | Value for the parameter | | `value.lastSeenDateTime` | string | Value for the parameter | | `value.ports` | array | Value for the parameter | | `value.ports.port` | number | Value for the parameter | | `value.ports.firstSeenDateTime` | string | Value for the parameter | | `value.ports.lastSeenDateTime` | string | Value for the parameter | | `value.host` | object | Value for the parameter | | `value.host.@odata.type` | string | Response data | | `value.host.id` | string | Unique identifier | | `value.sslCertificate` | object | Value for the parameter | | `value.sslCertificate.@odata.context` | string | Response data | | `value.sslCertificate.id` | string | Unique identifier | | `value.sslCertificate.firstSeenDateTime` | string | Value for the parameter | | `value.sslCertificate.lastSeenDateTime` | string | Value for the parameter | | `value.sslCertificate.fingerprint` | string | Value for the parameter | | `value.sslCertificate.sslVersion` | string | Value for the parameter | | `value.sslCertificate.expirationDateTime` | string | Value for the parameter | | `value.sslCertificate.issueDateTime` | string | Value for the parameter | | `value.sslCertificate.sha1` | string | Value for the parameter | | `value.sslCertificate.serialNumber` | string | Value for the parameter | | `value.sslCertificate.subject` | object | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## Get Passive DNS Record Retrieve details and relationships of a specific passive DNS Record object in Microsoft Defender Threat Intelligence using the record ID. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/passiveDnsRecords/{{passiveDnsRecordId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.passiveDnsRecordId` | string | Required | The passive DNS record ID. | | `parameters.$count` | boolean | Optional | Retrieves the total count of matching resources. | | `parameters.$orderby` | array | Optional | Orders results. | | `parameters.$search` | string | Optional | Returns results based on search criteria. | | `parameters.$select` | string | Optional | Filters properties (columns). | | `parameters.$skip` | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. | | `parameters.$top` | number | Optional | Sets the page size of results. | | `parameters.$expand` | array | Optional | Retrieves related resources. | | `parameters.$format` | string | Optional | Returns the results in the specified media format. | | `parameters.$filter` | string | Optional | Filters results (rows). | ### Input Example `{"parameters":{"$count":true,"$orderby":[""],"$search":"","$select":"","$skip":15,"$top":10,"$expand":["children"],"$format":"json","$filter":""},"path_parameters":{"passiveDnsRecordId":"Y29udG9zby5jb20kJDIwLjEwMy44NS4zMyQkZmFsc2U="}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.firstSeenDateTime` | string | Value for the parameter | | `value.lastSeenDateTime` | string | Value for the parameter | | `value.collectedDateTime` | string | Value for the parameter | | `value.recordType` | string | Type of the resource | | `value.parentHost` | object | Value for the parameter | | `value.parentHost.id` | string | Unique identifier | | `value.artifact` | object | Value for the parameter | | `value.artifact.@odata.type` | string | Response data | | `value.artifact.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## Get SSL Certificate Retrieve properties and relationships of an SSL Certificate object in Microsoft Defender Threat Intelligence using the sslCertificateId. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/sslCertificates/{{sslCertificateId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.sslCertificateId` | string | Required | The SSL certificate ID. | | `parameters.$count` | boolean | Optional | Retrieves the total count of matching resources. | | `parameters.$orderby` | array | Optional | Orders results. | | `parameters.$search` | string | Optional | Returns results based on search criteria. | | `parameters.$select` | string | Optional | Filters properties (columns). | | `parameters.$skip` | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. | | `parameters.$top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"$count":true,"$orderby":[""],"$search":"","$select":"","$skip":15,"$top":10},"path_parameters":{"sslCertificateId":"ZmI5NjU1MTUwNWYxZWRiMjRkZDNiMzZmY2ZmZGI3NjU4MzNiODExOA=="}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | object | Value for the parameter | | `value.id` | string | Unique identifier | | `value.firstSeenDateTime` | string | Value for the parameter | | `value.lastSeenDateTime` | string | Value for the parameter | | `value.fingerprint` | string | Value for the parameter | | `value.sslVersion` | string | Value for the parameter | | `value.expirationDateTime` | string | Value for the parameter | | `value.issueDateTime` | string | Value for the parameter | | `value.sha1` | string | Value for the parameter | | `value.serialNumber` | string | Value for the parameter | | `value.subject` | object | Value for the parameter | | `value.subject.commonName` | string | Name of the resource | | `value.subject.address` | object | Value for the parameter | | `value.subject.address.city` | string | Value for the parameter | | `value.subject.address.countryOrRegion` | string | Value for the parameter | | `value.subject.address.postalCode` | object | Value for the parameter | | `value.subject.address.postOfficeBox` | object | Value for the parameter | | `value.subject.address.state` | string | Value for the parameter | | `value.subject.address.street` | object | Value for the parameter | | `value.subject.email` | object | Value for the parameter | | `value.subject.givenName` | object | Name of the resource | | `value.subject.organizationName` | string | Name of the resource | | `value.subject.organizationUnitName` | object | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## Get WHOIS History Record Retrieve the history record for a domain's WHOIS information using its unique identifier in Microsoft Defender Threat Intelligence. