Microsoft Defender for Endpoint

GET /api/alerts?$expand=files,ips,domains HTTP/1.1
Host: api.securitycenter.windows.com
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJ...
User-Agent: PostmanRuntime/7.19.0
Accept: */ *
Cache-Control: no-cache
Postman-Token: 2dc0f885-068a-45d4-81a6-2da0d23a58ad,d3dd0e6e-83ab-4d27-94d2-0f3889dff324
Host: api.securitycenter.windows.com
Accept-Encoding: gzip, deflate
Connection: keep-alive
cache-control: no-cache

[
    {
        "EntityResult": {
            "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines/$entity",
            "id": "example_id",
            "computerDnsName": "example-name",
            "firstSeen": "2019-11-18T11:13:04.0588699Z",
            "lastSeen": "2019-11-24T18:31:50.581058Z",
            "osPlatform": "Windows10",
            "osVersion": null,
            "osProcessor": "x64",
            "version": "1803",
            "lastIpAddress": "192.0.2.138",
            "lastExternalIpAddress": "203.0.113.28",
            "agentVersion": "10.4860.17134.982",
            "osBuild": 17134,
            "healthStatus": "Active",
            "rbacGroupId": 0,
            "rbacGroupName": null,
            "riskScore": "High",
            "exposureLevel": "Medium",
            "aadDeviceId": null,
            "machineTags": []
        }
    }
]

[
    {
        "EntityResult": {
            "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Files/$entity",
            "sha1": "bdd0d38e113a0c7dd6213cf2e89e6cc6d66b5cdb",
            "sha256": "328954033456d5c13e58fb5bcc6c0232f9f62cb6d9185afa51c7913338992491",
            "md5": "9512e1cc66a1d36feb0a290cab09087b",
            "globalPrevalence": 5205000,
            "globalFirstObserved": "2018-06-22T12:59:21.6460311Z",
            "globalLastObserved": "2019-11-21T00:24:01.921338Z",
            "size": 245760,
            "fileType": "APP",
            "isPeFile": true,
            "filePublisher": "Microsoft Corporation",
            "fileProductName": "Microsoft Windows Operating System",
            "signer": "Microsoft Windows",
            "issuer": "Microsoft Windows Production PCA 2011",
            "signerHash": "419e77aed546a1a6cf4dc23c1f977542fe289cf7",
            "isValidCertificate": true
            },
        "EntityResult": {
            "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgFileStats",
            "sha1": "bdd0d38e113a0c7dd6213cf2e89e6cc6d66b5cdb",
            "orgPrevalence": "1",
            "orgFirstSeen": "2019-11-19T03:54:15Z",
            "orgLastSeen": "2019-11-19T04:21:18Z",
            "globalPrevalence": "5205000",
            "globalFirstObserved": "2018-06-22T12:59:21.6460311Z",
            "globalLastObserved": "2019-11-21T00:24:01.921338Z",
            "topFileNames": ["notepad.exe"]
        }
    }
]

{
   "Entity": "",
   "EntityResult": {
       "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions/$entity",
       "id": "00000000-0000-0000-0000-000000000000",
       "type": "LiveResponse",
       "title": null,
       "requestor": "SEC_OPS_USER",
       "requestorComment": "Execution of live response command",
       "status": "Pending",
       "machineId": "MACHINE_ID_HASH",
       "computerDnsName": "hostname.domain.local",
       "creationDateTimeUtc": "2026-01-04T10:57:33.032Z",
       "lastUpdateDateTimeUtc": "2026-01-04T10:57:33.032Z",
       "cancellationRequestor": null,
       "cancellationComment": null,
       "cancellationDateTimeUtc": null,
       "errorHResult": 0,
       "scope": null,
       "externalId": null,
       "requestSource": "PublicApi",
       "relatedFileInfo": null,
       "commands": [],
       "troubleshootInfo": null,
       "results": {
           "filepath": "",
           "script_name": "remediation_script.ps1",
           "exit_code": 0,
           "script_output": "Script completed successfully",
           "script_errors": ""
       }
   }
}

[
    {
        "status": "Succeeded",
        "creation_date_time_utc": "2020-02-08T03:24:52.8526634Z",
        "cancellation_requestor": null,
        "cancellation_date_time_utc": null,
        "id": "2e39d22e-60a7-4267-899c-a1471e800000",
        "last_update_date_time_utc": "2020-02-08T03:25:35.8345081Z",
        "related_file_info": null,
        "cancellation_comment": null,
        "requestor": "e4fc6454-754d-47f7-bbdb-045fad600000",
        "error_h_result": 0,
        "scope": "Selective",
        "machine_id": "fbc85cf3fbcc8bb14d1a84fcf7bbae4531f00000",
        "type": "Isolate",
        "requestor_comment": "test"
    }
]

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts",
    "value": [
        {
            "id": "example_id",
            "incidentId": 2,
            "investigationId": 1,
            "assignedTo": null,
            "severity": "Medium",
            "status": "New",
            "classification": null,
            "determination": null,
            "investigationState": "TerminatedBySystem",
            "detectionSource": "WindowsDefenderAtp",
            "category": "DefenseEvasion",
            "threatFamilyName": null,
            "title": "Suspicious process injection observed",
            "description": "A process abnormally injected code into another process, As a result, unexpected code may be running in the target process memory. Injection is often used to hide malicious code execution within a trusted process. \nAs a result, the target process may exhibit abnormal behaviors such as opening a listening port or connecting to a command and control server.",
