Azure Defender | Filter API by properties fields

Question

Hi,

I am trying to use this API to fetch detections:

'https://management.azure.com/subscriptions/<subscription_id>/providers/Microsoft.Security/alerts?api-version=2022-01-01&$filter=properties/startTimeUtc gt <datetime>'

However, the results are not filtered by the properties.startTimeUtc field.

Is there a way to make it work?

thanks

Answer 1

@Alon Golombek Thank you for reaching out to us, as per our documentation - https://learn.microsoft.com/en-us/rest/api/defenderforcloud/alerts/list?view=rest-defenderforcloud-2022-01-01&tabs=HTTP we don't have $filter parameter mentioned otherwise it would have been documented.

For example, if you see this doc - https://learn.microsoft.com/en-us/rest/api/monitor/metrics/list?view=rest-monitor-2023-10-01&tabs=HTTP for Azure monitor, we clearly mentioned over here $filter can be used.

Let me know if you have any further questions, feel free to post back.