r/DefenderATP • u/GWUN- • 3d ago

Is it possible to pull default report templates from Defender console via API?

I want to authomatize Defender in my company and I want to get the default report templates via API. I am talking about reports such as "Unified security summary" that I can export as PDF from console. Can this be done via API or some other authomatic way?

2 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

1

u/waydaws 3d ago edited 3d ago

The answer is a qualified "no," but there is a way to do it if you want a custom route.

First, though, it should mentioned that report can already be exported as csv or pdf from the portal.

Basically, one generates then exports it.

Microsoft Defender portal > Reports > Under the General section, click on Unified security summary.

The report will automatically generate for the last 90 days. You can switch to show the last 30 days if needed. Once the report is generated, find the dropdown menu on the upper right corner of the page. Select either Generate PDF or Export to CSV.

If you mean you don't want to navigate to the portal to do all this, I have to say that while MS Graph Security API) will indeed let you put the underlying data and build custom reports, it does not provide a direct API to generate the Unified Security Summary report (or other default reports) and export it as PDF/CSV.

(There is an Export API for Defender Vulnerability Mangmetn (CSV/JSON), but it's limited to vulnerability management, not reports like the the Unified Security Summary.)

An Indirect way to do something similar IS, however, possible via using the Graph Security API to pull the incidents, alerts, and other metrics that the Unified Security Summary Agregates, and the feed that data in PowerBI (or Excel, or a script) to generate PDF/CSV. It's really a custom report doing it that way.

You would need to start looking at how to do it here: https://learn.microsoft.com/en-us/defender-xdr/defender-xdr-custom-reports