            "alertCreationTime": "2019-11-19T03:56:37.7335862Z",
            "firstEventTime": "2019-11-19T03:54:15.7698362Z",
            "lastEventTime": "2019-11-19T03:54:15.7698362Z",
            "lastUpdateTime": "2019-11-20T10:13:31.7266667Z",
            "resolvedTime": null,
            "machineId": "machine-id",
            "alertUser": {
                "accountName": "example.user",
                "domainName": "EXAMPLELAB"
            },
            "comments": [],
            "alertFiles": [
                {
                    "sha1": "1b3b40fbc889fd4c645cc12c85d0805ac36ba254",
                    "sha256": "d3f8fade829d2b7bd596c4504a6dae5c034e789b6a3defbe013bda7d14466677",
                    "filePath": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
                    "fileName": "powershell.exe"
                },{
                    "sha1": "bdd0d38e113a0c7dd6213cf2e89e6cc6d66b5cdb",
                    "sha256": "328954033456d5c13e58fb5bcc6c0232f9f62cb6d9185afa51c7913338992491",
                    "filePath": "C:\\Windows\\System32\\notepad.exe",
                    "fileName": "notepad.exe"
                }
            ],
            "alertDomains": [],
            "alertIps": [],
            "alertProcesses": []
        }
    ]
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
    "value": [
        {
            "id": "example_id",
            "computerDnsName": "example-name",
            "firstSeen": "2019-11-18T11:13:04.0588699Z",
            "lastSeen": "2019-11-20T19:35:36.4619266Z",
            "osPlatform": "Windows10",
            "osVersion": null,
            "osProcessor": "x64",
            "version": "1803",
            "lastIpAddress": "192.0.2.1",
            "lastExternalIpAddress": "203.0.113.121",
            "agentVersion": "10.4860.17134.982",
            "osBuild": 17134,
            "healthStatus": "Active",
            "rbacGroupId": 0,
            "rbacGroupName": null,
            "riskScore": "High",
            "exposureLevel": "Medium",
            "aadDeviceId": null,
            "machineTags": []
        }
    ]
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Users",
    "value": [
        {
            "id": "example\\example.user",
            "accountName": "example.user",
            "accountDomain": "example",
            "accountSid": null,
            "firstSeen": "2019-11-19T03:50:36Z",
            "lastSeen": "2019-11-19T03:50:36Z",
            "mostPrevalentMachineId": null,
            "leastPrevalentMachineId": null,
            "logonTypes": "Interactive",
            "logOnMachinesCount": 1,
            "isDomainAdmin": false,
            "isOnlyNetworkUser": null
        }
    ]
}

{
   "Entity": "",
   "EntityResult": [
         {
            "id": "va-_-7-zip-_-7-zip",
            "productName": "7-zip",
            "recommendationName": "Update 7-zip to version 25.01.0.0",
            "weaknesses": 12,
            "vendor": "7-zip",
            "recommendedVersion": "25.01.0.0",
            "recommendedVendor": "",
            "recommendedProgram": "",
            "recommendationCategory": "Application",
            "subCategory": "",
            "severityScore": 0.0,
            "publicExploit": true,
            "activeAlert": false,
            "associatedThreats": [],
            "remediationType": "Update",
            "status": "Active",
            "configScoreImpact": 0.0,
            "exposureImpact": 0.0,
            "totalMachineCount": 0,
            "exposedMachinesCount": 1,
            "nonProductivityImpactedAssets": 0,
            "relatedComponent": "7-zip",
            "hasUnpatchableCve": false,
            "tags": [],
            "exposedCriticalDevices": 0
        }
   ]
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts",
    "value": [
        {
            "id": "example-id",
            "incidentId": 1,
            "investigationId": null,
            "assignedTo": "testuser@example.com",
            "severity": "Informational",
            "status": "Resolved",
            "classification": "FalsePositive",
            "determination": "SecurityTesting",
            "investigationState": "UnsupportedAlertType",
            "detectionSource": "WindowsDefenderAtp",
            "category": "Execution",
            "threatFamilyName": null,
            "title": "[Test Alert] Suspicious Powershell commandline",
            "description": "*** This is a test alert ***\nA suspicious Powershell commandline was found on the machine. This commandline might be used during installation, exploration, or in some cases with lateral movement activities which are used by attackers to invoke modules, download external payloads, and get more information about the system. Attackers usually use Powershell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.",
            "alertCreationTime": "2019-11-18T11:17:48.287421Z",
            "firstEventTime": "2019-11-18T11:15:06.5226815Z",
            "lastEventTime": "2019-11-18T11:15:06.5226815Z",
            "lastUpdateTime": "2019-11-20T04:12:03.91Z",
            "resolvedTime": "2019-11-20T04:12:03.4976288Z",
            "machineId": "machine-id",
            "alertUser": {
                "accountName": "Administrator",
                "domainName": "US-LT-V13007"
            },
            "comments": [],
            "alertFiles": [
                {
