Microsoft Defender for Endpoint alerts API

Source and collection

Vendor API or configured event stream, with tenant permissions and retention controls.

Use the documented API scope and subscription; preserve event IDs, metadata version and pagination/offset state.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 4f1175121a46b487058bd1b468effe406b0fbb21532b6335578573ad9f7f3876

{"id":"da637291085411733957_-1043898914","incidentId":12,"investigationId":9,"assignedTo":"elastic@elasticuser.com","severity":"Low","status":"Resolved","classification":null,"determination":null,"investigationState":"Benign","detectionSource":"WindowsDefenderAv","category":"Malware","threatFamilyName":null,"title":"An active 'Exeselrun' malware was detected","description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.","alertCreationTime":"2020-06-30T10:09:01.1569718Z","firstEventTime":"2020-06-30T10:07:44.333733Z","lastEventTime":"2020-06-30T10:07:44.333733Z","lastUpdateTime":"2020-07-03T15:15:39.13Z","resolvedTime":"2020-06-30T11:13:12.2680434Z","machineId":"c5a964f417c11f6277d5bf9489f0d","computerDnsName":"testserver4","rbacGroupName":null,"aadTenantId":"123543-d66c-4c7e-9e30-40034eb7c6f3","relatedUser":null,"comments":[],"evidence":{"entityType":"File","sha1":null,"sha256":null,"fileName":"SB.xsl","filePath":"C:\\Windows\\Temp\\sb-sim-temp-ikyxqi\\sb_10554_bs_h4qpk5","processId":null,"processCommandLine":null,"processCreationTime":null,"parentProcessId":null,"parentProcessCreationTime":null,"ipAddress":null,"url":null,"accountName":null,"domainName":null,"userSid":null,"aadUserId":null,"userPrincipalName":null}}

Structure and field interpretation

id / event ID

Vendor-scoped identity; retain tenant context.

status

Workflow status is not evidence of maliciousness.

metadata

Stream version and cursor information where present.

Investigation uses

• Triage the stated detection with source telemetry and analyst context.
• Track duplicate delivery, status changes and last-update timestamps without overwriting original evidence.

Validation boundaries

An alert API object is not a DeviceProcessEvents raw event; verdict, investigation state and workflow status are different concepts.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• CrowdStrike Falcon event stream

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.