Share via

Attack Simulator Graph API associate user and their results with a simulation

Mike Baker 16 Reputation points
2024-05-30T10:21:18.4533333+00:00

I can extract the list of Simulations and includedaccounts

https://graph.microsoft.com/v1.0/security/attackSimulation/simulations/<simid>/includedAccountTarget

however we cannot associate the results of a simulation with a user

https://graph.microsoft.com/v1.0/reports/security/microsoft.graph.getAttackSimulationSimulationUserCoverage()

except if we start looking at latestsimulationdate and match for range within launch date and validity however this gets only the recent simulation - not to mention too much complexity.

what are we missing?

is the Defender portal using API's that are not exposed?

Microsoft Security | Microsoft Graph
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.