                    "sha1": "3ce71813199abae99348f61f0caa34e2574f831c",
                    "sha256": "9a7c58bd98d70631aa1473f7b57b426db367d72429a5455b433a05ee251f3236",
                    "filePath": "C:\\Windows\\System32\\cmd.exe",
                    "fileName": "cmd.exe"
                },
                {
                    "sha1": "1b3b40fbc889fd4c645cc12c85d0805ac36ba254",
                    "sha256": "d3f8fade829d2b7bd596c4504a6dae5c034e789b6a3defbe013bda7d14466677",
                    "filePath": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
                    "fileName": "powershell.exe"
                }
            ],
            "alertDomains": [],
            "alertIps": [],
            "alertProcesses": []
        }
    ]
}

{
   "Entity": "",
   "EntityResult": [
       {
           "@odata.type": "#microsoft.windowsDefenderATP.api.PublicVulnerabilityDto",
           "id": "CVE-2025-21266",
           "name": "CVE-2025-21266",
           "description": "Summary: The Windows Telephony Service in Microsoft Windows is vulnerable to remote code execution. An attacker can exploit this vulnerability by tricking a user into visiting a malicious website, which would allow them to execute arbitrary code on the system. Impact: If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code on the affected system. This could lead to a complete compromise of the system, enabling the attacker to gain unauthorized access, steal sensitive information, or perform other malicious activities. Remediation: Apply the latest patches and updates provided by the respective vendors. Generated by AI",
           "severity": "High",
           "cvssV3": 8.8,
           "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
           "exposedMachines": 1,
           "publishedOn": "2025-01-14T08:00:00Z",
           "updatedOn": "2025-09-09T23:45:43.5Z",
           "firstDetected": "2025-01-14T18:31:29Z",
           "patchFirstAvailable": null,
           "publicExploit": false,
           "exploitVerified": false,
           "exploitInKit": false,
           "exploitTypes": [],
           "exploitUris": [],
           "cveSupportability": "Supported",
           "tags": [],
           "epss": 0.01391,
           "status": "RemediationRequired"
       }
   ]
}

[
    {
        "Entity": "User@domain.local",
        "EntityResult": [
            {
                "id": "da06788650-4d45-4dcf-ae23-d1071ad426ec_1",
                "incident_id": 864492,
                "investigation_id": 1778,
                "assigned_to": "API-Automated Investigation and Response",
                "severity": "Low",
                "status": "Resolved",
                "classification": null,
                "determination": null,
                "investigation_state": "Benign",
                "detection_source": "WindowsDefenderAv",
                "category": "Malware",
                "threat_family_name": "Ceprolad",
                "title": "An active '' malware ",
                "description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.",
                "alert_creation_time": "2026-02-27T06:58:08.1366667Z",
                "first_event_time": "2026-02-27T06:55:51.021546Z",
                "last_event_time": "2026-02-27T06:55:51.021546Z",
                "last_update_time": "2026-02-27T07:13:46.2333333Z",
                "resolved_time": "2026-02-27T07:13:44.3513463Z",
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da0b1f334d-b5e5-4618-8a2a-d3675e62a93b_1",
                "incident_id": 864492,
                "investigation_id": null,
                "assigned_to": null,
                "severity": "Low",
                "status": "New",
                "classification": null,
                "determination": null,
                "investigation_state": "UnsupportedAlertType",
                "detection_source": "WindowsDefenderAtp",
                "category": "Execution",
                "threat_family_name": null,
                "title": "Suspicious JavaScript process",
                "description": "A suspicious JavaScript process was observed on this device. Attackers typically use JavaScript to download secondary payloads, run additional commands, and perform other malicious activities on the target device.",
                "alert_creation_time": "2026-02-27T06:58:38.5533333Z",
                "first_event_time": "2026-02-27T06:55:32.6699867Z",
                "last_event_time": "2026-03-05T07:24:52.7415066Z",
                "last_update_time": "2026-03-05T07:28:04.67Z",
                "resolved_time": null,
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da0cfbb355-b5a5-43a5-adb6-d0879d0b0917_1",
                "incident_id": 690846,
                "investigation_id": null,
                "assigned_to": "analyst@company.onmicrosoft.com",
                "severity": "Medium",
                "status": "InProgress",
                "classification": null,
                "determination": null,
                "investigation_state": "UnsupportedAlertType",
                "detection_source": "WindowsDefenderAtp",
                "category": "Execution",
                "threat_family_name": null,
                "title": "Suspicious behavior by cmd.exe was observed",
                "description": "A suspicious behavior by cmd.exe was observed. This behavior may indicate malware installation or other malicious activities on the machine.",
