threatIntelligence resource type
Namespace: microsoft.graph.security
Note
The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.
Provides APIs to retrieve threat intelligence information, such as about a host or an article on a threat.
The Microsoft Graph threat intelligence API delivers world-class threat intelligence to help protect your organization from modern cyber threats. Using threat intelligence APIs, you can identify adversaries and their operations, accelerate detection and remediation, and enhance your security investments and workflows.
The threat intelligence API allows you to operationalize intelligence found within the user interface. This includes finished intelligence in the forms of articles and intel profiles, machine intelligence including indicators of compromise (IoCs) and reputation verdicts, and finally, enrichment data including passive DNS, cookies, components, and trackers.
Methods
| Method | Return type | Description |
|---|---|---|
| List articles | microsoft.graph.security.article collection | Get a list of article objects, including their properties and relationships. |
| List intelProfiles | microsoft.graph.security.intelligenceProfile collection | Get a list of intelligenceProfile resources. |
| Get hostPort | microsoft.graph.security.hostPort | Get the properties and relationships of a hostPort object. |
| List sslCertificates | microsoft.graph.security.sslCertificate collection | Get a list of sslCertificate objects and their properties. |
| List whoisRecords | microsoft.graph.security.whoisRecord | Get a list of whoisRecord objects. |
Properties
None.
Relationships
| Relationship | Type | Description |
|---|---|---|
| articleIndicators | microsoft.graph.security.articleIndicator collection | Refers to indicators of threat or compromise highlighted in an article. Note: List retrieval is not yet supported. |
| articles | microsoft.graph.security.article collection | A list of article objects. |
| hostComponents | microsoft.graph.security.hostComponent collection | Retrieve details about hostComponent objects. Note: List retrieval is not yet supported. |
| hostCookies | microsoft.graph.security.hostCookie collection | Retrieve details about hostCookie objects. Note: List retrieval is not yet supported. |
| hostPairs | microsoft.graph.security.hostPair collection | Retrieve details about hostTracker objects. Note: List retrieval is not yet supported. |
| hostPorts | microsoft.graph.security.hostPort collection | Retrieve details about hostPort objects. Note: List retrieval is not yet supported. |
| hostSslCertificates | microsoft.graph.security.hostSslCertificate collection | Retrieve details about hostSslCertificate objects. Note: List retrieval is not yet supported. |
| hostTrackers | microsoft.graph.security.hostTracker collection | Retrieve details about hostTracker objects. Note: List retrieval is not yet supported. |
| hosts | microsoft.graph.security.host collection | Refers to host objects that Microsoft Threat Intelligence has observed. Note: List retrieval is not yet supported. |
| intelProfileIndicators | microsoft.graph.security.intelligenceProfileIndicator collection | Refers to indicators of threat or compromise highlighted in an intelligenceProfile. Note: List retrieval is not yet supported. |
| intelProfiles | microsoft.graph.security.intelligenceProfile collection | A list of intelligenceProfile objects. |
| passiveDnsRecords | microsoft.graph.security.passiveDnsRecord collection | Retrieve details about passiveDnsRecord objects. Note: List retrieval is not yet supported. |
| sslCertificates | microsoft.graph.security.sslCertificate collection | Retrieve details about sslCertificate objects. Note: List retrieval is not yet supported. |
| subdomains | microsoft.graph.security.subdomain collection | Retrieve details about the subdomain. Note: List retrieval is not yet supported. |
| vulnerabilities | microsoft.graph.security.vulnerability collection | Retrieve details about vulnerabilities. Note: List retrieval is not yet supported. |
| whoisHistoryRecords | microsoft.graph.security.whoisHistoryRecord collection | Retrieve details about whoisHistoryRecord objects. Note: List retrieval is not yet supported. |
| whoisRecords | microsoft.graph.security.whoisRecord collection | A list of whoisRecord objects. |
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security.threatIntelligence"
}