Defender changed how it handles API permissions multiple times in the recent past, so the MDATPDriver is responsible for selecting the correct resource, scope name, API URI, and login URI:
The msticpy.data.drivers.mdatp_driver.MDATPDriver is a subclass of msticpy.data.drivers.odata_driver.OData with a few key differences. The MDATPDriver class only allows confidential client credential auth flows using a secret, while its OData parent class supports both application and delegated user auth flows. This is because the Defender APIs previously did not allow delegated user auth. The MDATPDriver driver also determines the correct casing on some of the field names in the responses.
Problem
The current MDATPDriver class only supports authentication using a client secret and application permissions. The use of secrets is not allowed per the Secure Future Initiative.
Proposed Solution
Update the MDATPDriver class to allow delegated user authentication.
Ensure that msticpyconfig.yaml permits MicrosoftDefender.Args without a defined ClientSecret
Refactor msticpy.data.drivers.mdatp_driver.MDATPDriver to support delegated user auth
Context
Defender changed how it handles API permissions multiple times in the recent past, so the
MDATPDriveris responsible for selecting the correct resource, scope name, API URI, and login URI:AdvancedQuery.Readhttps://api.securitycenter.microsoft.com/advancedqueries/runhttps://login.microsoftonline.com/<tenantId>/oauth2/tokenMDE,MDATPAdvancedHunting.Readhttps://api.security.microsoft.com/advancedhunting/runhttps://login.microsoftonline.com/<tenantId>/oauth2/tokenM365DThreatHunting.Read.Allhttps://graph.microsoft.com/<version>//security/runHuntingQueryhttps://login.microsoftonline.com/<tenantId>/oauth2/v2.0/tokenM365DGraphThe
msticpy.data.drivers.mdatp_driver.MDATPDriveris a subclass ofmsticpy.data.drivers.odata_driver.ODatawith a few key differences. TheMDATPDriverclass only allows confidential client credential auth flows using a secret, while itsODataparent class supports both application and delegated user auth flows. This is because the Defender APIs previously did not allow delegated user auth. TheMDATPDriverdriver also determines the correct casing on some of the field names in the responses.Problem
The current
MDATPDriverclass only supports authentication using a client secret and application permissions. The use of secrets is not allowed per the Secure Future Initiative.Proposed Solution
Update the
MDATPDriverclass to allow delegated user authentication.msticpyconfig.yamlpermitsMicrosoftDefender.Argswithout a definedClientSecretmsticpy.data.drivers.mdatp_driver.MDATPDriverto support delegated user auth