API оповещений спискаList alerts API

Область применения:Applies to:

Хотите испытать Microsoft Defender для конечной точки?Want to experience Microsoft Defender for Endpoint? Зарегистрився для бесплатной пробной.Sign up for a free trial.

Примечание

Если вы клиент правительства США, используйте URL-адреса, указанные в Microsoft Defender для конечных точек для государственных клиентов США.If you are a US Government customer, please use the URIs listed in Microsoft Defender for Endpoint for US Government customers.

Совет

Для улучшения производительности можно использовать сервер ближе к географическому расположению:For better performance, you can use server closer to your geo location:

  • api-us.securitycenter.microsoft.comapi-us.securitycenter.microsoft.com
  • api-eu.securitycenter.microsoft.comapi-eu.securitycenter.microsoft.com
  • api-uk.securitycenter.microsoft.comapi-uk.securitycenter.microsoft.com

Описание APIAPI description

Извлекает коллекцию оповещений.Retrieves a collection of Alerts.
Поддерживает запросы OData V4.Supports OData V4 queries.
Операторы, поддерживаемые OData:OData supported operators:
$filter on: alertCreationTime lastUpdateTime , , , , , incidentId InvestigationId и status severity category свойства.$filter on: alertCreationTime, lastUpdateTime, incidentId,InvestigationId, status, severity and category properties.
$top максимальное значение 10 000$top with max value of 10,000
$skip
$expand из evidence$expand of evidence
Примеры запросов OData в Microsoft Defender для конечной точкиSee examples at OData queries with Microsoft Defender for Endpoint

ОграниченияLimitations

  1. Вы можете получать последние обновления оповещений в соответствии с настроенным периодом хранения.You can get alerts last updated according to your configured retention period.
  2. Максимальный размер страницы — 10 000.Maximum page size is 10,000.
  3. Ограничения скорости для этого API : 100 вызовов в минуту и 1500 вызовов в час.Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

РазрешенияPermissions

Для вызова этого API требуется одно из следующих разрешений.One of the following permissions is required to call this API. Дополнительные дополнительные информации, в том числе о выборе разрешений, см. в этой ссылке: Использование API endpoint Defender для Microsoft DefenderTo learn more, including how to choose permissions, see Use Microsoft Defender for Endpoint APIs

Тип разрешенияPermission type РазрешениеPermission Имя отображения разрешенийPermission display name
ПриложениеApplication Alert.Read.AllAlert.Read.All 'Read all alerts''Read all alerts'
ПриложениеApplication Alert.ReadWrite.AllAlert.ReadWrite.All 'Read and write all alerts''Read and write all alerts'
Делегированные (рабочая или учебная учетная запись)Delegated (work or school account) Alert.ReadAlert.Read 'Read alerts''Read alerts'
Делегированные (рабочая или учебная учетная запись)Delegated (work or school account) Alert.ReadWriteAlert.ReadWrite 'Read and write alerts''Read and write alerts'

Примечание

При получении маркера с помощью учетных данных пользователей:When obtaining a token using user credentials:

  • Пользователю необходимо иметь по крайней мере следующее разрешение на роль: "Просмотр данных" (см. создание и управление ролями для получения дополнительных сведений)The user needs to have at least the following role permission: 'View Data' (See Create and manage roles for more information)
  • В ответ будут включены только оповещения, связанные с устройствами, к которые пользователь может получить доступ на основе параметров группы устройств (см. дополнительные сведения о создании и управлении группами устройств).The response will include only alerts that are associated with devices that the user can access, based on device group settings (See Create and manage device groups for more information)

HTTP-запросHTTP request

GET /api/alerts

Заголовки запросовRequest headers

ИмяName ТипType ОписаниеDescription
АвторизацияAuthorization StringString Bearer {token}.Bearer {token}. Обязательное поле.Required.

Тело запросаRequest body

переменная EmptyEmpty

ОткликResponse

В случае успеха этот метод возвращает 200 ОК и список объектов оповещения в теле отклика.If successful, this method returns 200 OK, and a list of alert objects in the response body.

