HUNTING THROUGH APIS

Summary from the TLDR InfoSec newsletter

This blog compares three Microsoft security APIs for threat hunting: Azure Monitor API, which queries Sentinel data only; Graph API, which queries both Defender XDR and Sentinel data, and Defender ATP API, which is limited to Defender for Endpoint data. The Graph API is recommended as it offers unified access to both platforms and supports more data types, while the Defender ATP API has notable limitations, such as a 30-day query timeframe restriction. Each API needs specific permissions and has different rate limits, with the Graph API allowing over 45 calls per minute based on tenant size.