                "alert_creation_time": "2025-10-13T10:26:21.3333333Z",
                "first_event_time": "2025-10-13T10:23:58.1472359Z",
                "last_event_time": "2025-10-13T10:25:22.714708Z",
                "last_update_time": "2026-02-13T08:14:22.61Z",
                "resolved_time": null,
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [
                    {
                        "comment": "\ud83d\udfe6 Intezer Automated Triage\n===================================\n\u26a0\ufe0f Suspicious - Not Mitigated - Follow Up Required\n===================================\n\n- Title: Suspicious behavior by cmd.exe was observed\n- Source: Microsoft Defender for Endpoint\n- Creation time: 13 Oct 25 | 10:26 UTC\n- External severity: Medium\n- Hosts: \n  * workstation-01 (Windows10)\n- Description: A suspicious behavior by cmd.exe was observed. This behavior may indicate malware installation or other malicious activities on the machine.\n- TTPs:\n  * Command and Control: Application Layer Protocol [T1071]\n  * Defense Evasion: MMC [T1218.014]\n  * Execution: Windows Command Shell [T1059.003]\n- Recommended actions: Ensure Device is Patched, Run Intezer Endpoint Scan (https://docs.intezer.com/docs/live-endpoint-analysis), Validate Activity with User\n- Malicious files: APTSimulator_scheduler.bat\n\nView alert: \ud83d\udc49 https://analyze.intezer.com/alerts/da0cfbb355-b5a5-43a5-adb6-d0879d0b0917_1?environment=mde",
                        "createdBy": "API Action",
                        "createdTime": "2025-10-13T10:40:32.4733451Z"
                    }
                ],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da0e3de096-1789-43ff-bb2e-6cc22e5037ad_1",
                "incident_id": 864492,
                "investigation_id": null,
                "assigned_to": null,
                "severity": "Low",
                "status": "New",
                "classification": null,
                "determination": null,
                "investigation_state": "UnsupportedAlertType",
                "detection_source": "WindowsDefenderAtp",
                "category": "DefenseEvasion",
                "threat_family_name": null,
                "title": "Suspicious registry modification",
                "description": "A suspicious process modified the registry on this device. Registry entries can be added, modified, or removed to change various settings of the system or behavior of a program. Attackers leverage this technique to gain persistence, escalate privileges, launch malicious codes, or to tamper with security products.",
                "alert_creation_time": "2026-02-27T06:58:38.7266667Z",
                "first_event_time": "2026-02-27T06:56:11.3416006Z",
                "last_event_time": "2026-03-05T07:25:30.6007486Z",
                "last_update_time": "2026-03-05T07:28:07.39Z",
                "resolved_time": null,
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da13c4af0a-bd35-4cb2-a556-fa972f3b80da_1",
                "incident_id": 864492,
                "investigation_id": 1779,
                "assigned_to": "API-Automated Investigation and Response",
                "severity": "Low",
                "status": "Resolved",
                "classification": null,
                "determination": null,
                "investigation_state": "Benign",
                "detection_source": "WindowsDefenderAv",
                "category": "Malware",
                "threat_family_name": "Ceprolad",
                "title": "An active '' malware ",
                "description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.",
                "alert_creation_time": "2026-03-02T07:26:21.22Z",
                "first_event_time": "2026-03-02T07:25:05.4166175Z",
                "last_event_time": "2026-03-02T07:25:05.4166175Z",
                "last_update_time": "2026-03-02T07:37:19.2666667Z",
                "resolved_time": "2026-03-02T07:37:19.1231428Z",
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da2052972f-7cc3-42c8-8abf-8ac490d63c35_1",
                "incident_id": 690846,
                "investigation_id": null,
                "assigned_to": "analyst@company.onmicrosoft.com",
                "severity": "Medium",
                "status": "InProgress",
                "classification": null,
                "determination": null,
                "investigation_state": "UnsupportedAlertType",
                "detection_source": "WindowsDefenderAtp",
                "category": "Execution",
                "threat_family_name": null,
                "title": "Suspicious behavior by cmd.exe was observed",
                "description": "A suspicious behavior by cmd.exe was observed. This behavior may indicate malware installation or other malicious activities on the machine.",
                "alert_creation_time": "2025-10-07T10:25:41.1666667Z",
                "first_event_time": "2025-10-07T10:23:44.5677721Z",
                "last_event_time": "2025-10-07T10:25:10.6581007Z",
                "last_update_time": "2026-02-13T08:14:22.61Z",
                "resolved_time": null,
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [
                    {
