Adaptive Application Controls - List

  • Reference
Service:
Defender for Cloud
API Version:
2020-01-01

Gets a list of application control machine groups for the subscription.

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/applicationWhitelistings?api-version=2020-01-01
With optional parameters: 
GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/applicationWhitelistings?api-version=2020-01-01&includePathRecommendations={includePathRecommendations}&summary={summary}

URI Parameters

Name In Required Type Description
subscriptionId
 path True

string

Azure subscription ID

Regex pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
api-version
 query True

string

API version for the operation
includePathRecommendations
 query

boolean

Include the policy rules
summary
 query

boolean

Return output in a summarized form

Responses

Name Type Description
200 OK

AdaptiveApplicationControlGroups

OK
Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Gets a list of application control groups of machines for the subscription

Sample Request

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/applicationWhitelistings?api-version=2020-01-01&includePathRecommendations=True&summary=False

Sample Response

Status code:
200 
{
  "value": [
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/locations/centralus/applicationWhitelistings/AMIT-VA",
      "name": "AMIT-VA",
      "type": "Microsoft.Security/applicationWhitelistings",
      "location": "centralus",
      "properties": {
        "recommendationStatus": "Recommended",
        "enforcementMode": "Audit",
        "protectionMode": {
          "exe": "Audit",
          "msi": "Audit",
          "script": "None"
        },
        "vmRecommendations": [
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/erelh-dsc/providers/microsoft.compute/virtualmachines/erelh-14011",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Supported"
          },
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/amit-va/providers/microsoft.compute/virtualmachines/ream-test",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Supported"
          },
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/v-arrikl-scheduledapps/providers/microsoft.compute/virtualmachines/v-arrikl-14060",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Supported"
          }
        ],
        "pathRecommendations": [
          {
            "path": "C:\\Windows\\SoftwareDistribution\\Download\\Install\\Windows-KB890830-x64-V5.53-delta.exe",
            "type": "File",
            "common": true,
            "action": "Remove",
            "usernames": [
              {
                "username": "LOCAL SYSTEM",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-5-18"
            ],
            "fileType": "Exe",
            "configurationStatus": "NoStatus"
          },
          {
            "path": "C:\\WindowsAzure\\GuestAgent_2.7.1198.822\\CollectGuestLogs.exe",
            "type": "File",
            "common": true,
            "action": "Remove",
            "usernames": [
              {
                "username": "LOCAL SYSTEM",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-5-18"
            ],
            "fileType": "Exe",
            "configurationStatus": "NoStatus"
          },
          {
            "path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "type": "PublisherSignature",
            "publisherInfo": {
              "publisherName": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US",
              "productName": "*",
              "binaryName": "*",
              "version": "0.0.0.0"
            },
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "Everyone",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-5-18",
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          },
          {
            "path": "%OSDRIVE%\\WINDOWSAZURE\\SECAGENT\\WASECAGENTPROV.EXE",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "Everyone",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          }
        ],
        "configurationStatus": "Configured",
        "issues": [],
        "sourceSystem": "Azure_AppLocker"
      }
    },
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/locations/centralus/applicationWhitelistings/ERELGROUP1",
      "name": "ERELGROUP1",
      "type": "Microsoft.Security/applicationWhitelistings",
      "location": "centralus",
      "properties": {
        "recommendationStatus": "Recommended",
        "enforcementMode": "Audit",
        "protectionMode": {
          "exe": "Audit",
          "msi": "None",
          "script": "None"
        },
        "vmRecommendations": [
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/erelh-stable/providers/microsoft.compute/virtualmachines/erelh-16090",
            "recommendationAction": "Recommended",
            "enforcementSupport": "NotSupported"
          }
        ],
        "pathRecommendations": [
          {
            "path": "[Exe] O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\*\\*\\0.0.0.0",
            "type": "PublisherSignature",
            "publisherInfo": {
              "publisherName": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US",
              "productName": "*",
              "binaryName": "*",
              "version": "0.0.0.0"
            },
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "Everyone",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          }
        ],
        "configurationStatus": "Configured",
        "issues": [],
        "sourceSystem": "Azure_AppLocker"
      }
    },
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/locations/centralus/applicationWhitelistings/GROUP1",
      "name": "GROUP1",
      "type": "Microsoft.Security/applicationWhitelistings",
      "location": "centralus",
      "properties": {
        "recommendationStatus": "Recommended",
        "enforcementMode": "Audit",
        "protectionMode": {
          "exe": "Audit",
          "msi": "None",
          "script": "None"
        },
        "vmRecommendations": [
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/talk-va/providers/microsoft.compute/virtualmachines/tal-win-vm",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Supported"
          },
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/talk-va/providers/microsoft.compute/virtualmachines/tal-win-vm-jit",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Supported"
          },
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/myresourcegroup/providers/microsoft.compute/virtualmachines/myvmweb",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Supported"
          },
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/v-arrikl-scheduledapps/providers/microsoft.compute/virtualmachines/v-arrikl-14061",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Supported"
          }
        ],
        "pathRecommendations": [
          {
            "path": "[Exe] O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\*\\*\\0.0.0.0",
            "type": "PublisherSignature",
            "publisherInfo": {
              "publisherName": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US",
              "productName": "*",
              "binaryName": "*",
              "version": "0.0.0.0"
            },
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "Everyone",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          },
          {
            "path": "%OSDRIVE%\\WINDOWSAZURE\\SECAGENT\\WASECAGENTPROV.EXE",
