WdatpClient

Attributes

TRIGGER_OPERATIONS `module-attribute`

TRIGGER_OPERATIONS: Dict[str, Dict[str, Any]] = {'WebHooks_CreateWebHook': {'operation_id': 'WebHooks_CreateWebHook', 'path': '/{connectionId}/subscriptions', 'method': 'post', 'required_parameters': ['request'], 'callback_payload_type': 'WebHookSubscriptionTableEntity'}, 'OnNewRemediationActivity': {'operation_id': 'OnNewRemediationActivity', 'path': '/{connectionId}/trigger/api/remediationtasks', 'method': 'get', 'required_parameters': [], 'callback_payload_type': 'OnNewRemediationActivityResponse'}}

Classes

AdvancedHuntingInput `dataclass`

AdvancedHuntingInput(query: str)

Advanced Hunting (Deprecated)

Attributes

query `class-attribute` `instance-attribute`

query: str = dataclass_field(metadata={'wire_name': 'Query'})

The query to run

AdvancedHuntingResponse `dataclass`

AdvancedHuntingResponse(*, stats: Optional[Dict[str, Any]] = None, results: Optional[List[Dict[str, Any]]] = None)

Response for Advanced Hunting (Deprecated)

Attributes

stats `class-attribute` `instance-attribute`

stats: Optional[Dict[str, Any]] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'Stats'})

Stats

CreateAlertByReferenceInput `dataclass`

CreateAlertByReferenceInput(machine_id: str, report_id: str, event_time: str, severity: str, category: str, title: str, description: str, recommended_action: str)

Alerts - Create alert

Attributes

machine_id `class-attribute` `instance-attribute`

machine_id: str = dataclass_field(metadata={'wire_name': 'machineId'})

ID of the machine on which the event was identified

report_id `class-attribute` `instance-attribute`

report_id: str = dataclass_field(metadata={'wire_name': 'reportId'})

Report Id of the event

event_time `class-attribute` `instance-attribute`

event_time: str = dataclass_field(metadata={'wire_name': 'eventTime'})

Time of the event as string, e.g. 2018-08-03T16:45:21.7115183Z

severity `instance-attribute`

severity: str

Severity of the alert.

category `instance-attribute`

category: str

Category of the alert

title `instance-attribute`

title: str

Title of the Alert

description `instance-attribute`

description: str

Description of the Alert

recommended_action `class-attribute` `instance-attribute`

recommended_action: str = dataclass_field(metadata={'wire_name': 'recommendedAction'})

Recommended action for the Alert

Alert `dataclass`

Alert(*, id: Optional[str] = None, incident_id: Optional[int] = None, investigation_id: Optional[int] = None, severity: Optional[str] = None, status: Optional[str] = None, description: Optional[str] = None, alert_creation_time: Optional[str] = None, category: Optional[str] = None, title: Optional[str] = None, threat_family_name: Optional[str] = None, detection_source: Optional[str] = None, classification: Optional[str] = None, determination: Optional[str] = None, assigned_to: Optional[str] = None, resolved_time: Optional[str] = None, last_event_time: Optional[str] = None, first_event_time: Optional[str] = None, machine_id: Optional[str] = None)

Response for Alerts - Create alert

Attributes

id `class-attribute` `instance-attribute`

id: Optional[str] = dataclass_field(default=None, kw_only=True)

Alert identifier

incident_id `class-attribute` `instance-attribute`

incident_id: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'incidentId'})

The ID of the incident

investigation_id `class-attribute` `instance-attribute`

investigation_id: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'investigationId'})

The Id of the investigation

severity `class-attribute` `instance-attribute`

severity: Optional[str] = dataclass_field(default=None, kw_only=True)

Alert severity

status `class-attribute` `instance-attribute`

status: Optional[str] = dataclass_field(default=None, kw_only=True)

Status of the alert

description `class-attribute` `instance-attribute`

description: Optional[str] = dataclass_field(default=None, kw_only=True)

Alert description

alert_creation_time `class-attribute` `instance-attribute`

alert_creation_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'alertCreationTime'})

The time at which the alert was created

category `class-attribute` `instance-attribute`

category: Optional[str] = dataclass_field(default=None, kw_only=True)

Alert category

title `class-attribute` `instance-attribute`

title: Optional[str] = dataclass_field(default=None, kw_only=True)

Alert title

threat_family_name `class-attribute` `instance-attribute`

threat_family_name: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'threatFamilyName'})

Threat family name

detection_source `class-attribute` `instance-attribute`

detection_source: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'detectionSource'})

Detection source

classification `class-attribute` `instance-attribute`

classification: Optional[str] = dataclass_field(default=None, kw_only=True)

Alert classification

determination `class-attribute` `instance-attribute`

determination: Optional[str] = dataclass_field(default=None, kw_only=True)

Alert determination

assigned_to `class-attribute` `instance-attribute`

assigned_to: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'assignedTo'})

Person to whom the alert was assigned

resolved_time `class-attribute` `instance-attribute`

resolved_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'resolvedTime'})

The time at which the alert was resolved

last_event_time `class-attribute` `instance-attribute`

last_event_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'lastEventTime'})

The time of the last event related to the alert

first_event_time `class-attribute` `instance-attribute`

first_event_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'firstEventTime'})

The time of the first event related to the alert

machine_id `class-attribute` `instance-attribute`

machine_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'machineId'})

The identifier of the machine related to the alert

GetAlertsResponse `dataclass`

GetAlertsResponse(*, count: Optional[int] = None, value: Optional[List[Alert | Mapping[str, Any]]] = None, next_link: Optional[str] = None)

Response for Alerts - Get list of alerts

Attributes

count `class-attribute` `instance-attribute`

count: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.count'})

The number of available alerts by this query

value `class-attribute` `instance-attribute`

value: Optional[List[Alert | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

The alerts returned

next_link `class-attribute` `instance-attribute`

next_link: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.nextLink'})

A link to get the next results in case there are more results than requested

PatchAlertInput `dataclass`

PatchAlertInput(*, status: Optional[str] = None, assigned_to: Optional[str] = None, classification: Optional[str] = None, determination: Optional[str] = None)

Alerts - Update alert

Attributes

status `class-attribute` `instance-attribute`

status: Optional[str] = dataclass_field(default=None, kw_only=True)

Status of the alert. One of 'New', 'InProgress' and 'Resolved'

assigned_to `class-attribute` `instance-attribute`

assigned_to: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'assignedTo'})

Person to assign the alert to

classification `class-attribute` `instance-attribute`

classification: Optional[str] = dataclass_field(default=None, kw_only=True)

Classification of the alert. One of 'Unknown', 'FalsePositive', 'TruePositive'

determination `class-attribute` `instance-attribute`

determination: Optional[str] = dataclass_field(default=None, kw_only=True)

The determination of the alert. One of 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'

InitiateInvestigationInput `dataclass`

InitiateInvestigationInput(comment: str)

Actions - Initiate investigation on a machine (to be deprecated)

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the investigation

InitiateInvestigationResponse `dataclass`

InitiateInvestigationResponse(*, value: Optional[str] = None)

