Incomplete Defender for Endpoint API call via Powershell

Question

Hello!&nbsp;I'm trying to export data from my assets via Powershell, using this api:https://api.securitycenter.microsoft.com/api/machines&nbsp;My script seems to be working fine but unfortunately the JSON-Response doesn't contain all the IP-Addresses displayed in the defender for endpoint portal for each device. Certain addresses are missing. Is there any reason or explanation for that?&nbsp;Also when using this API to access the data for one device:https://api.securitycenter.microsoft.com/api/machines/{id}the response is always null, although the inserted id is correct and the script is the same that works for all machines. When adding vulnerabilities to the same URI:&nbsp;https://api.securitycenter.microsoft.com/api/machines/{id}/vulnerabilities&nbsp;the API endpoint works again.&nbsp;Has anyone experienced anything like this before?Thanks in advance for any hints or ideas on what I could be doing wrong! 🙂&nbsp;This is my Powershell script:&nbsp;&nbsp;

jbmartin6 · Answer

jdyett&nbsp; Have you looked at the raw response rather than the converted JSON? There might be a clue there.&nbsp; My first thought for the blank response was that you might be getting multiple objects returned, but that shouldn't happen with device Id.

jimbjo · Answer

jdyett&nbsp;Hi, I think there's an inconsistency with the id parameter in that api (https://api.securitycenter.microsoft.com/api/machines/{id}) as well as this one:&nbsp;https://api.securitycenter.microsoft.com/api/machines/{id}/software. The API expects the "Device id" you can find in the Defender GUI when viewing a single machine. But, this is not the same as the "id" parameter returned by this api:&nbsp;https://api.securitycenter.microsoft.com/api/machines. I haven't yet found a way to get the correct id, that is the "Device id" from the securitycenter API. Maybe someone can help with this?

jbmartin6 · Answer

JimBjo What you describe is not what I see in my org's MDE UI and API, from what I see and use the deviceId value is consistent across all of the points you mention.

jimbjo · Answer

Very interesting, when experimenting further I can see that for some machines I get more than one match by matching on DNS, 3 in one case, and one of these have an id (that is the name of the property in the returned json) that matches "Device id". I clearly need to examine this further.

jbmartin6 · Answer

Oh, I did not think of that. We do have a subset of inactive devices in MDE where the authentication token was reset due to a bug in the 22H2 upgrade. Those have 2 listings if we look them up by hostname, so that could cause confusion if we got the deviceId mixed up. In those cases though I would expect to get the data from the last update to the old deviceId before the reset. Interesting, I will bear that possibility in mind if we see anything like you describe.

Forum Discussion

Incomplete Defender for Endpoint API call via Powershell

Share

Resources