Forum Discussion

Vaman-Kini's avatar
Vaman-Kini
Brass Contributor
May 04, 2020

Defender ATP - Lookup Hash and Domain

Defender ATP console is able to show that a hash or a domain has been previously seen on the hosts in the tenant.  is there an graph API that could be leveraged to  search for hosts with that hash or have seen traffic to a domain. 

2 Replies

  • kylemiller061's avatar
    kylemiller061
    Brass Contributor
    May 04, 2020

    Vaman-Kini - Yes, you can use the MDATP (Securitycenter) API's domain and file endpoints to retrieve statistic's related to domain and hash observations and lists of machines that have been observed interacting with those entities. You can utilize the API Explorer in the MDATP portal to try them out.

     

    https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines

    https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines

Resources