Upraviť

Zdieľať cez

Cancel machine action API

  • Článok

Applies to:

Important

Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

Note

If you are a US Government customer, please use the URIs listed in Microsoft Defender for Endpoint for US Government customers.

Tip

For better performance, you can use server closer to your geo location:

  • us.api.security.microsoft.com
  • eu.api.security.microsoft.com
  • uk.api.security.microsoft.com
  • au.api.security.microsoft.com
  • swa.api.security.microsoft.com
  • ina.api.security.microsoft.com

API description

Cancel an already launched machine action that isn't yet in final state (completed, canceled, failed).

Limitations

  1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.

Permissions

One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Get started.

Permission type Permission Permission display name
Application Machine.CollectForensics
Machine.Isolate
Machine.RestrictExecution
Machine.Scan
Machine.Offboard
Machine.StopAndQuarantine
Machine.LiveResponse		 Collect forensics
Isolate machine
Restrict code execution
Scan machine
Offboard machine
Stop And Quarantine
Run live response on a specific machine
Delegated (work or school account) Machine.CollectForensics
Machine.Isolate
Machine.RestrictExecution
Machine.Scan
Machine.Offboard
Machine.StopAndQuarantineMachine.LiveResponse		 Collect forensics
Isolate machine
Restrict code execution
Scan machine
Offboard machine
Stop And Quarantine
Run live response on a specific machine

HTTP request

POST https://api.securitycenter.microsoft.com/api/machineactions/<machineactionid>/cancel

Request headers

Name Type Description
Authorization String Bearer {token}. Required.
Content-Type string application/json. Required.

Request body

Parameter Type Description
Comment String Comment to associate with the cancellation action.

Response

If successful, this method returns 200, OK response code with a Machine Action entity. If machine action entity with the specified id wasn't found - 404 Not Found.

Example

Request

Here's an example of the request.

POST
https://api.securitycenter.microsoft.com/api/machineactions/988cc94e-7a8f-4b28-ab65-54970c5d5018/cancel

{
    "Comment": "Machine action was canceled by automation"
}

Related article

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.