Skip to content

client.software

Access software inventory and related records.

Property

client.software

Methods

  • get_all(query: SoftwareQuery | None = None) -> SoftwareResults: list software inventory records.
  • get(id: str) -> SoftwareResults: fetch one software inventory record by ID.
  • distributions(id: str) -> DistributionDTOResults: fetch software distribution records.
  • machineReferences(id: str) -> MachineReferencesResults: fetch machines related to the software record.
  • vulnerabilities(id: str) -> VulnerabilityDTOResults: fetch vulnerabilities related to the software record.
  • getmissingkbs(id: str) -> ProductDTOResults: fetch missing KBs related to the software record.
  • inventoryByMachine(page_size: int = 50000, since: datetime | int | None = None) -> AssetSoftwareResults: fetch CPE software inventory rows by machine.
  • inventoryByMachineFiles() -> AssetSoftwareResults: fetch CPE software inventory rows via export files.
  • inventoryNoProductCodeByMachine(page_size: int = 50000, since: datetime | int | str | None = None) -> AssetNonCPESoftwareResults: fetch non-CPE software inventory rows by machine.
  • inventoryNoProductCodeByMachineFiles() -> AssetNonCPESoftwareResults: fetch non-CPE software inventory rows via export files.

Notes

  • This endpoint uses /api/Software with an uppercase S because that is the current package path.
  • The method name machineReferences follows the current mixed-case package surface.
  • The inventory export helpers delegate to machine assessment endpoints while keeping software inventory discoverable from client.software.

API

SoftwareQuery

Query parameters for the /api/Software endpoint.

SoftwareResults 

SoftwareResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/Software endpoint.

AssetSoftwareResults 

AssetSoftwareResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/Software/inventoryByMachine endpoint.

DistributionDTOResults 

DistributionDTOResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/Software/{id}/distributions endpoint.

AssetNonCPESoftwareResults 

AssetNonCPESoftwareResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/Software/inventoryNoProductCodeByMachine endpoint.

SoftwareEndpoint 

SoftwareEndpoint(http: Client, auth: MSALAuth)

Endpoint for /api/Software.

get_all 

get_all(
    query: SoftwareQuery | None = None,
) -> SoftwareResults

Get all software inventory records.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-software

get 

get(id: str) -> SoftwareResults

Get a specific software inventory record by ID.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-software-by-id

distributions 

distributions(id: str) -> DistributionDTOResults

Get software distribution records for a specific software inventory record.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-software-ver-distribution

machineReferences 

machineReferences(id: str) -> MachineReferencesResults

Get machine references for a specific software inventory record.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines-by-software

vulnerabilities 

vulnerabilities(id: str) -> VulnerabilityDTOResults

Get vulnerability records for a specific software inventory record.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-vuln-by-software

getmissingkbs 

getmissingkbs(id: str) -> ProductDTOResults

Get missing KBs for a specific software inventory record.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-missing-kbs-software

inventoryByMachine 

inventoryByMachine(
    page_size: int = 50000,
    since: datetime | int | None = None,
) -> AssetSoftwareResults

Responds with all the data of installed software that has a Common Platform Enumeration(CPE), per device.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory#1-export-software-inventory-assessment-json-response

inventoryByMachineFiles 

inventoryByMachineFiles() -> AssetSoftwareResults

Responds with all the data of installed software that has a Common Platform Enumeration(CPE), per device.

Same Results as inventoryByMachine but exported as a file instead of in the response body. Recommended for larger data sets, as it returns zipped files with the data instead of returning it in the response body.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory#1-export-software-inventory-assessment-json-response

inventoryNoProductCodeByMachine 

inventoryNoProductCodeByMachine(
    page_size: int = 50000,
    since: datetime | int | str | None = None,
) -> AssetNonCPESoftwareResults

Responds with all the data of installed software that does not have a Common Platform Enumeration(CPE), per device.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory#1-export-software-inventory-assessment-json-response

inventoryNoProductCodeByMachineFiles 

inventoryNoProductCodeByMachineFiles() -> (
    AssetNonCPESoftwareResults
)

Responds with all the data of installed software that does not have a Common Platform Enumeration(CPE), per device.

Same Results as inventoryNoProductCodeByMachine but exported as a file instead of in the response body. Recommended for larger data sets, as it returns zipped files with the data instead of returning it in the response body.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-inventory#2-export-software-inventory-assessment-via-files