`MDEClient`¶

MDEClient is the top-level entry point for the package.

Constructor¶

MDEClient(
    tenant_id: str,
    client_id: str,
    client_secret: str,
    *,
    base_url: str = "https://api.securitycenter.microsoft.com",
    token_cache: msal.TokenCache | None = None,
    http_client: httpx.Client | None = None,
)

Parameters¶

tenant_id: Azure AD tenant ID.
client_id: app registration client ID.
client_secret: app registration client secret.
base_url: optional override for the Defender API base URL.
token_cache: optional MSAL token cache.
http_client: optional pre-configured httpx.Client.

Lifecycle¶

MDEClient is a context manager:

with MDEClient(...) as client:
    rows = client.machines.get_all().to_dicts()

If you do not use the context-manager form, call close() when you are done.

Top-level endpoint properties¶

advanced_queries
alerts
authenticated_definitions
authenticated_agents
baseline_configurations
browser_extension
certificate_inventory
device_av_health
device_groups
domain
files
firmware
incidents
indicators
investigations
ips
library
machine_actions
machines
recommendations
remediations
score
settings
software
user
vulnerabilities

See Endpoint index for endpoint-specific pages.

Public top-level imports¶

The package exports these names from mde_client:

MDEClient
AuthenticationError
ViaFiles
ViaFilesConfig
EmptyExportBlobError

API¶

MDEClient ¶

MDEClient(
    tenant_id: str,
    client_id: str,
    client_secret: str,
    *,
    base_url: str = _DEFAULT_BASE_URL,
    token_cache: TokenCache | None = None,
    http_client: Client | None = None,
)

Top-level client for the Microsoft Defender for Endpoint API.

Manages the HTTP session and auth lifecycle. Endpoint-specific functionality is accessed via properties (e.g. client.machines).

Parameters:

Name	Type	Description	Default
`tenant_id`	`str`	Azure AD tenant ID.	required
`client_id`	`str`	App registration client ID.	required
`client_secret`	`str`	App registration client secret.	required
`base_url`	`str`	Override the default MDE API base URL.	`_DEFAULT_BASE_URL`
`token_cache`	`TokenCache \| None`	Inject an msal.SerializableTokenCache for persistent caching. Defaults to in-memory (msal.TokenCache).	`None`
`http_client`	`Client \| None`	Inject a pre-configured httpx.Client, e.g. for testing or to set custom timeouts/proxies.	`None`

Example

client = MDEClient( tenant_id="...", client_id="...", client_secret="...", ) table = client.machines.get_all(MachinesQuery(health_status="Active"))

close ¶

close() -> None

Close the underlying HTTP connection pool.

MDEClient¶