                        "comment": "\ud83d\udfe6 Intezer Automated Triage\n===================================\n\ud83e\udde8 Generic Threat - APTSimulator_schedu... - Not Mitigated - Escalated\n===================================\n\n- Title: Suspicious behavior by cmd.exe was observed\n- Source: Microsoft Defender for Endpoint\n- Creation time: 07 Oct 25 | 10:25 UTC\n- External severity: Medium\n- Hosts: \n  * workstation-01 (Windows10)\n- Description: A suspicious behavior by cmd.exe was observed. This behavior may indicate malware installation or other malicious activities on the machine.\n- TTPs:\n  * Command and Control: Application Layer Protocol [T1071]\n  * Defense Evasion: MMC [T1218.014]\n  * Execution: Windows Command Shell [T1059.003]\n- Recommended actions: Isolation, Stop and Quarantine File, Run Intezer Endpoint Scan (https://docs.intezer.com/docs/live-endpoint-analysis)\n- Malicious files: APTSimulator_scheduler.bat\n\nView alert: \ud83d\udc49 https://analyze.intezer.com/alerts/da2052972f-7cc3-42c8-8abf-8ac490d63c35_1?environment=mde",
                        "createdBy": "API Action",
                        "createdTime": "2025-10-07T10:27:41.3867936Z"
                    },
                    {
                        "comment": "\ud83d\udfe6 Intezer Automated Triage (\ud83d\udca1Triage updated \u2192 Risk Deescalated)\n===================================\n\u26a0\ufe0f Suspicious - Not Mitigated - Follow Up Required\n===================================\n\n- Title: Suspicious behavior by cmd.exe was observed\n- Source: Microsoft Defender for Endpoint\n- Creation time: 07 Oct 25 | 10:25 UTC\n- External severity: Medium\n- Hosts: \n  * workstation-01 (Windows10)\n- Description: A suspicious behavior by cmd.exe was observed. This behavior may indicate malware installation or other malicious activities on the machine.\n- TTPs:\n  * Command and Control: Application Layer Protocol [T1071]\n  * Defense Evasion: MMC [T1218.014]\n  * Execution: Windows Command Shell [T1059.003]\n- Recommended actions: Ensure Device is Patched, Run Intezer Endpoint Scan (https://docs.intezer.com/docs/live-endpoint-analysis), Validate Activity with User\n- Malicious files: APTSimulator_scheduler.bat\n\nView alert: \ud83d\udc49 https://analyze.intezer.com/alerts/da2052972f-7cc3-42c8-8abf-8ac490d63c35_1?environment=mde",
                        "createdBy": "API Action",
                        "createdTime": "2025-10-07T10:32:21.417826Z"
                    }
                ],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da2068d331-0335-4479-9f96-e8f33db81aa9_1",
                "incident_id": 864492,
                "investigation_id": 1780,
                "assigned_to": "API-Automated Investigation and Response",
                "severity": "Low",
                "status": "Resolved",
                "classification": null,
                "determination": null,
                "investigation_state": "Benign",
                "detection_source": "WindowsDefenderAv",
                "category": "Malware",
                "threat_family_name": "Ceprolad",
                "title": "An active 'Ceprolad' malware in a command line was prevented from executing",
                "description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.",
                "alert_creation_time": "2026-03-05T07:26:09.89Z",
                "first_event_time": "2026-03-05T07:25:08.6889036Z",
                "last_event_time": "2026-03-05T07:25:08.6889036Z",
                "last_update_time": "2026-03-05T07:37:44.9066667Z",
                "resolved_time": "2026-03-05T07:37:44.65021Z",
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da29243e25-be1e-47b7-9d40-e626df36345c_1",
                "incident_id": 688299,
                "investigation_id": null,
                "assigned_to": null,
                "severity": "Medium",
                "status": "InProgress",
                "classification": null,
                "determination": null,
                "investigation_state": "UnsupportedAlertType",
                "detection_source": "WindowsDefenderAtp",
                "category": "Persistence",
                "threat_family_name": null,
                "title": "New group added suspiciously",
                "description": "A new group was added after suspicious activities were detected. An attacker might add new users to the group in an attempt to gain a better foothold on the machine or network.",
                "alert_creation_time": "2025-09-18T14:59:47.52Z",
                "first_event_time": "2025-09-18T14:53:30.7348596Z",
                "last_event_time": "2025-09-21T14:53:43.8093531Z",
                "last_update_time": "2025-09-21T14:56:44.5166667Z",
                "resolved_time": null,
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [
                    {
                        "comment": "\ud83d\udfe6 Intezer Automated Triage\n===================================\n\u26a0\ufe0f Suspicious - APTSimulator_schedu... - Not Mitigated - Follow Up Required\n===================================\n\n- Title: New group added suspiciously\n- Source: Microsoft Defender for Endpoint\n- Creation time: 18 Sep 25 | 14:59 UTC\n- External severity: Medium\n- Hosts: \n  * workstation-01 (Windows10)\n- Description: A new group was added after suspicious activities were detected. An attacker might add new users to the group in an attempt to gain a better foothold on the machine or network.\n- TTPs:\n  * Command and Control: Application Layer Protocol [T1071]\n  * Discovery: Local Groups [T1069.001]\n  * Persistence: Account Manipulation [T1098]\n- Recommended actions: Ensure Device is Patched, Run Intezer Endpoint Scan (https://docs.intezer.com/docs/live-endpoint-analysis), Validate Activity with User\n\nView alert: \ud83d\udc49 https://analyze.intezer.com/alerts/da29243e25-be1e-47b7-9d40-e626df36345c_1?environment=mde",