Response for Actions - Initiate investigation on a machine (to be deprecated)

Attributes

value `class-attribute` `instance-attribute`

value: Optional[str] = dataclass_field(default=None, kw_only=True)

The ID of the investigation

StartInvestigationInput `dataclass`

StartInvestigationInput(comment: str)

Actions - Start automated investigation on a machine

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the investigation

Investigation `dataclass`

Investigation(*, id: Optional[str] = None, state: Optional[str] = None, status_details: Optional[str] = None, computer_dns_name: Optional[str] = None, machine_id: Optional[str] = None, start_time: Optional[str] = None, end_time: Optional[str] = None)

Response for Actions - Start automated investigation on a machine

Attributes

id `class-attribute` `instance-attribute`

id: Optional[str] = dataclass_field(default=None, kw_only=True)

The ID of the investigation

state `class-attribute` `instance-attribute`

state: Optional[str] = dataclass_field(default=None, kw_only=True)

The state of the investigation (e.g. 'Benign', 'Running', etc..)

status_details `class-attribute` `instance-attribute`

status_details: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'statusDetails'})

Details on the status

computer_dns_name `class-attribute` `instance-attribute`

computer_dns_name: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'computerDnsName'})

The computer name

machine_id `class-attribute` `instance-attribute`

machine_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'machineId'})

The machine ID

start_time `class-attribute` `instance-attribute`

start_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'startTime'})

The UTC time at which investigation was started

end_time `class-attribute` `instance-attribute`

end_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'endTime'})

The UTC time at which investigation was completed

MachineAction `dataclass`

MachineAction(*, id: Optional[str] = None, type_: Optional[str] = None, requestor: Optional[str] = None, requestor_comment: Optional[str] = None, status: Optional[str] = None, machine_id: Optional[str] = None, creation_date_time_utc: Optional[str] = None, last_update_date_time_utc: Optional[str] = None, related_file_info: Optional[Dict[str, Any]] = None, commands: Optional[List[LiveResponseCommandStatus | Mapping[str, Any]]] = None)

Response for Actions - Get single machine action

Attributes

id `class-attribute` `instance-attribute`

id: Optional[str] = dataclass_field(default=None, kw_only=True)

The ID of the machine action

type_ `class-attribute` `instance-attribute`

type_: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'type'})

The type of the action (e.g. 'Isolate', 'CollectInvestigationPackage', ...)

requestor `class-attribute` `instance-attribute`

requestor: Optional[str] = dataclass_field(default=None, kw_only=True)

The person that requested the machine action

requestor_comment `class-attribute` `instance-attribute`

requestor_comment: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'requestorComment'})

The comment associated to the machine action

status `class-attribute` `instance-attribute`

status: Optional[str] = dataclass_field(default=None, kw_only=True)

The status of the machine action (e.g., 'InProgress')

machine_id `class-attribute` `instance-attribute`

machine_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'machineId'})

The ID of the machine on which the action has been performed

creation_date_time_utc `class-attribute` `instance-attribute`

creation_date_time_utc: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'creationDateTimeUtc'})

The UTC time at which the action has been requested

last_update_date_time_utc `class-attribute` `instance-attribute`

last_update_date_time_utc: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'lastUpdateDateTimeUtc'})

The last UTC time at which the action has been updated

related_file_info `class-attribute` `instance-attribute`

related_file_info: Optional[Dict[str, Any]] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'relatedFileInfo'})

relatedFileInfo

commands `class-attribute` `instance-attribute`

commands: Optional[List[LiveResponseCommandStatus | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

Live response machine action commands

CancelSingleMachineActionInput `dataclass`

CancelSingleMachineActionInput(comment: str)

Actions - Cancel a single machine action

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the machine action cancellation

GetLiveResponseDownloadLinkResponse `dataclass`

GetLiveResponseDownloadLinkResponse(*, value: Optional[str] = None)

Response for Actions - Get live response command result download URI

Attributes

value `class-attribute` `instance-attribute`

value: Optional[str] = dataclass_field(default=None, kw_only=True)

The live response command download URI

GetMachineActionsResponse `dataclass`

GetMachineActionsResponse(*, count: Optional[int] = None, value: Optional[List[MachineAction | Mapping[str, Any]]] = None, next_link: Optional[str] = None)

Response for Actions - Get list of machine actions

Attributes

count `class-attribute` `instance-attribute`

count: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.count'})

The number of available machine actions by this query

value `class-attribute` `instance-attribute`

value: Optional[List[MachineAction | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

The machine actions returned

next_link `class-attribute` `instance-attribute`

next_link: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.nextLink'})

A link to get the next results in case there are more results than requested

FileStats `dataclass`

FileStats(*, sha1: Optional[str] = None, globally_prevalence: Optional[int] = None, global_first_observed: Optional[str] = None, global_last_observed: Optional[str] = None, organization_prevalence: Optional[int] = None, org_first_seen: Optional[str] = None, org_last_seen: Optional[str] = None, top_file_names: Optional[List[str]] = None)

Response for Files - Get the statistics for the given file

Attributes

sha1 `class-attribute` `instance-attribute`

sha1: Optional[str] = dataclass_field(default=None, kw_only=True)

The sha1 of the file

globally_prevalence `class-attribute` `instance-attribute`

globally_prevalence: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'globallyPrevalence'})

The file global prevalence.

global_first_observed `class-attribute` `instance-attribute`

global_first_observed: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'globalFirstObserved'})

The first time the file was observed globally.

global_last_observed `class-attribute` `instance-attribute`

global_last_observed: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'globalLastObserved'})

The Last time the file was observed.

organization_prevalence `class-attribute` `instance-attribute`

organization_prevalence: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'organizationPrevalence'})

The file prevalence across organization

org_first_seen `class-attribute` `instance-attribute`

org_first_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'orgFirstSeen'})

The first time the file was observed in the organization.

org_last_seen `class-attribute` `instance-attribute`

org_last_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'orgLastSeen'})

The last time the file was observed in the organization.

top_file_names `class-attribute` `instance-attribute`

top_file_names: Optional[List[str]] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'topFileNames'})

The file names that this file has been presented.

DomainStats `dataclass`

DomainStats(*, host: Optional[str] = None, organization_prevalence: Optional[int] = None, org_first_seen: Optional[str] = None, org_last_seen: Optional[str] = None)

Response for Domains - Get the statistics for the given domain name

Attributes

host `class-attribute` `instance-attribute`

host: Optional[str] = dataclass_field(default=None, kw_only=True)

The domain host.

organization_prevalence `class-attribute` `instance-attribute`

organization_prevalence: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'organizationPrevalence'})

The domain prevalence across organization

org_first_seen `class-attribute` `instance-attribute`

org_first_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'orgFirstSeen'})

The first time the domain was observed in the organization.

org_last_seen `class-attribute` `instance-attribute`

org_last_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'orgLastSeen'})

The last time the domain was observed in the organization.