Пример 1 . По умолчаниюExample 1 - Default

ЗапросRequest

Ниже приведен пример запроса.Here is an example of the request.

GET https://api.securitycenter.microsoft.com/api/alerts

ОткликResponse

Ниже приведен пример отклика.Here is an example of the response.

Примечание

Список ответов, показанный здесь, может быть усечен для краткости.The response list shown here may be truncated for brevity. Все оповещения будут возвращены с фактического вызова.All alerts will be returned from an actual call.

{
    "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Alerts",
    "value": [
        {
            "id": "da637308392288907382_-880718168",
            "incidentId": 7587,
            "investigationId": 723156,
            "assignedTo": "secop123@contoso.com",
            "severity": "Low",
            "status": "New",
            "classification": "TruePositive",
            "determination": null,
            "investigationState": "Queued",
            "detectionSource": "WindowsDefenderAv",
            "category": "SuspiciousActivity",
            "threatFamilyName": "Meterpreter",
            "title": "Suspicious 'Meterpreter' behavior was detected",
            "description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.",
            "alertCreationTime": "2020-07-20T10:53:48.7657932Z",
            "firstEventTime": "2020-07-20T10:52:17.6654369Z",
            "lastEventTime": "2020-07-20T10:52:18.1362905Z",
            "lastUpdateTime": "2020-07-20T10:53:50.19Z",
            "resolvedTime": null,
            "machineId": "12ee6dd8c833c8a052ea231ec1b19adaf497b625",
            "computerDnsName": "temp123.middleeast.corp.microsoft.com",
            "rbacGroupName": "MiddleEast",
            "aadTenantId": "a839b112-1253-6432-9bf6-94542403f21c",
            "threatName": null,
            "mitreTechniques": [
                "T1064",
                "T1085",
                "T1220"
            ],
            "relatedUser": {
                "userName": "temp123",
                "domainName": "MIDDLEEAST"
            },
            "comments": [
                {
                    "comment": "test comment for docs",
                    "createdBy": "secop123@contoso.com",
                    "createdTime": "2020-07-21T01:00:37.8404534Z"
                }
            ],
            "evidence": []
        }
        ...
    ]
}

ЗапросRequest

Ниже приведен пример запроса.Here is an example of the request.

GET https://api.securitycenter.microsoft.com/api/alerts?$top=10&$expand=evidence

ОткликResponse

Ниже приведен пример отклика.Here is an example of the response.

Примечание

Список ответов, показанный здесь, может быть усечен для краткости.The response list shown here may be truncated for brevity. Все оповещения будут возвращены с фактического вызова.All alerts will be returned from an actual call.

