`client.files`¶

Look up file details and related entities.

Property¶

client.files

Methods¶

get(hash: str) -> FileResults: fetch file metadata by hash.
alerts(hash: str) -> AlertsResults: fetch alerts related to a file.
machines(hash: str) -> MachineResults: fetch machines related to a file.
stats(hash: str) -> FileStatsResults: fetch in-organization file statistics.

Notes¶

This endpoint uses the file hash as the lookup key.
Relationship methods return the same lazy wrappers used by their primary endpoint families.

API¶

FileResults ¶

FileResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results for the /api/files/{id} endpoint.

FileStatsResults ¶

FileStatsResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results for the /api/files/{id}/stats endpoint.

FileEndpoint ¶

FileEndpoint(http: Client, auth: MSALAuth)

Endpoint for interacting with file information.

get ¶

get(hash: str) -> FileResults

Get information about a file by its ID (hash).

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-file-information

alerts ¶

alerts(hash: str) -> AlertsResults

Get the alerts associated with a file.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-file-related-alerts

machines ¶

machines(hash: str) -> MachineResults

Get the machines associated with a file.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-file-related-machines

stats ¶

stats(hash: str) -> FileStatsResults

Get the in-organization stats for a file.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-file-statistics

client.files¶