IpStats `dataclass`

IpStats(*, ip_address: Optional[str] = None, organization_prevalence: Optional[int] = None, org_first_seen: Optional[str] = None, org_last_seen: Optional[str] = None)

Response for Ips - Get the statistics for the given ip address

Attributes

ip_address `class-attribute` `instance-attribute`

ip_address: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'ipAddress'})

The ip address

organization_prevalence `class-attribute` `instance-attribute`

organization_prevalence: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'organizationPrevalence'})

The ip address prevalence across organization

org_first_seen `class-attribute` `instance-attribute`

org_first_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'orgFirstSeen'})

The first time the ip address was observed in the organization.

org_last_seen `class-attribute` `instance-attribute`

org_last_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'orgLastSeen'})

The last time the ip address was observed in the organization.

GetInvestigationsResponse `dataclass`

GetInvestigationsResponse(*, count: Optional[int] = None, value: Optional[List[Investigation | Mapping[str, Any]]] = None, next_link: Optional[str] = None)

Response for Actions - Get list of investigation

Attributes

count `class-attribute` `instance-attribute`

count: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.count'})

The number of available investigations by this query

value `class-attribute` `instance-attribute`

value: Optional[List[Investigation | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

The investigations returned

next_link `class-attribute` `instance-attribute`

next_link: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.nextLink'})

A link to get the next results in case there are more results than requested

CollectInvestigationPackageInput `dataclass`

CollectInvestigationPackageInput(comment: str)

Actions - Collect investigation package

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the collection

GetInvestigationPackageUriResponse `dataclass`

GetInvestigationPackageUriResponse(*, value: Optional[str] = None)

Response for Actions - Get investigation package download URI

Attributes

value `class-attribute` `instance-attribute`

value: Optional[str] = dataclass_field(default=None, kw_only=True)

The investigation package SAS URI

IsolateMachineInput `dataclass`

IsolateMachineInput(comment: str, isolation_type: str)

Actions - Isolate machine

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the isolation

isolation_type `class-attribute` `instance-attribute`

isolation_type: str = dataclass_field(metadata={'wire_name': 'IsolationType'})

Type of the isolation. Allowed values are 'Full' (for full isolation) or 'Selective' (to restrict only limited set of applications from accessing the network)

UnisolateMachineInput `dataclass`

UnisolateMachineInput(comment: str)

Actions - Unisolate machine

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the unisolation

RestrictAppExecutionInput `dataclass`

RestrictAppExecutionInput(comment: str)

Actions - Restrict app execution

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the restriction

UnrestrictAppExecutionInput `dataclass`

UnrestrictAppExecutionInput(comment: str)

Actions - Remove app execution restriction

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the restriction removal

RunAntivirusScanInput `dataclass`

RunAntivirusScanInput(comment: str, scan_type: str)

Actions - Run antivirus scan

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the scan request

scan_type `class-attribute` `instance-attribute`

scan_type: str = dataclass_field(metadata={'wire_name': 'ScanType'})

Type of scan to perform. Allowed values are 'Quick' or 'Full'

RunLiveResponseInput `dataclass`

RunLiveResponseInput(comment: str, commands: List[LiveResponseCommand | Mapping[str, Any]])

Actions - Run live response

Attributes

comment `class-attribute` `instance-attribute`

comment: str = dataclass_field(metadata={'wire_name': 'Comment'})

A comment to associate to the isolation

commands `class-attribute` `instance-attribute`

commands: List[LiveResponseCommand | Mapping[str, Any]] = dataclass_field(metadata={'wire_name': 'Commands'})

The live response commands to execute

GetRemediationActivitiesResponse `dataclass`

GetRemediationActivitiesResponse(*, count: Optional[int] = None, value: Optional[List[RemediationActivity | Mapping[str, Any]]] = None, next_link: Optional[str] = None)

Response for Remediation tasks - Get list of remediation activities (Preview)

Attributes

count `class-attribute` `instance-attribute`

count: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.count'})

The number of remediation activities by this query

value `class-attribute` `instance-attribute`

value: Optional[List[RemediationActivity | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

The remediation activities returned

next_link `class-attribute` `instance-attribute`

next_link: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.nextLink'})

A link to get the next results in case there are more results than requested

RemediationActivity `dataclass`

RemediationActivity(*, id: Optional[str] = None, title: Optional[str] = None, created_on: Optional[str] = None, status_last_modified_on: Optional[str] = None, requester_id: Optional[str] = None, requester_email: Optional[str] = None, status: Optional[str] = None, description: Optional[str] = None, related_component: Optional[str] = None, target_devices: Optional[int] = None, rbac_group_names: Optional[List[str]] = None, fixed_devices: Optional[int] = None, requester_notes: Optional[str] = None, due_on: Optional[str] = None, category: Optional[str] = None, productivity_impact_remediation_type: Optional[str] = None, priority: Optional[str] = None, completion_method: Optional[str] = None, completer_id: Optional[str] = None, completer_email: Optional[str] = None, scid: Optional[str] = None, type_: Optional[str] = None, product_id: Optional[str] = None, vendor_id: Optional[str] = None, name_id: Optional[str] = None, recommended_version: Optional[str] = None, recommended_vendor: Optional[str] = None, recommended_program: Optional[str] = None, recommendation_reference: Optional[str] = None)

Response for RemediationActivities - Get single remediation activity (Preview)

Attributes

id `class-attribute` `instance-attribute`

id: Optional[str] = dataclass_field(default=None, kw_only=True)

The remediation activity identifier

title `class-attribute` `instance-attribute`

title: Optional[str] = dataclass_field(default=None, kw_only=True)

The title of the remediation activit

created_on `class-attribute` `instance-attribute`

created_on: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'createdOn'})

The time when the remediation activity was created

status_last_modified_on `class-attribute` `instance-attribute`

status_last_modified_on: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'statusLastModifiedOn'})

The time when the status was last modified

requester_id `class-attribute` `instance-attribute`

requester_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'requesterId'})

The remediation activity creator id

requester_email `class-attribute` `instance-attribute`

requester_email: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'requesterEmail'})

The remediation activity creator email address

status `class-attribute` `instance-attribute`

status: Optional[str] = dataclass_field(default=None, kw_only=True)

the remediation activity status

description `class-attribute` `instance-attribute`

description: Optional[str] = dataclass_field(default=None, kw_only=True)

The description of the remediation activity

related_component `class-attribute` `instance-attribute`

related_component: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'relatedComponent'})

The remediation activity related component

target_devices `class-attribute` `instance-attribute`

target_devices: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'targetDevices'})

The number of the remediation activity target machines

rbac_group_names `class-attribute` `instance-attribute`

rbac_group_names: Optional[List[str]] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'rbacGroupNames'})

The rbac group names associated to the remediation activity

fixed_devices `class-attribute` `instance-attribute`

fixed_devices: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'fixedDevices'})

The number of the remediation activity fixed machines

requester_notes `class-attribute` `instance-attribute`

requester_notes: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'requesterNotes'})

The remediation activity creator notes

due_on `class-attribute` `instance-attribute`

due_on: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'dueOn'})