{
    "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Alerts",
    "value": [
        {
            "id": "da637472900382838869_1364969609",
            "incidentId": 1126093,
            "investigationId": null,
            "assignedTo": null,
            "severity": "Low",
            "status": "New",
            "classification": null,
            "determination": null,
            "investigationState": "Queued",
            "detectionSource": "WindowsDefenderAtp",
            "detectorId": "17e10bbc-3a68-474a-8aad-faef14d43952",
            "category": "Execution",
            "threatFamilyName": null,
            "title": "Low-reputation arbitrary code executed by signed executable",
            "description": "Binaries signed by Microsoft can be used to run low-reputation arbitrary code. This technique hides the execution of malicious code within a trusted process. As a result, the trusted process might exhibit suspicious behaviors, such as opening a listening port or connecting to a command-and-control (C&C) server.",
            "alertCreationTime": "2021-01-26T20:33:57.7220239Z",
            "firstEventTime": "2021-01-26T20:31:32.9562661Z",
            "lastEventTime": "2021-01-26T20:31:33.0577322Z",
            "lastUpdateTime": "2021-01-26T20:33:59.2Z",
            "resolvedTime": null,
            "machineId": "111e6dd8c833c8a052ea231ec1b19adaf497b625",
            "computerDnsName": "temp123.middleeast.corp.microsoft.com",
            "rbacGroupName": "A",
            "aadTenantId": "a839b112-1253-6432-9bf6-94542403f21c",
            "threatName": null,
            "mitreTechniques": [
                "T1064",
                "T1085",
                "T1220"
            ],
            "relatedUser": {
                "userName": "temp123",
                "domainName": "MIDDLEEAST"
            },
            "comments": [
                {
                    "comment": "test comment for docs",
                    "createdBy": "secop123@contoso.com",
                    "createdTime": "2021-01-26T01:00:37.8404534Z"
                }
            ],
            "evidence": [
                {
                    "entityType": "User",
                    "evidenceCreationTime": "2021-01-26T20:33:58.42Z",
                    "sha1": null,
                    "sha256": null,
                    "fileName": null,
                    "filePath": null,
                    "processId": null,
                    "processCommandLine": null,
                    "processCreationTime": null,
                    "parentProcessId": null,
                    "parentProcessCreationTime": null,
                    "parentProcessFileName": null,
                    "parentProcessFilePath": null,
                    "ipAddress": null,
                    "url": null,
                    "registryKey": null,
                    "registryHive": null,
                    "registryValueType": null,
                    "registryValue": null,
                    "accountName": "eranb",
                    "domainName": "MIDDLEEAST",
                    "userSid": "S-1-5-21-11111607-1111760036-109187956-75141",
                    "aadUserId": "11118379-2a59-1111-ac3c-a51eb4a3c627",
                    "userPrincipalName": "temp123@microsoft.com",
                    "detectionStatus": null
                },
                {
                    "entityType": "Process",
                    "evidenceCreationTime": "2021-01-26T20:33:58.6133333Z",
                    "sha1": "ff836cfb1af40252bd2a2ea843032e99a5b262ed",
                    "sha256": "a4752c71d81afd3d5865d24ddb11a6b0c615062fcc448d24050c2172d2cbccd6",
                    "fileName": "rundll32.exe",
                    "filePath": "C:\\Windows\\SysWOW64",
                    "processId": 3276,
                    "processCommandLine": "rundll32.exe  c:\\temp\\suspicious.dll,RepeatAfterMe",
                    "processCreationTime": "2021-01-26T20:31:32.9581596Z",
                    "parentProcessId": 8420,
                    "parentProcessCreationTime": "2021-01-26T20:31:32.9004163Z",
                    "parentProcessFileName": "rundll32.exe",
                    "parentProcessFilePath": "C:\\Windows\\System32",
                    "ipAddress": null,
                    "url": null,
                    "registryKey": null,
                    "registryHive": null,
                    "registryValueType": null,
                    "registryValue": null,
                    "accountName": null,
                    "domainName": null,
                    "userSid": null,
                    "aadUserId": null,
                    "userPrincipalName": null,
                    "detectionStatus": "Detected"
                },
                {
                    "entityType": "File",
                    "evidenceCreationTime": "2021-01-26T20:33:58.42Z",
                    "sha1": "8563f95b2f8a284fc99da44500cd51a77c1ff36c",
                    "sha256": "dc0ade0c95d6db98882bc8fa6707e64353cd6f7767ff48d6a81a6c2aef21c608",
                    "fileName": "suspicious.dll",
                    "filePath": "c:\\temp",
                    "processId": null,
                    "processCommandLine": null,
                    "processCreationTime": null,
                    "parentProcessId": null,
                    "parentProcessCreationTime": null,
                    "parentProcessFileName": null,
                    "parentProcessFilePath": null,
                    "ipAddress": null,
                    "url": null,
                    "registryKey": null,
                    "registryHive": null,
                    "registryValueType": null,
                    "registryValue": null,
                    "accountName": null,
                    "domainName": null,
                    "userSid": null,
                    "aadUserId": null,
                    "userPrincipalName": null,
                    "detectionStatus": "Detected"
                }
            ]
        },
        ...
    ]
}

См. такжеSee also