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/whoisHistoryRecord/{{whoisHistoryRecordId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ------------------------------------------------------------------- | | `path_parameters.whoisHistoryRecordId` | string | Required | The WHOIS History Record ID. | | `parameters.$select` | string | Optional | Select is supported to limit the properties returned in this query. | ### Input Example `{"path_parameters":{"whoisHistoryRecordId":"Y29udG9zby5jb20kJDY5NjQ3ODEyMDc3NDY1NzI0MzM="}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `expirationDateTime` | string | Time value | | `registrationDateTime` | string | Time value | | `firstSeenDateTime` | object | Time value | | `lastSeenDateTime` | object | Time value | | `lastUpdateDateTime` | string | Time value | | `billing` | object | Output field: billing | | `noc` | object | Output field: noc | | `zone` | object | Output field: zone | | `whoisServer` | string | Output field: whoisServer | | `domainStatus` | string | Status value | | `rawWhoisText` | string | Output field: rawWhoisText | | `abuse` | object | Output field: abuse | | `abuse.email` | string | Output field: abuse.email | | `abuse.name` | object | Name of the resource | | `abuse.organization` | object | Output field: abuse.organization | | `abuse.telephone` | string | Output field: abuse.telephone | | `abuse.fax` | object | Output field: abuse.fax | | `abuse.address` | object | Output field: abuse.address | | `abuse.address.city` | object | Output field: abuse.address.city | | `abuse.address.countryOrRegion` | object | Output field: abuse.address.countryOrRegion | | `abuse.address.postalCode` | object | Output field: abuse.address.postalCode | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## Get WHOIS Record by Host ID Retrieve the current WHOIS record for a specified host using its unique identifier, requiring the hostId as a path parameter. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/hosts/{{hostId}}/whois` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------- | | `path_parameters.hostId` | string | Required | The host ID. | | `parameters.$select` | string | Optional | Select is supported to limit the properties returned in this query. | ### Input Example `{"path_parameters":{"hostId":"contoso.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `id` | string | Unique identifier | | `expirationDateTime` | string | Time value | | `registrationDateTime` | string | Time value | | `firstSeenDateTime` | object | Time value | | `lastSeenDateTime` | object | Time value | | `lastUpdateDateTime` | string | Time value | | `billing` | object | Output field: billing | | `noc` | object | Output field: noc | | `zone` | object | Output field: zone | | `whoisServer` | string | Output field: whoisServer | | `domainStatus` | string | Status value | | `rawWhoisText` | string | Output field: rawWhoisText | | `abuse` | object | Output field: abuse | | `abuse.email` | string | Output field: abuse.email | | `abuse.name` | object | Name of the resource | | `abuse.organization` | object | Output field: abuse.organization | | `abuse.telephone` | string | Output field: abuse.telephone | | `abuse.fax` | object | Output field: abuse.fax | | `abuse.address` | object | Output field: abuse.address | | `abuse.address.city` | object | Output field: abuse.address.city | | `abuse.address.countryOrRegion` | object | Output field: abuse.address.countryOrRegion | | `abuse.address.postalCode` | object | Output field: abuse.address.postalCode | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## Get WHOIS Record by WHOIS Record ID Retrieve a specific WHOIS Record resource using the provided WHOIS record ID in Microsoft Defender Threat Intelligence. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/whoisRecords/{{whoisRecordId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------- | | `path_parameters.whoisRecordId` | string | Required | The WHOIS record ID. | | `parameters.