The due time for the remediation activity

category `class-attribute` `instance-attribute`

category: Optional[str] = dataclass_field(default=None, kw_only=True)

the remediation activity category

productivity_impact_remediation_type `class-attribute` `instance-attribute`

productivity_impact_remediation_type: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'productivityImpactRemediationType'})

the remediation Productivity impact type

priority `class-attribute` `instance-attribute`

priority: Optional[str] = dataclass_field(default=None, kw_only=True)

The remediation activity priority

completion_method `class-attribute` `instance-attribute`

completion_method: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'completionMethod'})

The remediation activity completion method

completer_id `class-attribute` `instance-attribute`

completer_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'completerId'})

The remediation activity completer object id

completer_email `class-attribute` `instance-attribute`

completer_email: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'completerEmail'})

The remediation activity completer email address

scid `class-attribute` `instance-attribute`

scid: Optional[str] = dataclass_field(default=None, kw_only=True)

The remediation activity security configuration id

type_ `class-attribute` `instance-attribute`

type_: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'type'})

The remediation activity type

product_id `class-attribute` `instance-attribute`

product_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'productId'})

Product Id

vendor_id `class-attribute` `instance-attribute`

vendor_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'vendorId'})

Vendor id

name_id `class-attribute` `instance-attribute`

name_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'nameId'})

Name id

recommended_version `class-attribute` `instance-attribute`

recommended_version: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'recommendedVersion'})

Recommended version

recommended_vendor `class-attribute` `instance-attribute`

recommended_vendor: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'recommendedVendor'})

Recommended vendor

recommended_program `class-attribute` `instance-attribute`

recommended_program: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'recommendedProgram'})

Recommended program

recommendation_reference `class-attribute` `instance-attribute`

recommendation_reference: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'RecommendationReference'})

Recommendation reference

GetRemediationActivityMachineListResponse `dataclass`

GetRemediationActivityMachineListResponse(*, count: Optional[int] = None, value: Optional[List[Machine | Mapping[str, Any]]] = None, next_link: Optional[str] = None)

Response for Remediation activities - Get list of related machines (Preview)

Attributes

count `class-attribute` `instance-attribute`

count: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.count'})

The number of available machines by this query

value `class-attribute` `instance-attribute`

value: Optional[List[Machine | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

The machines returned

next_link `class-attribute` `instance-attribute`

next_link: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.nextLink'})

A link to get the next results in case there are more results than requested

GetMachinesResponse `dataclass`

GetMachinesResponse(*, count: Optional[int] = None, value: Optional[List[Machine | Mapping[str, Any]]] = None, next_link: Optional[str] = None)

Response for Machines - Get list of machines

Attributes

count `class-attribute` `instance-attribute`

count: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.count'})

The number of available machines by this query

value `class-attribute` `instance-attribute`

value: Optional[List[Machine | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

The machines returned

next_link `class-attribute` `instance-attribute`

next_link: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.nextLink'})

A link to get the next results in case there are more results than requested

Machine `dataclass`

Machine(*, id: Optional[str] = None, computer_dns_name: Optional[str] = None, first_seen: Optional[str] = None, last_seen: Optional[str] = None, os_platform: Optional[str] = None, os_version: Optional[str] = None, system_product_name: Optional[str] = None, last_ip_address: Optional[str] = None, last_external_ip_address: Optional[str] = None, agent_version: Optional[str] = None, os_build: Optional[int] = None, health_status: Optional[str] = None, is_aad_joined: Optional[bool] = None, machine_tags: Optional[List[str]] = None, rbac_group_id: Optional[int] = None, rbac_group_name: Optional[str] = None, risk_score: Optional[str] = None, aad_device_id: Optional[str] = None)

Response for Machines - Get single machine

Attributes

id `class-attribute` `instance-attribute`

id: Optional[str] = dataclass_field(default=None, kw_only=True)

The machine identifier

computer_dns_name `class-attribute` `instance-attribute`

computer_dns_name: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'computerDnsName'})

The computer name

first_seen `class-attribute` `instance-attribute`

first_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'firstSeen'})

The time of the first event received by the machine

last_seen `class-attribute` `instance-attribute`

last_seen: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'lastSeen'})

The time of the last event received by the machine

os_platform `class-attribute` `instance-attribute`

os_platform: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'osPlatform'})

The OS platform of the machine

os_version `class-attribute` `instance-attribute`

os_version: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'osVersion'})

The OS version of the machine

system_product_name `class-attribute` `instance-attribute`

system_product_name: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'systemProductName'})

systemProductName

last_ip_address `class-attribute` `instance-attribute`

last_ip_address: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'lastIpAddress'})

The last IP address of the machine

last_external_ip_address `class-attribute` `instance-attribute`

last_external_ip_address: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'lastExternalIpAddress'})

The last external IP address of the machine

agent_version `class-attribute` `instance-attribute`

agent_version: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'agentVersion'})

The agent version

os_build `class-attribute` `instance-attribute`

os_build: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'osBuild'})

The OS build of the machine

health_status `class-attribute` `instance-attribute`

health_status: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'healthStatus'})

The health status of the machine

is_aad_joined `class-attribute` `instance-attribute`

is_aad_joined: Optional[bool] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'isAadJoined'})

A flag indicating whether the machine is joined to Microsoft Entra ID

machine_tags `class-attribute` `instance-attribute`

machine_tags: Optional[List[str]] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'machineTags'})

The tags associated to the machine

rbac_group_id `class-attribute` `instance-attribute`

rbac_group_id: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'rbacGroupId'})

The ID of the RBAC group to which the machine belongs

rbac_group_name `class-attribute` `instance-attribute`

rbac_group_name: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'rbacGroupName'})

The name of the RBAC group to which the machine belongs

risk_score `class-attribute` `instance-attribute`

risk_score: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'riskScore'})

A score indicating how much the machine is at risk

aad_device_id `class-attribute` `instance-attribute`

aad_device_id: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'aadDeviceId'})

aadDeviceId

MachineTagInput `dataclass`

MachineTagInput(value: str, action: str)

Machines - Tag machine

Attributes

value `class-attribute` `instance-attribute`

value: str = dataclass_field(metadata={'wire_name': 'Value'})

The tag to add or remove

action `class-attribute` `instance-attribute`

action: str = dataclass_field(metadata={'wire_name': 'Action'})

The action to perform. Value should be one of 'Add' (to add a tag) or 'Remove' (to remove a tag)

WebHookSubscriptionTableEntity `dataclass`

WebHookSubscriptionTableEntity(*, id: Optional[str] = None, notification_url: Optional[str] = None, client_state: Optional[str] = None)

Response for Triggers - Trigger when new WDATP alert occurs

Attributes

notification_url `class-attribute` `instance-attribute`

notification_url: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'notificationUrl'})

Gets or sets the web hook subscription notification URL.

