'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Check Patched Devices in Defender for Endpoint Vulnerability API
Question details
The user needs to know if patched devices continue to appear in later extracts generated by the Microsoft Defender for Endpoint software vulnerability APIs.
- Product
- Microsoft Defender for Endpoint
- Device & OS
- not provided
- Scenario
- Exporting device vulnerability assessments via API to track the status of vulnerable and patched devices in the network.
- Observed behavior
- Identifying whether patched devices are excluded from future full API extracts and how to accurately track newly fixed vulnerabilities.
Ensure you have the necessary Microsoft Defender for Endpoint API permissions and are familiar with calling both full and delta export endpoints.
Tracking Patched Devices Using Full and Delta API Exports
Understand how the Defender for Endpoint APIs handle patched devices through full state reflections and delta tracking.
The Microsoft Defender for Endpoint vulnerability APIs provide two different methods for exporting data: full exports and delta exports. It is crucial to use the correct API endpoint depending on whether you want to see the current state of the network or an audit of recent changes.
Call the full vulnerability assessment API. This extract strictly reflects the current state of your environment. If you originally had 100 vulnerable devices and successfully patched 30 of them, the next full extract will only show the remaining 70 vulnerable devices. The patched devices will automatically be removed from this list.
To explicitly track which devices were patched, call the delta export API. You must specify a date parameter. The API response will return data categorized into new, fixed, and updated vulnerabilities. Review the entries marked as 'fixed' to identify the exact devices that were recently patched.
Analyze API Export Data Effortlessly with WPS Office
While Microsoft Defender for Endpoint manages vulnerability tracking, analyzing the exported CSV or JSON data requires a robust spreadsheet tool. WPS Office provides a lightweight, easy-to-use, and free alternative to Microsoft Excel for formatting, managing, and reporting your security data.
- 1. Export your vulnerability data: Use the Microsoft Defender for Endpoint Delta API to export your patched device data as a standard CSV file.
- 2. Open with WPS Spreadsheet: Launch the free WPS Office suite, open the Spreadsheet application, and import your downloaded CSV export.
- 3. Filter and analyze: Utilize WPS Spreadsheet's built-in filtering and pivot table features to quickly isolate the 'fixed' status devices and generate security reports.
Frequently Asked Questions
Why are my patched devices missing from the full vulnerability assessment?
The full vulnerability assessment export only reflects the current, active state of your network. Once a vulnerability is patched, that device is no longer considered vulnerable to that specific threat and therefore drops off the full extract report.
How do I explicitly filter and find patched devices using the API?
You should use the Delta export API rather than the Full export. By setting a specific date parameter, the Delta export will retrieve historical changes, allowing you to filter the results by the 'fixed' status to view devices that have been recently patched.
Can I get historical vulnerability data using the Defender API?
Yes. By utilizing the Delta export and specifying a past date, you can retrieve all historical changes. This includes newly discovered vulnerabilities, updated statuses, and fixed vulnerabilities since your specified date.