$select` | string | Optional | Select is supported to limit the properties returned in this query. | ### Input Example `{"path_parameters":{"whoisRecordId":"Y29udG9zby5jb20kJDY5NjQ3ODEyMDc3NDY1NzI0MzM="}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.type` | string | Response data | | `id` | string | Unique identifier | | `expirationDateTime` | string | Time value | | `registrationDateTime` | string | Time value | | `firstSeenDateTime` | object | Time value | | `lastSeenDateTime` | object | Time value | | `lastUpdateDateTime` | string | Time value | | `billing` | object | Output field: billing | | `noc` | object | Output field: noc | | `zone` | object | Output field: zone | | `whoisServer` | string | Output field: whoisServer | | `domainStatus` | string | Status value | | `rawWhoisText` | string | Output field: rawWhoisText | | `abuse` | object | Output field: abuse | | `abuse.email` | string | Output field: abuse.email | | `abuse.name` | object | Name of the resource | | `abuse.organization` | object | Output field: abuse.organization | | `abuse.telephone` | string | Output field: abuse.telephone | | `abuse.fax` | object | Output field: abuse.fax | | `abuse.address` | object | Output field: abuse.address | | `abuse.address.city` | object | Output field: abuse.address.city | | `abuse.address.countryOrRegion` | object | Output field: abuse.address.countryOrRegion | | `abuse.address.postalCode` | object | Output field: abuse.address.postalCode | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## List Host SSL Certificates Retrieve a list of SSL Certificate objects associated with a given host ID in Microsoft Defender Threat Intelligence. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/hosts/{{hostId}}/sslCertificates` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.hostId` | string | Required | The host ID. | | `parameters.$count` | boolean | Optional | Retrieves the total count of matching resources. | | `parameters.$orderby` | array | Optional | Orders results. | | `parameters.$select` | string | Optional | Returns results based on search criteria. | | `parameters.$skip` | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. | | `parameters.$top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"$count":true,"$orderby":[""],"$select":"","$skip":15,"$top":10},"path_parameters":{"hostId":"contoso.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.firstSeenDateTime` | string | Value for the parameter | | `value.lastSeenDateTime` | string | Value for the parameter | | `value.ports` | array | Value for the parameter | | `value.ports.port` | number | Value for the parameter | | `value.ports.firstSeenDateTime` | string | Value for the parameter | | `value.ports.lastSeenDateTime` | string | Value for the parameter | | `value.host` | object | Value for the parameter | | `value.host.@odata.type` | string | Response data | | `value.host.id` | string | Unique identifier | | `value.sslCertificate` | object | Value for the parameter | | `value.sslCertificate.@odata.context` | string | Response data | | `value.sslCertificate.id` | string | Unique identifier | | `value.sslCertificate.firstSeenDateTime` | string | Value for the parameter | | `value.sslCertificate.lastSeenDateTime` | string | Value for the parameter | | `value.sslCertificate.fingerprint` | string | Value for the parameter | | `value.sslCertificate.sslVersion` | string | Value for the parameter | | `value.sslCertificate.expirationDateTime` | string | Value for the parameter | | `value.sslCertificate.issueDateTime` | string | Value for the parameter | | `value.sslCertificate.sha1` | string | Value for the parameter | | `value.sslCertificate.serialNumber` | string | Value for the parameter | | `value.sslCertificate.subject` | object | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## List Related Hosts Retrieve a list of host resources related to a specified SSL Certificate ID in Microsoft Defender Threat Intelligence. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/sslCertificates/{{sslCertificateId}}/relatedHosts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.sslCertificateId` | string | Required | The SSL Certificate ID. | | `parameters.$count` | boolean | Optional | Retrieves the total count of matching resources. | | `parameters.$skip` | number | Optional | Indexes into a result set. Also used by some APIs to implement paging and can be used together with $top to manually page results. | | `parameters.$top` | number | Optional | Sets the page size of results. | ### Input Example `{"parameters":{"$count":true,"$skip":15,"$top":10},"path_parameters":{"sslCertificateId":"MDJjODMzNDIzYzYwOTIzNjM1YTA0OTRhMmI2NThjYWM5NDFmM2FmMA=="}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `@odata.context` | string | Response data | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.firstSeenDateTime` | object | Value for the parameter | | `value.lastSeenDateTime` | object | Value for the parameter | | `value.countryOrRegion` | object | Value for the parameter | | `value.netblock` | object | Value for the parameter | | `value.autonomousSystem` | object | Value for the parameter | | `value.hostingProvider` | object | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## List SSL Certificates Retrieve a list of SSL Certificate objects with their properties from Microsoft Defender Threat Intelligence using search parameters. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/sslCertificates` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.$count` | boolean | Optional | Returns a holistic count of the number of SSL Certificate objects. | | `parameters.$orderby` | array | Optional | Supports some properties of the SSL Certificate resource. | | `parameters.$search` | string | Required | Currently supports searching by only one property in a call. Do not include any colon (':') in the search string; simply remove any colon from the property value in the search string, if it exists. | | `parameters.$select` | string | Optional | Limits the properties returned in this query. | | `parameters.