            "type": "ProductSignature",
            "publisherInfo": {
              "publisherName": "CN=MICROSOFT AZURE DEPENDENCY CODE SIGN",
              "productName": "MICROSOFT® COREXT",
              "binaryName": "*",
              "version": "0.0.0.0"
            },
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "NT AUTHORITY\\SYSTEM",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          },
          {
            "path": "%PROGRAMFILES%\\RAPID7\\INSIGHT AGENT\\COMPONENTS\\INSIGHT_AGENT\\2.6.7.9\\GET_PROXY.EXE",
            "type": "PublisherSignature",
            "publisherInfo": {
              "publisherName": "O=RAPID7 LLC, L=BOSTON, S=MASSACHUSETTS, C=US",
              "productName": "*",
              "binaryName": "*",
              "version": "0.0.0.0"
            },
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "NT AUTHORITY\\SYSTEM",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          },
          {
            "path": "%PROGRAMFILES%\\GOOGLE\\CHROME\\APPLICATION\\CHROME.EXE",
            "type": "ProductSignature",
            "publisherInfo": {
              "publisherName": "O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US",
              "productName": "GOOGLE CHROME",
              "binaryName": "*",
              "version": "0.0.0.0"
            },
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "NT AUTHORITY\\SYSTEM",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          },
          {
            "path": "O=GOOGLE INC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US\\GOOGLE UPDATE\\*\\0.0.0.0",
            "type": "ProductSignature",
            "publisherInfo": {
              "publisherName": "O=GOOGLE INC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US",
              "productName": "GOOGLE UPDATE",
              "binaryName": "*",
              "version": "0.0.0.0"
            },
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "NT AUTHORITY\\SYSTEM",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Exe",
            "configurationStatus": "Configured"
          }
        ],
        "configurationStatus": "Configured",
        "issues": [],
        "sourceSystem": "Azure_AppLocker"
      }
    },
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/providers/Microsoft.Security/locations/westeurope/applicationWhitelistings/GROUP1",
      "name": "GROUP1",
      "type": "Microsoft.Security/applicationWhitelistings",
      "location": "westeurope",
      "properties": {
        "recommendationStatus": "Recommended",
        "enforcementMode": "Audit",
        "protectionMode": {
          "executable": "Audit"
        },
        "vmRecommendations": [
          {
            "configurationStatus": "Configured",
            "resourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/nic-no-pip/providers/microsoft.compute/virtualmachines/nic-no-pip-vm",
            "recommendationAction": "Recommended",
            "enforcementSupport": "Unknown"
          }
        ],
        "pathRecommendations": [
          {
            "path": "/sbin/init",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/sbin/upstart-udev-bridge",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/lib/systemd/systemd-udevd",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/sbin/upstart-socket-bridge",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/sbin/dhclient",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/bin/python3.4",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/sbin/upstart-file-bridge",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/bin/dbus-daemon",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "messagebus",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/lib/systemd/systemd-logind",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/sbin/getty",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/sbin/atd",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/sbin/cron",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/sbin/acpid",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/sbin/sshd",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/lib/linux-lts-xenial-tools-4.4.0-103/hv_vss_daemon",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/lib/linux-lts-xenial-tools-4.4.0-103/hv_kvp_daemon",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/sbin/nscd",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "unscd",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/sbin/ntpd",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "ntp",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/microsoft/auoms/bin/auomscollect",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/omi/bin/omiserver",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/omi/bin/omiengine",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "omi",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/omi/bin/omiagent",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/sbin/rsyslogd",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "syslog",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/bin/python2.7",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              },
              {
                "username": "omsagent",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/microsoft/omsagent/ruby/bin/ruby",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "omsagent",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/microsoft/auoms/bin/auoms",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/bin/dash",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "omsagent",
                "recommendationAction": "Recommended"
              },
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/bin/sleep",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "omsagent",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/dsc/bin/dsc_host",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "omsagent",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/bin/sudo",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/bin/bash",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/bin/apt-get",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/lib/apt/methods/http",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/lib/apt/methods/gpgv",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/lib/apt/methods/copy",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "root",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/usr/bin/pgrep",
            "type": "File",
            "common": true,
            "action": "Recommended",
            "usernames": [
              {
                "username": "omsagent",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          },
          {
            "path": "/opt/microsoft/omsconfig/bin/omsconsistencyinvoker",
            "type": "File",
            "common": false,
            "action": "Recommended",
            "usernames": [
              {
                "username": "omsagent",
                "recommendationAction": "Recommended"
              }
            ],
            "userSids": [
              "S-1-1-0"
            ],
            "fileType": "Executable",
            "configurationStatus": "Configured"
          }
        ],
        "configurationStatus": "Configured",
        "issues": [
          {
            "issue": "ExecutableViolationsAudited",
            "numberOfVms": 1
          }
        ],
        "sourceSystem": "Azure_AuditD"
      }
    }
  ]
}

