You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/api/exposed-apis-full-sample-powershell.md
+12-9Lines changed: 12 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,7 @@ search.appverid: met150
30
30
-[Microsoft Defender for Business](/defender-business)
31
31
32
32
> [!IMPORTANT]
33
-
> Advanced hunting capabilities are not included in Defender for Business.
33
+
> Advanced hunting capabilities aren't included in Defender for Business.
34
34
35
35
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630&clcid=0x409&culture=en-us&country=us)
36
36
@@ -51,8 +51,10 @@ In this section, we share PowerShell samples to
51
51
52
52
## Preparation instructions
53
53
54
-
- Open a PowerShell window.
55
-
- If your policy doesn't allow you to run the PowerShell commands, you can run the below command:
54
+
1. Open a PowerShell window.
55
+
56
+
2. If your policy doesn't allow you to run the PowerShell commands, you can run the following command:
57
+
56
58
```
57
59
Set-ExecutionPolicy -ExecutionPolicy Bypass
58
60
```
@@ -61,13 +63,12 @@ For more information, see [PowerShell documentation](/powershell/module/microsof
61
63
62
64
## Get token
63
65
64
-
Run the below:
65
-
66
-
- $tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query is run on the data of this tenant)
67
-
- $appId: ID of your Microsoft Entra app (the app must have 'Run advanced queries' permission to Defender for Endpoint)
68
-
- $appSecret: Secret of your Microsoft Entra app
66
+
Run the following command, using your information as follows:
69
67
70
-
- $suspiciousUrl: The URL
68
+
-`$tenantId`: ID of the tenant on behalf of which you want to run the query (that is, the query is run on the data of this tenant)
69
+
-`$appId`: ID of your Microsoft Entra app (the app must have 'Run advanced queries' permission to Defender for Endpoint)
70
+
-`$appSecret`: Secret of your Microsoft Entra app
71
+
-`$suspiciousUrl`: The URL
71
72
72
73
73
74
```
@@ -132,7 +133,9 @@ $response
132
133
133
134
134
135
## See also
136
+
135
137
-[Microsoft Defender for Endpoint APIs](apis-intro.md)
0 commit comments