OnNewRemediationActivityResponse `dataclass`

OnNewRemediationActivityResponse(*, count: Optional[int] = None, value: Optional[List[RemediationActivity | Mapping[str, Any]]] = None, next_link: Optional[str] = None)

Response for Triggers when a new remediation activity is created (Preview)

Attributes

count `class-attribute` `instance-attribute`

count: Optional[int] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.count'})

The number of remediation activities by this query

value `class-attribute` `instance-attribute`

value: Optional[List[RemediationActivity | Mapping[str, Any]]] = dataclass_field(default=None, kw_only=True)

The remediation activities returned

next_link `class-attribute` `instance-attribute`

next_link: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': '@odata.nextLink'})

A link to get the next results in case there are more results than requested

AdvancedHuntingSchemaInput `dataclass`

AdvancedHuntingSchemaInput(query: str)

Advanced Hunting Schema

Attributes

query `class-attribute` `instance-attribute`

query: str = dataclass_field(metadata={'wire_name': 'Query'})

The query to run

AdvancedHuntingSchemaResponse `dataclass`

AdvancedHuntingSchemaResponse(*, additional_properties: Dict[str, Any] = dict())

Response for Advanced Hunting Schema

Attributes

additional_properties `class-attribute` `instance-attribute`

additional_properties: Dict[str, Any] = dataclass_field(default_factory=dict, kw_only=True)

Dynamic properties determined at runtime (similar to .NET [JsonExtensionData])

LiveResponseCommandStatus `dataclass`

LiveResponseCommandStatus(*, index: Optional[int] = None, start_time: Optional[str] = None, end_time: Optional[str] = None, command_status: Optional[str] = None, errors: Optional[List[str]] = None, command: Optional[LiveResponseCommand | Mapping[str, Any]] = None)

Definition: LiveResponseCommandStatus

Attributes

index `class-attribute` `instance-attribute`

index: Optional[int] = dataclass_field(default=None, kw_only=True)

The index of the command

start_time `class-attribute` `instance-attribute`

start_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'startTime'})

The command execution start time UTC

end_time `class-attribute` `instance-attribute`

end_time: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'endTime'})

The command execution end time UTC

command_status `class-attribute` `instance-attribute`

command_status: Optional[str] = dataclass_field(default=None, kw_only=True, metadata={'wire_name': 'commandStatus'})

The status of the command execution (e.g., 'Completed')

errors `class-attribute` `instance-attribute`

errors: Optional[List[str]] = dataclass_field(default=None, kw_only=True)

List of command execution errors. In case no errors reported this will be an empty list.

command `class-attribute` `instance-attribute`

command: Optional[LiveResponseCommand | Mapping[str, Any]] = dataclass_field(default=None, kw_only=True)

The live response command

LiveResponseCommand `dataclass`

LiveResponseCommand(type_: str, *, params: Optional[List[Dict[str, Any]]] = None)

Definition: LiveResponseCommand

Attributes

type_ `class-attribute` `instance-attribute`

type_: str = dataclass_field(metadata={'wire_name': 'type'})

The type of the command

params `class-attribute` `instance-attribute`

params: Optional[List[Dict[str, Any]]] = dataclass_field(default=None, kw_only=True)

List of command parameters.

WebHookSubscriptionRequest `dataclass`

WebHookSubscriptionRequest(client_state: str, change_type: str, resource: str, expiration_date_time: str, notification_url: str)

Definition: WebHookSubscriptionRequest

Attributes

client_state `class-attribute` `instance-attribute`

client_state: str = dataclass_field(metadata={'wire_name': 'clientState'})

Gets or sets the client state.

change_type `class-attribute` `instance-attribute`

change_type: str = dataclass_field(metadata={'wire_name': 'changeType'})

Indicates the type of change in the subscribed resource that will raise a notification.

resource `instance-attribute`

resource: str

Specifies the resource that will be monitored for changes.

expiration_date_time `class-attribute` `instance-attribute`

expiration_date_time: str = dataclass_field(metadata={'wire_name': 'expirationDateTime'})

Specifies the date and time when the webhook subscription expires.

notification_url `class-attribute` `instance-attribute`

notification_url: str = dataclass_field(metadata={'wire_name': 'notificationUrl'})

Gets or sets the web hook callback URL.

WebHookNotification `dataclass`

WebHookNotification(*, id: Optional[str] = None, machine_id: Optional[str] = None)

Definition: WebHookNotification

WdatpClient

WdatpClient(connection_runtime_url: str, credential: AsyncTokenCredential | AzureKeyCredential, *, max_retry_attempts: int = 3, timeout: float = 30.0, use_exponential_backoff: bool = True, initial_retry_delay_seconds: float = 0.5, maximum_retry_delay_seconds: float = 120.0, retry_jitter_factor: float = 0.1, retry_unsafe_http_methods: bool = False, transport: Optional[AsyncHttpTransport] = None, **kwargs: Any)

Bases: ConnectorClientBase

Typed client for wdatp connector.

Initialize a WdatpClient.

Parameters:

Name	Type	Description	Default
`connection_runtime_url`	`str`	The connection runtime URL from Azure Portal.	required
`credential`	`AsyncTokenCredential \| AzureKeyCredential`	Caller-owned Azure Core credential.	required
`max_retry_attempts`	`int`	The maximum number of request attempts.	`3`
`timeout`	`float`	The network timeout in seconds for each request. The value configures Azure Core retry and transport deadlines. Nonpositive values disable SDK and transport deadlines.	`30.0`
`use_exponential_backoff`	`bool`	Whether retries use exponential backoff.	`True`
`initial_retry_delay_seconds`	`float`	The initial retry delay in seconds.	`0.5`
`maximum_retry_delay_seconds`	`float`	The maximum retry delay in seconds.	`120.0`
`retry_jitter_factor`	`float`	The jitter fraction applied to retry delays.	`0.1`
`retry_unsafe_http_methods`	`bool`	Whether unsafe HTTP methods may be retried.	`False`
`transport`	`Optional[AsyncHttpTransport]`	Optional Azure Core async HTTP transport closed by the client through its asynchronous lifecycle.	`None`
`**kwargs`	`Any`	Optional Azure Core pipeline policy settings.	`{}`

Methods:

advanced_hunting `async`

advanced_hunting(input: AdvancedHuntingInput | Mapping[str, Any], *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Advanced Hunting (Deprecated)

Run a custom query over Microsoft Defender for Endpoint data. This action supports only queries over MDE tables. This action is deprecated and will be retired on February 1, 2027. Migrate to the Microsoft Graph Security API. For migration guidance, see: https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-1.0#powerplatformflow-migrationpowerapps-power-automate-logic-apps

Swagger operation ID: AdvancedHunting.

Parameters:

Name	Type	Description	Default
`input`	`AdvancedHuntingInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

create_alert_by_reference `async`

create_alert_by_reference(input: CreateAlertByReferenceInput | Mapping[str, Any], *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Alerts - Create alert

Create Alert based on specific Event

Swagger operation ID: CreateAlertByReference.

