API to get Microsoft Defender Campaigns

Hashem Barakat 0

Is there a way to get the Campaigns data inside the Microsoft Defender Portal using an API?
User's image

James Hamil 26,961 Reputation points Microsoft Employee

2025-01-06T21:08:33.42+00:00

Hi @Hashem Barakat , what information do you need specifically from here?
Hashem Barakat 0 Reputation points

2025-01-07T05:51:43.2166667+00:00

Hi James, I am mainly looking for the Campaigns in the last month, the Name, Sample subject, Recipients, Inboxed, Clicked.

I have tried both Graph API and Defender API but i couldnt find anything related to the data i want.

Thank you.
James Hamil 26,961 Reputation points Microsoft Employee

2025-01-09T23:13:58.37+00:00

Hi @Hashem Barakat , I reached out to the Product Group about this, I'll let you know what I find!

Best,

James
Hashem Barakat 0 Reputation points

2025-01-10T05:43:28.29+00:00

Perfect, Thank you.
James Hamil 26,961 Reputation points Microsoft Employee

2025-01-23T20:59:34.34+00:00

Hi @Hashem Barakat , while checking network trace I found this:

"https://security.microsoft.com/api/CampaignIntelligence/GetKqlQuery?threatType=Campaign"

Payload:

{"startTime":"2025-01-20T07:00:00.000Z","endTime":"2025-01-22T06:59:59.000Z","query":{"ShouldUseRawContent":false,"RawContent":"","Root":{"$type":"Microsoft.Office.Compliance.Repository.ComplexCondition, Microsoft.Office.Compliance.Repository","Logic":"And","Conditions":[{"$type":"Microsoft.Office.Compliance.Repository.SimpleCondition, Microsoft.Office.Compliance.Repository","IsExclusive":false,"IsLeaf":true,"Property":"campaigndata_CampaignName","Operator":"EqualAnyof","ValueType":"String","Values":["abc"]}],"IsExclusive":false}}}

But unfortunately, I can't find any documentation on this yet. I've reached out to find more and I'll let you know when I do.

Best,

James

Share via

API to get Microsoft Defender Campaigns

Your answer