Skip to content

client.vulnerabilities

Access vulnerability records and related machine views.

Property

client.vulnerabilities

Methods

  • get_all(query: VulnerabilitiesQuery | None = None) -> VulnerabilityResults: list vulnerabilities.
  • get(id: str) -> VulnerabilityResults: fetch one vulnerability by ID.
  • machineReferences(id: str) -> MachineReferencesResults: fetch machines related to a vulnerability.
  • machinesVulnerabilities(query: VulnerabilitiesByMachineAndSoftwareQuery | None = None) -> VulnerabilitiesByMachineAndSoftwareResults: fetch the machine-vulnerability collection path.
  • softwareVulnerabilitiesByMachine(page_size: int = 50000) -> AssetVulnerabilityResults: fetch software vulnerability assessment rows by machine.
  • softwareVulnerabilitiesByMachineFiles() -> AssetVulnerabilityResults: fetch software vulnerability assessment rows via export files.
  • softwareVulnerabilityChangesByMachine(page_size: int = 50000, since: datetime | int | str | None = None) -> DeltaAssetVulnerabilityResults: fetch delta software vulnerability assessment rows by machine.

Notes

  • Use VulnerabilitiesQuery and VulnerabilitiesByMachineAndSoftwareQuery when you need collection-level filtering for vulnerability datasets.
  • The software vulnerability helpers delegate to the machine assessment endpoints while keeping them discoverable from client.vulnerabilities.

API

VulnerabilitiesQuery

Query parameters for the /api/vulnerabilities endpoint.

VulnerabilitiesByMachineAndSoftwareQuery

Query parameters for the /api/vulnerabilities/machinesVulnerabilities endpoint.

VulnerabilityResults 

VulnerabilityResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/vulnerabilities endpoint.

AssetVulnerabilityResults 

AssetVulnerabilityResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/machines/SoftwareVulnerabilitiesByMachine endpoint.

DeltaAssetVulnerabilityResults 

DeltaAssetVulnerabilityResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/machines/SoftwareVulnerabilityChangesByMachine endpoint with delta query parameters.

VulnerabilitiesByMachineAndSoftwareResults 

VulnerabilitiesByMachineAndSoftwareResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/vulnerabilities/machinesVulnerabilities endpoint.

VulnerabilityDTOResults 

VulnerabilityDTOResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/machines/{id}/vulnerabilities endpoint.

VulnerabilityEndpoint 

VulnerabilityEndpoint(http: Client, auth: MSALAuth)

Endpoint for /api/vulnerabilities.

get_all 

get_all(
    query: VulnerabilitiesQuery | None = None,
) -> VulnerabilityResults

Get all vulnerabilities.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities

get 

get(id: str) -> VulnerabilityResults

Get a vulnerability by ID.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-vulnerability-by-id

machineReferences 

machineReferences(id: str) -> MachineReferencesResults

Get machine references from a Vulnerability CVE ID.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines-by-vulnerability

machinesVulnerabilities 

machinesVulnerabilities(
    query: VulnerabilitiesByMachineAndSoftwareQuery
    | None = None,
) -> VulnerabilitiesByMachineAndSoftwareResults

Get machines with a vulnerability

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities-by-machines

softwareVulnerabilitiesByMachine 

softwareVulnerabilitiesByMachine(
    page_size: int = 50000,
) -> AssetVulnerabilityResults

Get vulnerabilities for a machine with software references.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities#1-export-software-vulnerabilities-assessment-json-response

softwareVulnerabilitiesByMachineFiles 

softwareVulnerabilitiesByMachineFiles() -> (
    AssetVulnerabilityResults
)

Get vulnerabilities for a machine with software references.

Same Results as softwareVulnerabilitiesByMachine but exported as a file instead of in the response body. Recommended for larger data sets, as it returns zipped files with the data instead of returning it in the response body.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities#2-export-software-vulnerabilities-assessment-via-files

softwareVulnerabilityChangesByMachine 

softwareVulnerabilityChangesByMachine(
    page_size: int = 50000,
    since: datetime | int | str | None = None,
) -> DeltaAssetVulnerabilityResults

Get vulnerabilities for a machine with software references.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities - https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities#3-delta-export-software-vulnerabilities-assessment-json-response