Retrieving Windows Defender ATP query API data with PowerShell

Tue, 09 Jan 2018 20:45:15 +0000

I am currently working on some automation around Windows Defender, so started to look at the Windows Defender Advanced Threat Protection query API.

Note that this API is still in preview. I wrote two functions for this.

Connect-WindowsATP is used to get an access token. Note that you will need to first register the API in Azure Directory so that you get an Application ID that you have to include at the top of the script.

API on Anything About IT

Retrieving Windows Defender ATP query API data with PowerShell