$skip` | number | Optional | Skips over elements in pages. You can combine with $top to perform pagination or use the URL returned in @odata.nextLink for server-side pagination. | | `parameters.$top` | number | Optional | Limits the number of elements per page. You can combine with $skip to perform pagination or use the URL returned in @odata.nextLink for server-side pagination. | ### Input Example `{"parameters":{"$count":true,"$orderby":["firstSeenDateTime desc"],"$search":"issuer/commonName:Contoso","$select":"","$skip":15,"$top":10}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.id` | string | Unique identifier | | `value.firstSeenDateTime` | string | Value for the parameter | | `value.lastSeenDateTime` | string | Value for the parameter | | `value.fingerprint` | string | Value for the parameter | | `value.sslVersion` | string | Value for the parameter | | `value.expirationDateTime` | string | Value for the parameter | | `value.issueDateTime` | string | Value for the parameter | | `value.sha1` | string | Value for the parameter | | `value.serialNumber` | string | Value for the parameter | | `value.subject` | object | Value for the parameter | | `value.subject.commonName` | string | Name of the resource | | `value.subject.address` | object | Value for the parameter | | `value.subject.address.city` | string | Value for the parameter | | `value.subject.address.countryOrRegion` | string | Value for the parameter | | `value.subject.address.postalCode` | object | Value for the parameter | | `value.subject.address.postOfficeBox` | object | Value for the parameter | | `value.subject.address.state` | string | Value for the parameter | | `value.subject.address.street` | object | Value for the parameter | | `value.subject.email` | object | Value for the parameter | | `value.subject.givenName` | object | Name of the resource | | `value.subject.organizationName` | string | Name of the resource | | `value.subject.organizationUnitName` | object | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## List WHOIS History Records by Host ID Retrieve the WHOIS record history for a specified host ID in Microsoft Defender Threat Intelligence. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/hosts/{{hostId}}/whois/history` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.hostId` | string | Required | The host ID. | | `parameters.$count` | boolean | Optional | Count is supported to return a holistic count of the number of whoisHistoryRecord objects. | | `parameters.$select` | string | Optional | Select is supported to limit the properties returned in this query. | | `parameters.$skip` | number | Optional | Skip is supported to skip over elements in pages. Combine with $top to perform pagination or use the @odata.nextLink for server-side pagination. | | `parameters.$top` | number | Optional | Top is supported to limit the number of elements per page. Combine with $skip to perform pagination or use the @odata.nextLink for server-side pagination. | ### Input Example `{"parameters":{"$count":true,"$select":"","$skip":15,"$top":10},"path_parameters":{"hostId":"contoso.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.expirationDateTime` | string | Value for the parameter | | `value.registrationDateTime` | string | Value for the parameter | | `value.firstSeenDateTime` | object | Value for the parameter | | `value.lastSeenDateTime` | object | Value for the parameter | | `value.lastUpdateDateTime` | string | Value for the parameter | | `value.billing` | object | Value for the parameter | | `value.noc` | object | Value for the parameter | | `value.zone` | object | Value for the parameter | | `value.whoisServer` | string | Value for the parameter | | `value.domainStatus` | string | Status value | | `value.rawWhoisText` | string | Value for the parameter | | `value.abuse` | object | Value for the parameter | | `value.abuse.email` | string | Value for the parameter | | `value.abuse.name` | object | Name of the resource | | `value.abuse.organization` | object | Value for the parameter | | `value.abuse.telephone` | string | Value for the parameter | | `value.abuse.fax` | object | Value for the parameter | | `value.abuse.address` | object | Value for the parameter | | `value.abuse.address.city` | object | Value for the parameter | | `value.abuse.address.countryOrRegion` | object | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## List WHOIS History Records by ID Retrieve the historical WHOIS record data for a given ID in Microsoft Defender Threat Intelligence. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/whoisRecords/{{id}}/history` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the List WHOIS History Records by ID action | | `parameters.$count` | boolean | Optional | Count is supported to return a holistic count of the number of whoisHistoryRecord objects. | | `parameters.$select` | string | Optional | Select is supported to limit the properties returned in this query. | | `parameters.$skip` | number | Optional | Skip is supported to skip over elements in pages. Combine with $top to perform pagination or use the @odata.nextLink for server-side pagination. | | `parameters.