How to read Machine/Device Dynamic Tags from Graph Security API
I have spent a bit of time creating dynamic tagging rules in Defender, in hopes of using those tags to facilitate reporting and am running into an issue plus an inconsistency.
First, the inconsistency: In Defender endpoints are referred to as Devices, tags are Device Tags. In Security Centers Graph API, endpoints are referred to as Machines and the Tags are MachineTags. It's a small difference, but I feel like it's making it harder to find an answer.
The issue: When I retreive Machine data from https://api.security.microsoft.com/api/machines, it only provides Manually applied tags rather than Dynamic tags. The only way I can so far figure out to retrieve these machine tags is through Threat Hunting queries against DeviceInfo table, where booth sets of tags are present as DeviceManualTag and DeviceDynamicTag.
Has anyone else figured out how to coax the machine API endpoint into returning Dynamic tags? Or is using the threat hunting endpoint the only solution at the moment?
And to Microsoft: any timeframe for adding DynamicTags to the data returned from the machine api?