How to get Domain from Whois History in Defender

Question

Hi, I am trying to use the API to retrieve all the Whois domains that have specific email

I need all the whois and whois history and i didn't find API for history by email ,

This work "GET /security/threatIntelligence/whoisRecords?$search="{value}" "

This does not have a search function

https://learn.microsoft.com/en-us/graph/api/security-whoisrecord-list-history?view=graph-rest-1.0&tabs=http

How can I see from the API like in the UI see in the attachment

The API returns only the 14 result not the 34 results

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

You are correct in identifying that the Microsoft Graph Threat Intelligence API for Whois does not yet fully support the depth of filtering/searching you'd expect, especially by email across Whois history records. Let's break this down clearly:

What Works

This endpoint:

GET /security/threatIntelligence/whoisRecords?$search="{value}"

• It does support searching by email or domain in current Whois records.
• Returns up to 25 results by default (pagination supported via @odata.nextLink).

What Doesn’t Work (Till now)

This endpoint:

GET /security/threatIntelligence/whoisRecords/{id}/history

• Only works per record, meaning you must already have the id of a Whois record to retrieve history.
• No $search or filtering across multiple history records.
• So you can't do something like ?$filter=email eq 'test@example.com' across all history.

Why You See 14 Results in API vs 34 in UI?

The Microsoft 365 Defender UI aggregates:

1. WhoisRecords
2. WhoisRecord History
3. Possibly passive DNS / additional enrichment data.

The API in contrast:

• Only returns what’s directly exposed.
• So, if you search by email in the API, you're getting only current records.
• The history is siloed per record not globally searchable.

Workaround

To simulate the UI behavior:

1. Call GET /security/threatIntelligence/whoisRecords?$search="******@email.com".
2. Loop through each returned Whois record:
   • For each one, call GET /security/threatIntelligence/whoisRecords/{id}/history.
3. Aggregate all results manually.

Note:

There is currently no API endpoint to:

Search all Whois history globally by email.

Do deep entity correlation like the UI.

On the downside, this can be slow, especially if you’re dealing with a large dataset.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.