Actions41
- Advanced Query Actions
- Alert Actions
- Exposure Score Actions
- Indicator Actions
- Investigation Actions
- Machine Actions
- Machine Action Actions
- Recommendation Actions
- Remediation Actions
- Software Actions
- Vulnerability Actions
Recommendation → Get All Recommendations
AI-generatedSummary
Retrieve multiple security recommendations from Microsoft Defender using optional OData query operators to filter, limit, or paginate the results.
Inputs
- authentication (required) — Choose OAuth2 for authenticating requests to Microsoft Defender API.
- odataOperators — Use OData filter, top, and skip operators to refine the query results. Filterable fields include ID, name, description, cvssV3, publishedOn, severity, and updatedOn. 'Top' limits the number of items returned, and 'Skip' offsets the start position.
- requestOptions — Optional HTTP request settings such as batching, SSL certificate handling, proxy configuration, and request timeouts.
Output shape
a list of recommendation objects as returned by the Microsoft Defender API endpoint /api/recommendations/
The output corresponds to the filtered and paginated list of recommendations fetched via a GET request to /api/recommendations/. Supports OData operators for pagination and filtering as query parameters. If no filtering is applied, defaults to returning up to 10 recommendations starting from the first record.
Examples
Example 1: Retrieve top 5 high severity recommendations
Set OData Filter to "severity eq 'High'" and Top to 5.