`client.user`¶

Access user-related alert and machine relationships.

Property¶

client.user

Methods¶

alerts(id: str) -> AlertsResults: fetch alerts related to a user.
machines(id: str) -> MachineResults: fetch machines related to a user.

Notes¶

The property name is user, not users.
This endpoint is relationship-oriented and does not expose a user listing method.

API¶

UserResults ¶

UserResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/users endpoint.

UserEndpoint ¶

UserEndpoint(http: Client, auth: MSALAuth)

Endpoint for /api/users.

alerts ¶

alerts(id: str) -> AlertsResults

Get alerts related to a specific user.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-user-related-alerts

machines ¶

machines(id: str) -> MachineResults

Get machines related to a specific user.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-user-related-machines

client.user¶