How to read Machine/Device Dynamic Tags from Graph Security API

Lucas Krupinski 0 Reputation points
2024-12-30T20:04:36.0466667+00:00

I have spent a bit of time creating dynamic tagging rules in Defender, in hopes of using those tags to facilitate reporting and am running into an issue plus an inconsistency.

First, the inconsistency: In Defender endpoints are referred to as Devices, tags are Device Tags. In Security Centers Graph API, endpoints are referred to as Machines and the Tags are MachineTags. It's a small difference, but I feel like it's making it harder to find an answer.

The issue: When I retreive Machine data from https://api.security.microsoft.com/api/machines, it only provides Manually applied tags rather than Dynamic tags. The only way I can so far figure out to retrieve these machine tags is through Threat Hunting queries against DeviceInfo table, where booth sets of tags are present as DeviceManualTag and DeviceDynamicTag.

Has anyone else figured out how to coax the machine API endpoint into returning Dynamic tags? Or is using the threat hunting endpoint the only solution at the moment?

And to Microsoft: any timeframe for adding DynamicTags to the data returned from the machine api?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
12,760 questions
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint: A Microsoft unified security platform for preventative protection, postbreach detection, and automated investigation and response. Previously known as Microsoft Defender Advanced Threat Protection.Training: Instruction to develop new skills.
19 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.