hostPair resource type

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Note

The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.

Represents a pair of parent-child hosts in which the child host is able to be reached via the parent host. For example, if contoso.com redirects to microsoft.com, then contoso.com would be the parent host and microsoft.com the child host.

Host pair relationships shared at an earlier point, or currently share a connection observed from a Microsoft crawl. A parent host leads to the child host perhaps through a simple top-level redirect (HTTP 302), or something more complex like an iframe or script source reference. In other instances, a web crawl may reveal odd behaviors such as host pair relationships between IP addresses and domains/hosts that go against DNS standards.

The linkKind property notes the reason to identify the hosts as a parent-child pair. An example of this may be redirect.

For more information about host pairs, see the Microsoft Defender Threat Intelligence documentation for data sets.

Methods

Method	Return type	Description
Get	microsoft.graph.security.hostPair	Read the properties and relationships of a hostPair object.
List for a host	microsoft.graph.security.hostPair collection	Get a list of hostPair objects associated with a specified host, where the host is either the parent or child.
List for a host as child	microsoft.graph.security.hostPair collection	Get a list of hostPair objects associated with a host, where that host is the child and has an incoming pairing with a parent.
List for a host as parent	microsoft.graph.security.hostPair collection	Get a list of hostPair objects associated with a host, where that host is the parent and has an outgoing pairing to a child.

Properties

Property	Type	Description
firstSeenDateTime	DateTimeOffset	The first date and time when Microsoft Defender Threat Intelligence observed the hostPair. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z.
id	String	A system-generated ID for the hostPair.
lastSeenDateTime	DateTimeOffset	The last date and time when Microsoft Defender Threat Intelligence observed the hostPair. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z.
linkKind	String	The reason that two hosts are identified as hostPair.

Relationships

Relationship	Type	Description
childHost	microsoft.graph.security.host	Host reached via the parentHost.
parentHost	microsoft.graph.security.host	Host used to reach the childHost.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.hostPair",
  "id": "String (identifier)",
  "firstSeenDateTime": "String (timestamp)",
  "lastSeenDateTime": "String (timestamp)",
  "linkKind": "String",
  "parentHost": {
    "@odata.type": "#microsoft.graph.security.host",
    "id": "String (identifier)"
  },
  "childHost": {
    "@odata.type": "#microsoft.graph.security.host",
    "id": "String (identifier)"
  }
}