title | description | ms.service | ms.author | author | ms.localizationpriority | manager | audience | ms.collection | ms.topic | ms.subservice | ms.custom | search.appverid | ms.date | |||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Get domain statistics API |
Learn how to use the Get domain statistics API to retrieve the statistics on the given domain in Microsoft Defender for Endpoint. |
defender-endpoint |
siosulli |
siosulli |
medium |
deniseb |
ITPro |
|
reference |
reference |
api |
met150 |
04/17/2024 |
[!INCLUDE Microsoft Defender XDR rebranding]
Applies to:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender XDR
Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.
[!includeMicrosoft Defender for Endpoint API URIs for US Government]
[!includeImprove request performance]
Retrieves the statistics on the given domain.
- Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
- The maximum value for
lookbackhours
is 720 hours (30 days).
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Use Microsoft Defender for Endpoint APIs
Permission type | Permission | Permission display name |
---|---|---|
Application | URL.Read.All | 'Read URLs' |
Delegated (work or school account) | URL.Read.All | 'Read URLs' |
Note
When obtaining a token using user credentials:
- The user needs to have at least the following role permission: 'View Data' (For more information, see Create and manage roles)
GET /api/domains/{domain}/stats
Header | Value |
---|---|
Authorization | Bearer {token}. Required. |
Name | Type | Description |
---|---|---|
lookBackHours | Int32 | Defines the hours we search back to get the statistics. Defaults to 30 days. Optional. |
Empty
If successful and domain exists - 200 OK, with statistics object in the response body. If domain doesn't exist - 200 OK with a prevalence set to 0.
Here's an example of the request.
GET https://api.security.microsoft.com/api/domains/example.com/stats?lookBackHours=48
Here's an example of the response.
{
"@odata.context": "https://api.security.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgDomainStats",
"host": "example.com",
"organizationPrevalence": 4070,
"orgFirstSeen": "2017-07-30T13:23:48Z",
"orgLastSeen": "2017-08-29T13:09:05Z"
}