$top` | number | Optional | Top is supported to limit the number of elements per page. Combine with $skip to perform pagination or use the @odata.nextLink for server-side pagination. | ### Input Example `{"parameters":{"$count":true,"$select":"","$skip":15,"$top":10}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.expirationDateTime` | string | Value for the parameter | | `value.registrationDateTime` | string | Value for the parameter | | `value.firstSeenDateTime` | object | Value for the parameter | | `value.lastSeenDateTime` | object | Value for the parameter | | `value.lastUpdateDateTime` | string | Value for the parameter | | `value.billing` | object | Value for the parameter | | `value.noc` | object | Value for the parameter | | `value.zone` | object | Value for the parameter | | `value.whoisServer` | string | Value for the parameter | | `value.domainStatus` | string | Status value | | `value.rawWhoisText` | string | Value for the parameter | | `value.abuse` | object | Value for the parameter | | `value.abuse.email` | string | Value for the parameter | | `value.abuse.name` | object | Name of the resource | | `value.abuse.organization` | object | Value for the parameter | | `value.abuse.telephone` | string | Value for the parameter | | `value.abuse.fax` | object | Value for the parameter | | `value.abuse.address` | object | Value for the parameter | | `value.abuse.address.city` | object | Value for the parameter | | `value.abuse.address.countryOrRegion` | object | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` ## List WHOIS Records Retrieve a list of WHOIS record objects from Microsoft Defender Threat Intelligence using search parameters. ### Endpoint - **URL:** `/v1.0/security/threatIntelligence/whoisRecords` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.$count` | boolean | Optional | Count is supported to return a holistic count of the number of WHOIS Record objects. | | `parameters.$orderby` | array | Optional | Orderby supports some properties of the WHOIS Record resource. | | `parameters.$search` | string | Required | Search is required in the request URL of this API. The API currently only supports searching by one field in a call. | | `parameters.$select` | string | Optional | Select is supported to limit the properties returned in this query. | | `parameters.$skip` | number | Optional | Skip is supported to skip over elements in pages. Combine with $top to perform pagination or use the @odata.nextLink for server-side pagination. | | `parameters.$top` | number | Optional | Top is supported to limit the number of elements per page. Combine with $skip to perform pagination or use the @odata.nextLink for server-side pagination. | ### Input Example `{"parameters":{"$count":true,"$orderby":["registrationDateTime desc"],"$search":"admin/address/state:WA","$select":"","$skip":15,"$top":10}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `value` | array | Value for the parameter | | `value.@odata.type` | string | Response data | | `value.id` | string | Unique identifier | | `value.expirationDateTime` | string | Value for the parameter | | `value.registrationDateTime` | string | Value for the parameter | | `value.firstSeenDateTime` | object | Value for the parameter | | `value.lastSeenDateTime` | object | Value for the parameter | | `value.lastUpdateDateTime` | string | Value for the parameter | | `value.billing` | object | Value for the parameter | | `value.noc` | object | Value for the parameter | | `value.zone` | object | Value for the parameter | | `value.whoisServer` | string | Value for the parameter | | `value.domainStatus` | string | Status value | | `value.rawWhoisText` | string | Value for the parameter | | `value.abuse` | object | Value for the parameter | | `value.abuse.email` | string | Value for the parameter | | `value.abuse.name` | object | Name of the resource | | `value.abuse.organization` | object | Value for the parameter | | `value.abuse.telephone` | string | Value for the parameter | | `value.abuse.fax` | object | Value for the parameter | | `value.abuse.address` | object | Value for the parameter | | `value.abuse.address.city` | object | Value for the parameter | | `value.abuse.address.countryOrRegion` | object | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, must-revalidate, no-cache, max-age=0","Pragma":"no-cache","Transfer-Encoding":"chunked","Content-Type":"application/json","Content-Encoding":"gzip","Expires":"0","Strict-Transport-Security":"max-age=31536000","request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","client-request-id":"33e59775-3b6f-4cf1-86a8-8a3cb1c4e301","x-ms-ags-diagnostic":"{\"ServerInfo\":{\"DataCenter\":\"Central India\",\"Slice\":\"E\",\"Ring\":\"3\",\"ScaleUni...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | no-store, must-revalidate, no-cache, max-age=0 | | client-request-id | HTTP response header: client-request-id | 33e59775-3b6f-4cf1-86a8-8a3cb1c4e301 | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 17 Oct 2024 12:51:44 GMT | | Expires | The date/time after which the response is considered stale | 0 | | Pragma | HTTP response header: Pragma | no-cache | | request-id | HTTP response header: request-id | 33e59775-3b6f-4cf1-86a8-8a3cb1c4e301 | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Accept-Encoding | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | x-ms-ags-diagnostic | HTTP response header: x-ms-ags-diagnostic | \{"ServerInfo":\{"DataCenter":"Central India","Slice":"E","Ring":"3","ScaleUnit":"001","RoleInstance":"PN3PEPF000003CB"}} |