Supported Microsoft Defender for Endpoint query APIs

Applies to:


Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

Learn about the supported response-related API calls you can run and details such as the required request headers, and expected response from the calls.

In this section

Topic Description
Collect investigation package Run this API to collect an investigation package from a device.
Isolate device Run this API to isolate a device from the network.
Unisolate device Remove a device from isolation.
Restrict code execution Run this API to contain an attack by stopping malicious processes. You can also lock down a device and prevent subsequent attempts of potentially malicious programs from running.
Unrestrict code execution Run this to reverse the restriction of applications policy after you have verified that the compromised device has been remediated.
Run antivirus scan Remotely initiate an antivirus scan to help identify and remediate malware that might be present on a compromised device.
Stop and quarantine file Run this call to stop running processes, quarantine files, and delete persistency such as registry keys.
Request sample Run this call to request a sample of a file from a specific device. The file will be collected from the device and uploaded to a secure storage.
Block file Run this API to prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware.
Unblock file Allow a file run in the organization using Microsoft Defender Antivirus.
Get package SAS URI Run this API to get a URI that allows downloading an investigation package.
Get MachineAction object Run this API to get MachineAction object.
Get MachineActions collection Run this to get MachineAction collection.
Get FileActions collection Run this API to get FileActions collection.
Get FileMachineAction object Run this API to get FileMachineAction object.
Get FileMachineActions collection Run this API to get FileMachineAction collection.