Query Models¶

Query models inherit from BaseQuery.

Shared fields¶

Every query model can inherit these pagination controls:

page_size mapped to pageSize
top mapped to $top
skip mapped to $skip

Filter translation¶

Non-null model fields are converted into OData-style filters.

strings become field eq 'value'
datetimes become ISO-formatted equality filters
lists of strings become field in (...)

Fields set to None are omitted.

Naming convention¶

Defender-specific query models preserve upstream API field names instead of normalizing them to snake_case. For example:

healthStatus
machineTags
lastSeen
creationDateTimeUtc

This keeps query construction close to the upstream API surface and avoids a second naming layer in the package.

Common endpoint query models¶

MachinesQuery
AlertsQuery
IndicatorsQuery
InvestigationQuery
MachineActionsQuery
RecommendationQuery
RemediationQuery
SoftwareQuery
VulnerabilitiesQuery
VulnerabilitiesByMachineAndSoftwareQuery

API¶

BaseQuery ¶

Base query parameters for API endpoints.

All fields are optional — omitted fields are simply not sent. Pydantic enforces the constraints (ge/le) at construction time, so invalid values are caught before hitting the wire.

Example

query = BaseQuery(page_size=500)

to_odata_filters `property` ¶

to_odata_filters: dict[str, str]

Convert query fields to OData filter clauses.

This is used by endpoints that support OData filtering. Only fields that are not None are included in the output.

to_datetime_format ¶

to_datetime_format(
    format: str = "%Y-%m-%d", regex: str | None = None
) -> BaseQuery

Converts the sinceTime field to a string in the specified format, if it is not already a string.