                        "createdBy": "API Action",
                        "createdTime": "2025-09-18T15:03:43.2796289Z"
                    }
                ],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da2be6df1c-2401-4545-8111-5f75d0fd0223_1",
                "incident_id": 690846,
                "investigation_id": null,
                "assigned_to": "analyst@company.onmicrosoft.com",
                "severity": "Low",
                "status": "InProgress",
                "classification": null,
                "determination": null,
                "investigation_state": "UnsupportedAlertType",
                "detection_source": "WindowsDefenderAtp",
                "category": "Execution",
                "threat_family_name": null,
                "title": "Suspicious JavaScript process",
                "description": "A suspicious JavaScript process was observed on this device. Attackers typically use JavaScript to download secondary payloads, run additional commands, and perform other malicious activities on the target device.",
                "alert_creation_time": "2025-10-01T10:26:20.6566667Z",
                "first_event_time": "2025-10-01T10:24:19.1071611Z",
                "last_event_time": "2025-10-07T10:24:27.1065475Z",
                "last_update_time": "2026-02-13T08:14:22.61Z",
                "resolved_time": null,
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [
                    {
                        "comment": "\ud83d\udfe6 Intezer Automated Triage\n===================================\n\u26a0\ufe0f Suspicious - en-US.js - Not Mitigated - Follow Up Required\n===================================\n\n- Title: Suspicious JavaScript process\n- Source: Microsoft Defender for Endpoint\n- Creation time: 01 Oct 25 | 10:26 UTC\n- External severity: Low\n- Hosts: \n  * workstation-01 (Windows10)\n- Description: A suspicious JavaScript process was observed on this device. Attackers typically use JavaScript to download secondary payloads, run additional commands, and perform other malicious activities on the target device.\n- TTPs:\n  * Command and Control: Application Layer Protocol [T1071]\n  * Defense Evasion: Indicator Removal on Host [T1070]\n  * Defense Evasion: Indicator Removal on Host: Timestomp [T1070.006]\n- Recommended actions: Ensure Device is Patched, Run Intezer Endpoint Scan (https://docs.intezer.com/docs/live-endpoint-analysis), Validate Activity with User\n\nView alert: \ud83d\udc49 https://analyze.intezer.com/alerts/da2be6df1c-2401-4545-8111-5f75d0fd0223_1?environment=mde",
                        "createdBy": "API Action",
                        "createdTime": "2025-10-01T10:30:36.462226Z"
                    }
                ],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            },
            {
                "id": "da37252b75-0446-4a7b-99b4-e64886557bd3_1",
                "incident_id": 688299,
                "investigation_id": null,
                "assigned_to": null,
                "severity": "Low",
                "status": "InProgress",
                "classification": null,
                "determination": null,
                "investigation_state": "UnsupportedAlertType",
                "detection_source": "WindowsDefenderAtp",
                "category": "Execution",
                "threat_family_name": null,
                "title": "Suspicious JavaScript process",
                "description": "A suspicious JavaScript process was observed on this device. Attackers typically use JavaScript to download secondary payloads, run additional commands, and perform other malicious activities on the target device.",
                "alert_creation_time": "2025-09-18T14:59:46.57Z",
                "first_event_time": "2025-09-18T14:54:11.4061419Z",
                "last_event_time": "2025-09-21T14:54:00.575478Z",
                "last_update_time": "2025-09-21T14:56:36.6533333Z",
                "resolved_time": null,
                "machine_id": "4f683b2d393afc3149b0de4149acc5449acdf07e",
                "alert_user": null,
                "alert_files": [],
                "comments": [
                    {
                        "comment": "\ud83d\udfe6 Intezer Automated Triage\n===================================\n\u26a0\ufe0f Suspicious - wscript.exe - Not Mitigated - Follow Up Required\n===================================\n\n- Title: Suspicious JavaScript process\n- Source: Microsoft Defender for Endpoint\n- Creation time: 18 Sep 25 | 14:59 UTC\n- External severity: Low\n- Hosts: \n  * workstation-01 (Windows10)\n- Description: A suspicious JavaScript process was observed on this device. Attackers typically use JavaScript to download secondary payloads, run additional commands, and perform other malicious activities on the target device.\n- TTPs:\n  * Command and Control: Application Layer Protocol [T1071]\n  * Defense Evasion: Indicator Removal on Host [T1070]\n  * Defense Evasion: Indicator Removal on Host: Timestomp [T1070.006]\n- Recommended actions: Ensure Device is Patched, Run Intezer Endpoint Scan (https://docs.intezer.com/docs/live-endpoint-analysis), Validate Activity with User\n\nView alert: \ud83d\udc49 https://analyze.intezer.com/alerts/da37252b75-0446-4a7b-99b4-e64886557bd3_1?environment=mde",
