Microsoft Defender Advanced Threat Protection is an enterprise endpoint security platform designed to help organizations to prevent, detect, investigate, and respond to advanced threats. The platform offers API endpoints through which you can manage most aspects of your MDAPT instance. In this post we will be taking a look at a simple example of how we can utilize the MDATP API in a script.

Nowadays (and usually) the biggest challenge in Cybersecurity is not just to protect the organization from outsider threats, but to protect them from themselves. Internal threats can come in many shapes and sizes, from bypassing internal protection elements for browsing prohibited content, to deliberately sabotaging systems and leaking data.