Definitions

Name Description
AdaptiveApplicationControlGroup
AdaptiveApplicationControlGroups

Represents a list of VM/server groups and set of rules that are Recommended by Microsoft Defender for Cloud to be allowed
AdaptiveApplicationControlIssue

An alert that machines within a group can have
AdaptiveApplicationControlIssueSummary

Represents a summary of the alerts of the machine group
CloudError

Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
CloudErrorBody

The error detail.
ConfigurationStatus

The configuration status of the machines group or machine or rule
EnforcementMode

The application control policy enforcement/protection mode of the machine group
EnforcementSupport

The machine supportability of Enforce feature
ErrorAdditionalInfo

The resource management error additional info.
FileType

The type of the file (for Linux files - Executable is used)
PathRecommendation

Represents a path that is recommended to be allowed and its properties
ProtectionMode

The protection mode of the collection/file types. Exe/Msi/Script are used for Windows, Executable is used for Linux.
PublisherInfo

Represents the publisher information of a process/rule
RecommendationAction

The recommendation action of the machine or rule
RecommendationStatus

The initial recommendation status of the machine group or machine
RecommendationType

The type of the rule to be allowed
SourceSystem

The source type of the machine group
UserRecommendation

Represents a user that is recommended to be allowed for a certain rule
VmRecommendation

Represents a machine that is part of a machine group

AdaptiveApplicationControlGroup

Name Type Description
id

string

Resource Id
location

string

Location where the resource is stored
name

string

Resource name
properties.configurationStatus

ConfigurationStatus

The configuration status of the machines group or machine or rule
properties.enforcementMode

EnforcementMode

The application control policy enforcement/protection mode of the machine group
properties.issues

AdaptiveApplicationControlIssueSummary[]

Represents a summary of the alerts of the machine group
properties.pathRecommendations

PathRecommendation[]

Represents a path that is recommended to be allowed and its properties
properties.protectionMode

ProtectionMode

The protection mode of the collection/file types. Exe/Msi/Script are used for Windows, Executable is used for Linux.
properties.recommendationStatus

RecommendationStatus

The initial recommendation status of the machine group or machine
properties.sourceSystem

SourceSystem

The source type of the machine group
properties.vmRecommendations

VmRecommendation[]

Represents a machine that is part of a machine group
type

string

Resource type

AdaptiveApplicationControlGroups

Represents a list of VM/server groups and set of rules that are Recommended by Microsoft Defender for Cloud to be allowed

Name Type Description
value

AdaptiveApplicationControlGroup[]

AdaptiveApplicationControlIssue

An alert that machines within a group can have

Name Type Description
ExecutableViolationsAudited

string

MsiAndScriptViolationsAudited

string

MsiAndScriptViolationsBlocked

string

RulesViolatedManually

string

ViolationsAudited

string

ViolationsBlocked

string

AdaptiveApplicationControlIssueSummary

Represents a summary of the alerts of the machine group

Name Type Description
issue

AdaptiveApplicationControlIssue

An alert that machines within a group can have
numberOfVms

number

The number of machines in the group that have this alert

CloudError

Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).