                        "createdBy": "API Action",
                        "createdTime": "2025-09-18T15:06:13.2743521Z"
                    }
                ],
                "alert_domains": null,
                "alert_ips": null,
                "alert_processes": null
            }
        ]
    }
]

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity",
    "id": "example-id",
    "type": "Isolate",
    "requestor": "requestor-id",
    "requestorComment": "Machine Isolation due to alert ...",
    "status": "Pending",
    "machineId": "machine-id",
    "creationDateTimeUtc": "2019-11-21T03:55:59.5419077Z",
    "lastUpdateDateTimeUtc": "2019-11-21T03:55:59.5419077Z",
    "cancellationRequestor": null,
    "cancellationComment": null,
    "cancellationDateTimeUtc": null,
    "errorHResult": 0,
    "scope": null,
    "relatedFileInfo": null
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts",
    "value": [
        {
            "id": "example_id",
            "incidentId": 2,
            "investigationId": null,
            "assignedTo": null,
            "severity": "Medium",
            "status": "New",
            "classification": null,
            "determination": null,
            "investigationState": "UnsupportedAlertType",
            "detectionSource": "WindowsDefenderAtp",
            "category": "Execution",
            "threatFamilyName": null,
            "title": "Unexpected behavior observed by a process run with no command line arguments",
            "description": "The legitimate process by this name does not normally exhibit this behavior when run with no command line arguments. \nSuch unexpected behavior may be a result of extraneous code injected into a legitimate process, or a malicious executable masquerading as the legitimate one by name.",
            "alertCreationTime": "2019-11-19T03:56:35.3007009Z",
            "firstEventTime": "2019-11-19T03:54:16.0441057Z",
            "lastEventTime": "2019-11-19T03:54:16.0441057Z",
            "lastUpdateTime": "2019-11-19T03:56:38.45Z",
            "resolvedTime": null,
            "machineId": "machine-id",
            "alertUser": null,
            "comments": [],
            "alertFiles": [],
            "alertDomains": [],
            "alertIps": [],
            "alertProcesses": []
            }
    ]
}

{
    "id": "18",
    "indicatorValue": "110e7d15b011d7fac48f2bd61114db1022197f7a",
    "indicatorType": "FileSha1",
    "action": "Audit",
    "createdBy": "45e9773c-100e-4a9f-ad37-d8e182e9ed26",
    "severity": "Informational",
    "category": 1,
    "application": "demo-test",
    "educateUrl": null,
    "bypassDurationHours": null,
    "title": "test",
    "description": "test",
    "recommendedActions": "nothing",
    "creationTimeDateTimeUtc": "2022-02-08T14:20:34.9071582Z",
    "expirationTime": null,
    "lastUpdateTime": "2022-02-08T14:20:34.9151307Z",
    "lastUpdatedBy": null,
    "rbacGroupNames": [],
    "rbacGroupIds": [],
    "notificationId": null,
    "notificationBody": null,
    "version": null,
    "mitreTechniques": [],
    "historicalDetection": false,
    "lookBackPeriod": null,
    "generateAlert": true,
    "additionalInfo": null,
    "createdByDisplayName": "Example Defender ATP",
    "externalId": null,
    "createdBySource": "PublicApi",
    "certificateInfo": null
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines",
    "value": [
        {
            "id": "example-id",
            "computerDnsName": "example-name",
            "firstSeen": "2019-11-18T11:13:04.0588699Z",
            "lastSeen": "2019-11-20T09:59:28.0646303Z",
            "osPlatform": "Windows10",
            "osVersion": null,
            "osProcessor": "x64",
            "version": "1803",
            "lastIpAddress": "192.0.2.138",
            "lastExternalIpAddress": "203.0.113.35",
            "agentVersion": "10.4860.17134.982",
            "osBuild": 17134,
            "healthStatus": "Active",
            "rbacGroupId": 0,
            "rbacGroupName": null,
            "riskScore": "High",
            "exposureLevel": "Medium",
            "aadDeviceId": null,
            "machineTags": []
        },{
            "id": "example-id",
            "computerDnsName": "example-name",
            "firstSeen": "2019-11-20T08:36:16.2721384Z",
            "lastSeen": "2019-11-20T08:36:52.7182837Z",
            "osPlatform": "Windows10",
            "osVersion": null,
            "osProcessor": "x64",
            "version": "1803",
            "lastIpAddress": "192.0.2.141",
            "lastExternalIpAddress": "203.0.113.35",
            "agentVersion": "10.4850.17134.191",
            "osBuild": 17134,
            "healthStatus": "Active",
            "rbacGroupId": 0,
            "rbacGroupName": null,
            "riskScore": "None",
            "exposureLevel": "Medium",
            "aadDeviceId": null,
            "machineTags": []
        }
    ]
}

{
    "Stats": {
        "ExecutionTime": 0.0156652,
        "resource_usage": {
            "cache": {
                "memory": {
                    "hits": 13,
                    "misses": 0,
                    "total": 13
                },
                "disk": {
                    "hits": 0,
                    "misses": 0,
                    "total": 0
                }
            },
            "cpu": {
                "user": "00:00:00.0156250",
                "kernel": "00:00:00",
                "total cpu": "00:00:00.0156250"
