hostReputation resource type
Namespace: microsoft.graph.security
Note
The Microsoft Graph API for Microsoft Defender Threat Intelligence requires an active Defender Threat Intelligence Portal license and API add-on license for the tenant.
Represents the reputation of a host based on a series of rules. This score helps users quickly understand any detected ties to malicious or suspicious infrastructure when validating the reputation of a known or unknown entity. The platform provides quick information about the activity of these entities (such as first and last seen timestamps or autonomous system details) and a list of rules that affect the reputation score when applicable.
Reputation data is important to understanding the trustworthiness of an attack surface and is also useful when assessing unknown hostnames or IP addresses that appear in investigations. These scores uncover any prior malicious or suspicious activity that affected the entity, or other known indicators of compromise to consider.
Methods
| Method | Return type | Description |
|---|---|---|
| Get host reputation | microsoft.graph.security.hostReputation | Read the properties and relationships of a microsoft.graph.security.hostReputation object, for a given microsoft.graph.security.host. |
Properties
| Property | Type | Description |
|---|---|---|
| classification | microsoft.graph.security.hostReputationClassification | The calculated reputation of the host. The possible values are: unknown, neutral, suspicious, malicious, unknownFutureValue. |
| id | String | A system-generated ID for this hostReputation. |
| rules | microsoft.graph.security.hostReputationRule collection | A collection of rules that have been used to calculate the classification and score. |
| score | Int32 | The calculated score (0-100) of the requested host. A higher value indicates that this host is more likely to be suspicious or malicious. |
Relationships
None.
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security.hostReputation",
"classification": "String",
"id": "String (identifier)",
"rules": [
{
"@odata.type": "microsoft.graph.security.hostReputationRule"
}
],
"score": "Int32"
}