api

Legacy Microsoft Defender XDR APIs

The legacy Microsoft Defender XDR API surface covers Defender XDR incidents and advanced hunting endpoints under api.security.microsoft.com. Microsoft Graph Security API is the forward-looking replacement for advanced hunting integrations, and Microsoft says the older advanced hunting endpoints stop returning data on February 1, 2027.

apisCurrent

Relationships

DeviceProcessEvents
Exposed tabletableDeviceEvents
Exposed tabletableDeviceFileEvents
Exposed tabletableDeviceNetworkEvents
Exposed tabletableDeviceRegistryEvents
Exposed tabletableDeviceLogonEvents
Exposed tabletableDeviceImageLoadEvents
Exposed tabletableDeviceInfo
Exposed tabletableEmailEvents
Exposed tabletableEmailUrlInfo
Exposed tabletableEmailAttachmentInfo
Exposed tabletableEmailPostDeliveryEvents
Exposed tabletableUrlClickEvents
Exposed tabletableCampaignInfo
Exposed tabletableFileMaliciousContentInfo
Exposed tabletableMessageEvents
Exposed tabletableMessageUrlInfo
Exposed tabletableMessagePostDeliveryEvents
Exposed tabletable

Example Request

http
GET https://api.security.microsoft.com/api/incidents
Authorization: Bearer <token>

POST https://api.security.microsoft.com/api/advancedhunting/run
Authorization: Bearer <token>
Content-Type: application/json

{"Query":"DeviceProcessEvents | take 10"}