            },
            "memory": {
                "peak_per_node": 33554624
            }
        },
        "dataset_statistics": [
            {
                "table_row_count": 2,
                "table_size": 60
            }
        ]
    },
    "Schema": [
        {
            "Name": "EventTime",
            "Type": "DateTime"
        },
        {
            "Name": "FileName",
            "Type": "String"
        },
        {
            "Name": "InitiatingProcessFileName",
            "Type": "String"
        }
    ],
    "Results": [
        {
            "EventTime": "2019-11-18T11:13:07.043128Z",
            "FileName": "csc.exe",
            "InitiatingProcessFileName": "powershell.exe"
        },
        {
            "EventTime": "2019-11-19T03:54:14.4256361Z",
            "FileName": "csc.exe",
            "InitiatingProcessFileName": "powershell.exe"
        }
    ]
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity",
    "id": "example-id",
    "type": "RunAntiVirusScan",
    "requestor": "requestor_id",
    "requestorComment": "Run antivirus scan on suspect",
    "status": "Pending",
    "machineId": "machine-id",
    "creationDateTimeUtc": "2019-11-21T11:07:06.611628Z",
    "lastUpdateDateTimeUtc": "2019-11-21T11:07:06.611628Z",
    "cancellationRequestor": null,
    "cancellationComment": null,
    "cancellationDateTimeUtc": null,
    "errorHResult": 0,
    "scope": null,
    "relatedFileInfo": null
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity",
    "id": "example-id",
    "type": "StopAndQuarantineFile",
    "requestor": "requestor-id",
    "requestorComment": "Stopping and quarantining putty",
    "status": "Pending",
    "machineId": "machine-id",
    "creationDateTimeUtc": "2019-11-25T10:05:21.3641296Z",
    "lastUpdateDateTimeUtc": "2019-11-25T10:05:21.3641296Z",
    "cancellationRequestor": null,
    "cancellationComment": null,
    "cancellationDateTimeUtc": null,
    "errorHResult": 0,
    "scope": null,
    "relatedFileInfo": {
        "fileIdentifier": "d932604ab8e9debe475415851fd26929a0c0dcd1",
        "fileIdentifierType": "Sha1"
    }
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity",
    "id": "example-id",
    "type": "Unisolate",
    "requestor": "requestor-id",
    "requestorComment": "Unisolate machine due to the following remediation measures taken...",
    "status": "Pending",
    "machineId": "machine-id",
    "creationDateTimeUtc": "2019-11-21T03:59:34.7389352Z",
    "lastUpdateDateTimeUtc": "2019-11-21T03:59:34.7389352Z",
    "cancellationRequestor": null,
    "cancellationComment": null,
    "cancellationDateTimeUtc": null,
    "errorHResult": 0,
    "scope": null,
    "relatedFileInfo": null
}

{
    "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts/$entity",
    "id": "example-id",
    "incidentId": 1,
    "investigationId": null,
    "assignedTo": null,
    "severity": "Informational",
    "status": "Resolved",
    "classification": null,
    "determination": null,
    "investigationState": "UnsupportedAlertType",
    "detectionSource": "WindowsDefenderAtp",
    "category": "Execution",
    "threatFamilyName": null,
    "title": "[Test Alert] Suspicious Powershell commandline",
    "description": "*** This is a test alert ***\nA suspicious Powershell commandline was found on the machine. This commandline might be used during installation, exploration, or in some cases with lateral movement activities which are used by attackers to invoke modules, download external payloads, and get more information about the system. Attackers usually use Powershell to bypass security protection mechanisms by executing their payload in memory without touching the disk and leaving any trace.",
    "alertCreationTime": "2019-11-18T11:17:48.287421Z",
    "firstEventTime": "2019-11-18T11:15:06.5226815Z",
    "lastEventTime": "2019-11-18T11:15:06.5226815Z",
    "lastUpdateTime": "2019-11-20T04:12:03.6066667Z",
    "resolvedTime": "2019-11-20T04:12:03.4976288Z",
    "machineId": "machine-id",
    "alertUser": {
        "accountName": "Administrator",
        "domainName": "example-domain"
    },
    "comments": [],
    "alertFiles": [
        {
            "sha1": "3ce71813199abae99348f61f0caa34e2574f831c",
            "sha256": "9a7c58bd98d70631aa1473f7b57b426db367d72429a5455b433a05ee251f3236",
            "filePath": "C:\\Windows\\System32\\cmd.exe",
            "fileName": "cmd.exe"
        },
        {
            "sha1": "1b3b40fbc889fd4c645cc12c85d0805ac36ba254",
            "sha256": "d3f8fade829d2b7bd596c4504a6dae5c034e789b6a3defbe013bda7d14466677",
            "filePath": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
            "fileName": "powershell.exe"
        }
    ],
    "alertDomains": [],
    "alertIps": [],
    "alertProcesses": []
}

[
    {
        "status": "Succeeded",
        "creation_date_time_utc": "2020-02-08T03:24:52.8526634Z",
        "cancellation_requestor": null,
        "cancellation_date_time_utc": null,
        "id": "2e39d22e-60a7-4267-899c-a1471e800000",
        "last_update_date_time_utc": "2020-02-08T03:25:35.8345081Z",
        "related_file_info": null,
        "cancellation_comment": null,
        "requestor": "e4fc6454-754d-47f7-bbdb-045fad600000",
        "error_h_result": 0,
        "scope": "Selective",
        "machine_id": "fbc85cf3fbcc8bb14d1a84fcf7bbae4531f00000",
        "type": "Isolate",
        "requestor_comment": "test"
    }
]