Actions41
- Advanced Query Actions
- Alert Actions
- Exposure Score Actions
- Indicator Actions
- Investigation Actions
- Machine Actions
- Machine Action Actions
- Recommendation Actions
- Remediation Actions
- Software Actions
- Vulnerability Actions
Advanced Query → Run
AI-generatedSummary
Execute an advanced KQL (Kusto Query Language) query against the Microsoft Defender API to retrieve security-related data.
Inputs
- Authentication (required) — Select the authentication method. Only OAuth2 is available.
- KQL Query (required) — Provide the KQL query string to execute. The query is sent in the request body under the property 'Query'.
- Request Options — Optional settings for the request including batching controls, SSL verification behavior, proxy configuration, and timeout duration.
Output shape
a JSON object containing the results of the executed KQL query
The query response depends on the KQL provided. Only a single result is returned per execution. Request options such as batching and timeout can influence execution behavior and performance.
Examples
Example 1: Run a query to get device info for the first 5 records
Set KQL Query parameter to 'DeviceInfo | take 5' and authenticate via OAuth2.