microsoft / msticpy

Microsoft Threat Intelligence Security Tools
Other
1.72k stars 310 forks source link

Added additional DataProvider for Advanced Hunting via Graph #725

Closed d3vzer0 closed 8 months ago

d3vzer0 commented 9 months ago

Added changes to the MDATP driver to differentiate between legacy hunting and the newer Graph hunting queries: https://learn.microsoft.com/en-us/graph/api/security-security-runhuntingquery?view=graph-rest-1.0

Not sure how long the 'older' version will still be supported but the original documentation (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/run-advanced-query-api?view=o365-worldwide) mentions that the newer Graph version supports more tables/features :)