Azure fraud notification - Get Fraud Events

Applies to: Partner Center API

This article explains how to get the list of impacted Azure resources that have Azure fraud activities.

Prerequisites

REST request

Request syntax

Method Request URI
GET {baseURL}/v1/fraudEvents>

Request headers

Request body

None.

Request example

GET https://api.partnercenter.microsoft.com/v1/fraudEvents?EventStatus={EventStatus}&SubscriptionId={SubscriptionId} HTTP/1.1
Authorization: Bearer <token>
Host: api.partnercenter.microsoft.com
Content-Type: application/json

URI parameter

Use the following optional query parameters when creating the request.

Name Type Required Description
EventStatus string No The fraud alert status, it's Active or Resolved.
SubscriptionId string No The Azure subscription ID, which has the Crypro-mining activities

REST response

If successful, this method returns a collection of Fraud events in the response body.

Response success and error codes

Each response comes with an HTTP status code that indicates success or failure and more debugging information. Use a network trace tool to read this code, error type, and more parameters. For the full list, see Error Codes.

Response example

HTTP/1.1 200 OK
Content-Length: 313
Content-Type: application/json
MS-CorrelationId: 4cb80cbe-566b-4d8b-8b8f-af1454b73089
MS-RequestId: 566330a7-1e4b-4848-9c23-f135c70fd810
Date: Thu, 21 May 2020 22:29:17 GMT
[
    {
        "eventTime": "2021-12-08T00:25:45.69",
        "eventId": "2a7064fb-1e33-4007-974e-352cb3f2c805_2edeb5b1-766f-4209-9271-3ddf27755afa",
        "partnerTenantId": "348e932d-ef58-4347-8351-be51e4ec148c",
        "partnerFriendlyName": "test partner",
        "customerTenantId": "a248da34-6840-4c67-82d7-7f55ccd50d03",
        "customerFriendlyName": "test customer",
        "subscriptionId": "2a7064fb-1e33-4007-974e-352cb3f2c805",
        "subscriptionType": "modern",
        "entityId": "2edeb5b1-766f-4209-9271-3ddf27755afa",
        "entityName": "sampleentity",
        "entityUrl": "\\sample\\entity\\url",
        "hitCount": "10",
        "catalogOfferId": "ms-azr-17g",
        "eventStatus": "Active",
        "serviceName": "sampleservice",
        "resourceName": "sampleresource",
        "resourceGroupName": "sampleresourcegroup",
        "firstOccurrence": "2021-12-08T00:25:45.69",
        "lastOccurrence": "2021-12-08T00:25:45.69",
        "resolvedReason": "None",
        "resolvedOn": "9999-12-31T23:59:59.9970000",
        "resolvedBy": ""
        "firstObserved" : "9999-12-31T23:59:59.9970000",
        "lastObserved" : "9999-12-31T23:59:59.9970000"
    }
]