Parameters:

Name	Type	Description	Default
`input`	`CreateAlertByReferenceInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

list_alerts

list_alerts(*, expand: Optional[str] = None, filter: Optional[str] = None, select: Optional[str] = None, orderby: Optional[str] = None, top: Optional[int] = None, skip: Optional[int] = None, count: Optional[bool] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> AsyncItemPaged[dict[str, Any]]

Alerts - Get list of alerts

Retrieve from Windows Defender ATP the most recent alerts

Returns an Azure Core async pager that follows the connector continuation URL.

Swagger operation ID: GetAlerts.

Parameters:

Name	Type	Description	Default
`expand`	`Optional[str]`	Expands related entities inline.	`None`
`filter`	`Optional[str]`	Filters the results, using OData syntax.	`None`
`select`	`Optional[str]`	Selects which properties to include in the response, defaults to all.	`None`
`orderby`	`Optional[str]`	Sorts the results.	`None`
`top`	`Optional[int]`	Returns only the first n results.	`None`
`skip`	`Optional[int]`	Skips the first n results.	`None`
`count`	`Optional[bool]`	Includes a count of the matching results in the response.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`AsyncItemPaged[dict[str, Any]]`	AsyncItemPaged[dict[str, Any]]: An Azure Core pager over connector results. Consume it with `async for`.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_single_alert `async`

get_single_alert(alert_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Alerts - Get single alert

Retrieve from Windows Defender ATP a specific alert

Swagger operation ID: GetSingleAlert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The identifier of the alert to retrieve.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

patch_alert `async`

patch_alert(input: PatchAlertInput | Mapping[str, Any], alert_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Alerts - Update alert

Update a Windows Defender ATP alert

Swagger operation ID: PatchAlert.

Parameters:

Name	Type	Description	Default
`input`	`PatchAlertInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`alert_id`	`str`	The identifier of the alert to update.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

initiate_investigation `async`

initiate_investigation(input: InitiateInvestigationInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Initiate investigation on a machine (to be deprecated)

Initiate investigation on a machine

Swagger operation ID: InitiateInvestigation.

Parameters:

Name	Type	Description	Default
`input`	`InitiateInvestigationInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to investigate.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

start_investigation `async`

start_investigation(input: StartInvestigationInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Start automated investigation on a machine

Start automated investigation on a machine

Swagger operation ID: StartInvestigation.

Parameters:

Name	Type	Description	Default
`input`	`StartInvestigationInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to investigate.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_single_machine_action `async`

get_single_machine_action(machine_action_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Get single machine action

Retrieve from Windows Defender ATP a specific machine action

Swagger operation ID: GetSingleMachineAction.

Parameters:

Name	Type	Description	Default
`machine_action_id`	`str`	The identifier of the machine action to retrieve.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

cancel_single_machine_action `async`

cancel_single_machine_action(input: CancelSingleMachineActionInput | Mapping[str, Any], machine_action_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Cancel a single machine action

Cancel a specific machine action

Swagger operation ID: CancelSingleMachineAction.

Parameters:

Name	Type	Description	Default
`input`	`CancelSingleMachineActionInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_action_id`	`str`	The identifier of the machine action to cancel.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_live_response_download_link `async`

get_live_response_download_link(machine_action_id: str, command_index: int, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Get live response command result download URI

Get result download URI for a completed live response command

Swagger operation ID: GetLiveResponseDownloadLink.

Parameters:

Name	Type	Description	Default
`machine_action_id`	`str`	The identifier of the machine action.	required
`command_index`	`int`	The index of the live response command to get the results download URI for.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

list_machine_actions

list_machine_actions(*, filter: Optional[str] = None, select: Optional[str] = None, orderby: Optional[str] = None, top: Optional[int] = None, skip: Optional[int] = None, count: Optional[bool] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> AsyncItemPaged[dict[str, Any]]

Actions - Get list of machine actions

Retrieve from Windows Defender ATP the most recent machine actions

Returns an Azure Core async pager that follows the connector continuation URL.

Swagger operation ID: GetMachineActions.

Parameters:

Name	Type	Description	Default
`filter`	`Optional[str]`	Filters the results, using OData syntax.	`None`
`select`	`Optional[str]`	Selects which properties to include in the response, defaults to all.	`None`
`orderby`	`Optional[str]`	Sorts the results.	`None`
`top`	`Optional[int]`	Returns only the first n results.	`None`
`skip`	`Optional[int]`	Skips the first n results.	`None`
`count`	`Optional[bool]`	Includes a count of the matching results in the response.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`AsyncItemPaged[dict[str, Any]]`	AsyncItemPaged[dict[str, Any]]: An Azure Core pager over connector results. Consume it with `async for`.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_file_stats `async`

get_file_stats(file_id: str, *, look_back_hours: Optional[int] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Files - Get the statistics for the given file

Retrieve from Windows Defender ATP statistics for the given file to a given file by identifier Sha1, or Sha256

Swagger operation ID: GetFileStats.

Parameters:

Name	Type	Description	Default
`file_id`	`str`	The file identifier - Sha1, or Sha256.	required
`look_back_hours`	`Optional[int]`	The look back period in hours to look by, the default is 24 hours.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_domain_stats `async`

get_domain_stats(domain_name: str, *, look_back_hours: Optional[int] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Domains - Get the statistics for the given domain name

Retrieve from Windows Defender ATP statistics related to a given domain name

Swagger operation ID: GetDomainStats.

Parameters:

Name	Type	Description	Default
`domain_name`	`str`	The domain name.	required
`look_back_hours`	`Optional[int]`	The look back period in hours to look by, the default is 24 hours.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_ip_stats `async`

get_ip_stats(ip_address: str, *, look_back_hours: Optional[int] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Ips - Get the statistics for the given ip address

Retrieve from Windows Defender ATP statistics related to a given ip address - given in ipv4 or ipv6 format.

Swagger operation ID: GetIpStats.

Parameters:

Name	Type	Description	Default
`ip_address`	`str`	The ip address.	required
`look_back_hours`	`Optional[int]`	The look back period in hours to look by, the default is 24 hours.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_single_investigation `async`

get_single_investigation(investigation_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Get single investigation

Retrieve from Microsoft Defender ATP a specific investigation

Swagger operation ID: GetSingleInvestigation.

Parameters:

Name	Type	Description	Default
`investigation_id`	`str`	The identifier of the investigation to retrieve.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

list_investigations

list_investigations(*, filter: Optional[str] = None, select: Optional[str] = None, orderby: Optional[str] = None, top: Optional[int] = None, skip: Optional[int] = None, count: Optional[bool] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> AsyncItemPaged[dict[str, Any]]

Actions - Get list of investigation

Retrieve from Microsoft Defender ATP the most recent investigations

Returns an Azure Core async pager that follows the connector continuation URL.

Swagger operation ID: GetInvestigations.