Name Type Description
error.additionalInfo

ErrorAdditionalInfo[]

The error additional info.
error.code

string

The error code.
error.details

CloudErrorBody[]

The error details.
error.message

string

The error message.
error.target

string

The error target.

CloudErrorBody

The error detail.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.
code

string

The error code.
details

CloudErrorBody[]

The error details.
message

string

The error message.
target

string

The error target.

ConfigurationStatus

The configuration status of the machines group or machine or rule

Name Type Description
Configured

string

Failed

string

InProgress

string

NoStatus

string

NotConfigured

string

EnforcementMode

The application control policy enforcement/protection mode of the machine group

Name Type Description
Audit

string

Enforce

string

None

string

EnforcementSupport

The machine supportability of Enforce feature

Name Type Description
NotSupported

string

Supported

string

Unknown

string

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.
type

string

The additional info type.

FileType

The type of the file (for Linux files - Executable is used)

Name Type Description
Dll

string

Exe

string

Executable

string

Msi

string

Script

string

Unknown

string

PathRecommendation

Represents a path that is recommended to be allowed and its properties

Name Type Description
action

RecommendationAction

The recommendation action of the machine or rule
common

boolean

Whether the application is commonly run on the machine
configurationStatus

ConfigurationStatus

The configuration status of the machines group or machine or rule
fileType

FileType

The type of the file (for Linux files - Executable is used)
path

string

The full path of the file, or an identifier of the application
publisherInfo

PublisherInfo

Represents the publisher information of a process/rule
type

RecommendationType

The type of the rule to be allowed
userSids

string[]

A security identifier
usernames

UserRecommendation[]

Represents a user that is recommended to be allowed for a certain rule

ProtectionMode

The protection mode of the collection/file types. Exe/Msi/Script are used for Windows, Executable is used for Linux.

Name Type Description
exe

EnforcementMode

The application control policy enforcement/protection mode of the machine group
executable

EnforcementMode

The application control policy enforcement/protection mode of the machine group
msi

EnforcementMode

The application control policy enforcement/protection mode of the machine group
script

EnforcementMode

The application control policy enforcement/protection mode of the machine group

PublisherInfo

Represents the publisher information of a process/rule

Name Type Description
binaryName

string

The "OriginalName" field taken from the file's version resource
productName

string

The product name taken from the file's version resource
publisherName

string

The Subject field of the x.509 certificate used to sign the code, using the following fields - O = Organization, L = Locality, S = State or Province, and C = Country
version

string

The binary file version taken from the file's version resource

RecommendationAction

The recommendation action of the machine or rule

Name Type Description
Add

string

Recommended

string

Remove

string

RecommendationStatus

The initial recommendation status of the machine group or machine

Name Type Description
NoStatus

string

NotAvailable

string

NotRecommended

string

Recommended

string

RecommendationType

The type of the rule to be allowed

Name Type Description
BinarySignature

string

File

string

FileHash

string

ProductSignature

string

PublisherSignature

string

VersionAndAboveSignature

string

SourceSystem

The source type of the machine group

Name Type Description
Azure_AppLocker

string

Azure_AuditD

string

NonAzure_AppLocker

string

NonAzure_AuditD

string

None

string

UserRecommendation

Represents a user that is recommended to be allowed for a certain rule

Name Type Description
recommendationAction

RecommendationAction

The recommendation action of the machine or rule
username

string

Represents a user that is recommended to be allowed for a certain rule

VmRecommendation

Represents a machine that is part of a machine group

Name Type Description
configurationStatus

ConfigurationStatus

The configuration status of the machines group or machine or rule
enforcementSupport

EnforcementSupport

The machine supportability of Enforce feature
recommendationAction

RecommendationAction

The recommendation action of the machine or rule
resourceId

string

The full resource id of the machine