Forum Discussion
Defender ATP - Lookup Hash and Domain
Defender ATP console is able to show that a hash or a domain has been previously seen on the hosts in the tenant. is there an graph API that could be leveraged to search for hosts with that hash or...
Vaman-Kini - Yes, you can use the MDATP (Securitycenter) API's domain and file endpoints to retrieve statistic's related to domain and hash observations and lists of machines that have been observed interacting with those entities. You can utilize the API Explorer in the MDATP portal to try them out.
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines
kylemiller061 Thank you so much.