Parameters:

Name	Type	Description	Default
`filter`	`Optional[str]`	Filters the results, using OData syntax.	`None`
`select`	`Optional[str]`	Selects which properties to include in the response, defaults to all.	`None`
`orderby`	`Optional[str]`	Sorts the results.	`None`
`top`	`Optional[int]`	Returns only the first n results.	`None`
`skip`	`Optional[int]`	Skips the first n results.	`None`
`count`	`Optional[bool]`	Includes a count of the matching results in the response.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`AsyncItemPaged[dict[str, Any]]`	AsyncItemPaged[dict[str, Any]]: An Azure Core pager over connector results. Consume it with `async for`.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

collect_investigation_package `async`

collect_investigation_package(input: CollectInvestigationPackageInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Collect investigation package

Collect investigation package from a machine

Swagger operation ID: CollectInvestigationPackage.

Parameters:

Name	Type	Description	Default
`input`	`CollectInvestigationPackageInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to collect the investigation from.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_investigation_package_uri `async`

get_investigation_package_uri(machine_action_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Get investigation package download URI

Get a URI that allows downloading of an investigation package

Swagger operation ID: GetInvestigationPackageUri.

Parameters:

Name	Type	Description	Default
`machine_action_id`	`str`	The ID of the investigation package collection.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

isolate_machine `async`

isolate_machine(input: IsolateMachineInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Isolate machine

Isolate a machine from network

Swagger operation ID: IsolateMachine.

Parameters:

Name	Type	Description	Default
`input`	`IsolateMachineInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to isolate.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

unisolate_machine `async`

unisolate_machine(input: UnisolateMachineInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Unisolate machine

Unisolate a machine from network

Swagger operation ID: UnisolateMachine.

Parameters:

Name	Type	Description	Default
`input`	`UnisolateMachineInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to unisolate.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

restrict_app_execution `async`

restrict_app_execution(input: RestrictAppExecutionInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Restrict app execution

Restrict execution of all applications on the machine except a predefined set

Swagger operation ID: RestrictAppExecution.

Parameters:

Name	Type	Description	Default
`input`	`RestrictAppExecutionInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to restrict.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

unrestrict_app_execution `async`

unrestrict_app_execution(input: UnrestrictAppExecutionInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Remove app execution restriction

Enable execution of any application on the machine

Swagger operation ID: UnrestrictAppExecution.

Parameters:

Name	Type	Description	Default
`input`	`UnrestrictAppExecutionInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to unrestrict.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

run_antivirus_scan `async`

run_antivirus_scan(input: RunAntivirusScanInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Run antivirus scan

Initiate Windows Defender Antivirus scan on a machine

Swagger operation ID: RunAntivirusScan.

Parameters:

Name	Type	Description	Default
`input`	`RunAntivirusScanInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to scan.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

run_live_response `async`

run_live_response(input: RunLiveResponseInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Actions - Run live response

Run live response api commands for a single machine

Swagger operation ID: RunLiveResponse.

Parameters:

Name	Type	Description	Default
`input`	`RunLiveResponseInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to run live response session on.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

list_remediation_activities

list_remediation_activities(*, filter: Optional[str] = None, select: Optional[str] = None, orderby: Optional[str] = None, top: Optional[int] = None, skip: Optional[int] = None, count: Optional[bool] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> AsyncItemPaged[dict[str, Any]]

Remediation tasks - Get list of remediation activities (Preview)

Retrieve from Windows Defender ATP the remediation activities

Returns an Azure Core async pager that follows the connector continuation URL.

Swagger operation ID: GetRemediationActivities.

Parameters:

Name	Type	Description	Default
`filter`	`Optional[str]`	Filters the results, using OData syntax.	`None`
`select`	`Optional[str]`	Selects which properties to include in the response, defaults to all.	`None`
`orderby`	`Optional[str]`	Sorts the results.	`None`
`top`	`Optional[int]`	Returns only the first n results.	`None`
`skip`	`Optional[int]`	Skips the first n results.	`None`
`count`	`Optional[bool]`	Includes a count of the matching results in the response.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`AsyncItemPaged[dict[str, Any]]`	AsyncItemPaged[dict[str, Any]]: An Azure Core pager over connector results. Consume it with `async for`.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_single_remediation_activity `async`

get_single_remediation_activity(remediation_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

RemediationActivities - Get single remediation activity (Preview)

Retrieve from Windows Defender ATP a specific remediation activity

Swagger operation ID: GetSingleRemediationActivity.

Parameters:

Name	Type	Description	Default
`remediation_id`	`str`	The identifier of the remediation activity to retrieve.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

list_get_remediation_activity_machine

list_get_remediation_activity_machine(remediation_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> AsyncItemPaged[dict[str, Any]]

Remediation activities - Get list of related machines (Preview)

Retrieve from Windows Defender ATP the related machines to a specific remediation activity

Returns an Azure Core async pager that follows the connector continuation URL.

Swagger operation ID: GetRemediationActivityMachineList.

Parameters:

Name	Type	Description	Default
`remediation_id`	`str`	The identifier of the remediation activity to retrieve.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`AsyncItemPaged[dict[str, Any]]`	AsyncItemPaged[dict[str, Any]]: An Azure Core pager over connector results. Consume it with `async for`.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

list_machines

list_machines(*, filter: Optional[str] = None, select: Optional[str] = None, orderby: Optional[str] = None, top: Optional[int] = None, skip: Optional[int] = None, count: Optional[bool] = None, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> AsyncItemPaged[dict[str, Any]]

Machines - Get list of machines

Retrieve from Windows Defender ATP the most recent machines

Returns an Azure Core async pager that follows the connector continuation URL.

Swagger operation ID: GetMachines.

Parameters:

Name	Type	Description	Default
`filter`	`Optional[str]`	Filters the results, using OData syntax.	`None`
`select`	`Optional[str]`	Selects which properties to include in the response, defaults to all.	`None`
`orderby`	`Optional[str]`	Sorts the results.	`None`
`top`	`Optional[int]`	Returns only the first n results.	`None`
`skip`	`Optional[int]`	Skips the first n results.	`None`
`count`	`Optional[bool]`	Includes a count of the matching results in the response.	`None`
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`AsyncItemPaged[dict[str, Any]]`	AsyncItemPaged[dict[str, Any]]: An Azure Core pager over connector results. Consume it with `async for`.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

get_single_machine `async`

get_single_machine(machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Machines - Get single machine

Retrieve from Windows Defender ATP a specific machine

Swagger operation ID: GetSingleMachine.

Parameters:

Name	Type	Description	Default
`machine_id`	`str`	The identifier of the machine to retrieve.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

machine_tag `async`

machine_tag(input: MachineTagInput | Mapping[str, Any], machine_id: str, *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Machines - Tag machine

Add or remove a tag to/from a machine

Swagger operation ID: MachineTag.

Parameters:

Name	Type	Description	Default
`input`	`MachineTagInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`machine_id`	`str`	The ID of the machine to which the tag should be added or removed.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

advanced_hunting_schema `async`

advanced_hunting_schema(input: AdvancedHuntingSchemaInput | Mapping[str, Any], *, timeout: Optional[float] = None, headers: Optional[Mapping[str, str]] = None, client_request_id: Optional[str] = None, response_hook: Optional[ConnectorResponseHook] = None) -> dict[str, Any] | None

Advanced Hunting Schema

Gets the schema for a Windows Defender ATP custom query

Swagger operation ID: AdvancedHuntingSchema.

