Find devices by internal IP API

Important

Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender Advanced Threat Protection. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.

Applies to: Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

API description

Find Machines seen with the requested internal IP in the time range of 15 minutes prior and after a given timestamp.

Limitations

  1. The given timestamp must be in the past 30 days.
  2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

Permissions

One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Use Microsoft Defender ATP APIs

Permission type Permission Permission display name
Application Machine.Read.All 'Read all machine profiles'
Application Machine.ReadWrite.All 'Read and write all machine information'
Delegated (work or school account) Machine.Read 'Read machine information'
Delegated (work or school account) Machine.ReadWrite 'Read and write machine information'

Note

When obtaining a token using user credentials:

  • Response will include only devices that the user have access to based on device group settings (See Create and manage device groups for more information)
  • The user needs to have at least the following role permission: 'View Data' (See Create and manage roles for more information)
  • Response will include only devices that the user have access to based on device group settings (See Create and manage device groups for more information)

HTTP request

GET /api/machines/findbyip(ip='{IP}',timestamp={TimeStamp})

Request headers

Name Type Description
Authorization String Bearer {token}. Required.

Request body

Empty

Response

If successful and machines were found - 200 OK with list of the machines in the response body. If no machine found - 404 Not Found. If the timestamp is not in the past 30 days - 400 Bad Request.

Example

Request

Here is an example of the request.

Note

For better performance, you can use server closer to your geo location:

  • api-us.securitycenter.microsoft.com
  • api-eu.securitycenter.microsoft.com
  • api-uk.securitycenter.microsoft.com
GET https://api.securitycenter.windows.com/api/machines/findbyip(ip='10.248.240.38',timestamp=2019-09-22T08:44:05Z)