hostTracker resource type

Namespace: microsoft.graph.security

Note

The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.

Represents a unique code or value found within web pages and often used to track user interaction. These codes can be used to correlate a disparate group of websites to a central entity. Often, actors copy the source code of a victim’s website they want to impersonate for a phishing campaign. Seldomly, actors take the time to remove these IDs. Actors might also deploy tracker IDs to see how successful their cyberattack campaigns are. This is similar to marketers using SEO IDs, such as a Google Analytics Tracker ID, to track the success of their marketing campaign.

The hostTracker is associated with a host resource.

Inherits from artifact.

Methods

Method	Return type	Description
Get hostTracker	microsoft.graph.security.hostTracker	Read the properties and relationships of a microsoft.graph.security.hostTracker object.

Properties

Property	Type	Description
firstSeenDateTime	DateTimeOffset	The first date and time when this hostTracker was observed by Microsoft Defender Threat Intelligence. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z.
id	String	A system-generated ID for this hostTracker. Inherited from microsoft.graph.security.artifact.
kind	String	The kind of hostTracker that was detected. For example, GoogleAnalyticsID or JarmHash.
lastSeenDateTime	DateTimeOffset	The most recent date and time when this hostTracker was observed by Microsoft Defender Threat Intelligence. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z.
value	String	The identification value for the hostTracker.

Relationships

Relationship	Type	Description
host	microsoft.graph.security.host	The host related to this hostTracker. When navigating to a hostTracker from a host, this should be assumed to be a return reference.

JSON representation

The following is a JSON representation of the resource.

{
  "@odata.type": "#microsoft.graph.security.hostTracker",
  "firstSeenDateTime": "String (timestamp)",
  "id": "String (identifier)",
  "kind": "String",
  "lastSeenDateTime": "String (timestamp)",
  "value": "String"
}