Parameters:

Name	Type	Description	Default
`input`	`AdvancedHuntingSchemaInput \| Mapping[str, Any]`	The request body. Mapping keys use serialized Swagger wire names.	required
`timeout`	`Optional[float]`	The request timeout in seconds.	`None`
`headers`	`Optional[Mapping[str, str]]`	Additional HTTP request headers.	`None`
`client_request_id`	`Optional[str]`	A caller-provided request identifier.	`None`
`response_hook`	`Optional[ConnectorResponseHook]`	A callback invoked with the connector response.	`None`

Returns:

Type	Description
`dict[str, Any] \| None`	dict[str, Any] \| None: The connector operation result.

Raises:

Type	Description
`ConnectorException`	If the connector request fails.

WdatpClient

Attributes

TRIGGER_OPERATIONS module-attribute

Classes

AdvancedHuntingInput dataclass

Attributes

query class-attribute instance-attribute

AdvancedHuntingResponse dataclass

Attributes

stats class-attribute instance-attribute

CreateAlertByReferenceInput dataclass

Attributes

machine_id class-attribute instance-attribute

report_id class-attribute instance-attribute

event_time class-attribute instance-attribute

severity instance-attribute

category instance-attribute

title instance-attribute

description instance-attribute

recommended_action class-attribute instance-attribute

Alert dataclass

Attributes

id class-attribute instance-attribute

incident_id class-attribute instance-attribute

investigation_id class-attribute instance-attribute

severity class-attribute instance-attribute

status class-attribute instance-attribute

description class-attribute instance-attribute

alert_creation_time class-attribute instance-attribute

category class-attribute instance-attribute

title class-attribute instance-attribute

threat_family_name class-attribute instance-attribute

detection_source class-attribute instance-attribute

classification class-attribute instance-attribute

determination class-attribute instance-attribute

assigned_to class-attribute instance-attribute

resolved_time class-attribute instance-attribute

last_event_time class-attribute instance-attribute

first_event_time class-attribute instance-attribute

machine_id class-attribute instance-attribute

GetAlertsResponse dataclass

Attributes

count class-attribute instance-attribute

value class-attribute instance-attribute

next_link class-attribute instance-attribute

PatchAlertInput dataclass

Attributes

status class-attribute instance-attribute

assigned_to class-attribute instance-attribute

classification class-attribute instance-attribute

determination class-attribute instance-attribute

InitiateInvestigationInput dataclass

Attributes

comment class-attribute instance-attribute

InitiateInvestigationResponse dataclass

Attributes

value class-attribute instance-attribute

StartInvestigationInput dataclass

Attributes

comment class-attribute instance-attribute

Investigation dataclass

Attributes

id class-attribute instance-attribute

state class-attribute instance-attribute

status_details class-attribute instance-attribute

computer_dns_name class-attribute instance-attribute

machine_id class-attribute instance-attribute

start_time class-attribute instance-attribute

end_time class-attribute instance-attribute

MachineAction dataclass

Attributes

id class-attribute instance-attribute

type_ class-attribute instance-attribute

requestor class-attribute instance-attribute

requestor_comment class-attribute instance-attribute

status class-attribute instance-attribute

machine_id class-attribute instance-attribute

creation_date_time_utc class-attribute instance-attribute

last_update_date_time_utc class-attribute instance-attribute

related_file_info class-attribute instance-attribute

TRIGGER_OPERATIONS `module-attribute`

AdvancedHuntingInput `dataclass`

query `class-attribute` `instance-attribute`

AdvancedHuntingResponse `dataclass`

stats `class-attribute` `instance-attribute`

CreateAlertByReferenceInput `dataclass`

machine_id `class-attribute` `instance-attribute`

report_id `class-attribute` `instance-attribute`

event_time `class-attribute` `instance-attribute`

severity `instance-attribute`

category `instance-attribute`

title `instance-attribute`

description `instance-attribute`

recommended_action `class-attribute` `instance-attribute`

Alert `dataclass`

id `class-attribute` `instance-attribute`

incident_id `class-attribute` `instance-attribute`

investigation_id `class-attribute` `instance-attribute`

severity `class-attribute` `instance-attribute`

status `class-attribute` `instance-attribute`

description `class-attribute` `instance-attribute`

alert_creation_time `class-attribute` `instance-attribute`

category `class-attribute` `instance-attribute`

title `class-attribute` `instance-attribute`

threat_family_name `class-attribute` `instance-attribute`

detection_source `class-attribute` `instance-attribute`

classification `class-attribute` `instance-attribute`

determination `class-attribute` `instance-attribute`

assigned_to `class-attribute` `instance-attribute`

resolved_time `class-attribute` `instance-attribute`

last_event_time `class-attribute` `instance-attribute`

first_event_time `class-attribute` `instance-attribute`

machine_id `class-attribute` `instance-attribute`

GetAlertsResponse `dataclass`

count `class-attribute` `instance-attribute`

value `class-attribute` `instance-attribute`

next_link `class-attribute` `instance-attribute`

PatchAlertInput `dataclass`

status `class-attribute` `instance-attribute`

assigned_to `class-attribute` `instance-attribute`

classification `class-attribute` `instance-attribute`

determination `class-attribute` `instance-attribute`

InitiateInvestigationInput `dataclass`

comment `class-attribute` `instance-attribute`

InitiateInvestigationResponse `dataclass`

value `class-attribute` `instance-attribute`

StartInvestigationInput `dataclass`

comment `class-attribute` `instance-attribute`

Investigation `dataclass`

id `class-attribute` `instance-attribute`

state `class-attribute` `instance-attribute`

status_details `class-attribute` `instance-attribute`

computer_dns_name `class-attribute` `instance-attribute`

machine_id `class-attribute` `instance-attribute`

start_time `class-attribute` `instance-attribute`

end_time `class-attribute` `instance-attribute`

MachineAction `dataclass`

id `class-attribute` `instance-attribute`

type_ `class-attribute` `instance-attribute`

requestor `class-attribute` `instance-attribute`

requestor_comment `class-attribute` `instance-attribute`

status `class-attribute` `instance-attribute`

machine_id `class-attribute` `instance-attribute`

creation_date_time_utc `class-attribute` `instance-attribute`

last_update_date_time_utc `class-attribute` `instance-attribute`

related_file_info `class-attribute` `instance-attribute`

commands `class-attribute` `instance-attribute`

CancelSingleMachineActionInput `dataclass`

comment `class-attribute` `instance-attribute`

GetLiveResponseDownloadLinkResponse `dataclass`

value `class-attribute` `instance-attribute`

GetMachineActionsResponse `dataclass`

count `class-attribute` `instance-attribute`

value `class-attribute` `instance-attribute`

next_link `class-attribute` `instance-attribute`

FileStats `dataclass`

sha1 `class-attribute` `instance-attribute`

globally_prevalence `class-attribute` `instance-attribute`

global_first_observed `class-attribute` `instance-attribute`

global_last_observed `class-attribute` `instance-attribute`