How to fetch Cloud Discovery Dashboard data in Microsoft Defender Portal using PowerShell?

Question

Hello, I'm attempting to use Powershell to obtain data for the Cloud Discovery Dashboard from the Microsoft Defender Portal. Is it possible for me to obtain data from PowerShell that precisely matches the provided image?

Is it possible to get that information using any modules or API documentation?

Answer 1

Hello,

According to this MS Learn page, you can use the REST API

The endpoints are

• /api/v1/activities/
• /api/v1/alerts/ (your second figure)
• /api/subnet/
• /api/v1/entities/ (your third figure)
• /api/v1/files/

Your PowerShell command will resemble this

Invoke-RestMethod -Uri "https://<tenant_id>.<tenant_region>.contoso.com/api/v1/example/" -Method Get -Headers @{Authorization="Token <your_token_key>"; "Content-Type"="application/json"} -Body (@{"filters"=@{}} | ConvertTo-Json -Compress)

To get the token key : https://learn.microsoft.com/en-us/defender-cloud-apps/api-authentication

For example, listing open alerts with filters will look like this

Invoke-RestMethod -Uri "https://<tenant_id>.<tenant_region>.contoso.com/api/v1/alerts/" -Method Get -Headers @{Authorization="Token <your_token_key>"; "Content-Type"="application/json"} -Body (@{"filters"=@{"alertOpen"=True}} | ConvertTo-Json -Compress)