Azure / Azure/MDTI-Solutions

Feature Request: Support URL and File Hash Reputation Queries in MDTI Premium API

Open
#37 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Jupyter Notebook
Stars
82
Forks
23
PR merge metrics
No merged PRs in 30d

Description

**Description:**
The Microsoft Defender Threat Intelligence (MDTI) Premium API currently appears to only support querying domains (hosts) and IP addresses for reputation data.

Many security operations teams require the ability to also query full URLs and file hashes (SHA256, MD5, SHA1) for threat intelligence and reputation details via the API.

**Use Case:**

- Security teams enrich Indicators of Compromise (IoCs) during incident investigation.
- Current domain/IP-only support limits automated enrichment workflows.
- URLs and file hashes are common IoCs in phishing, malware, and intrusion investigations.

**Feature Request:**
Add support for the following in the MDTI Premium API:

URLs → Return reputation score, category, and threat details.

File hashes → Return reputation score, category, and threat details.

**Benefit:**
This would allow security teams to fully leverage MDTI Premium as a single source of truth for IoC enrichment without relying on third-party APIs.

**Questions:**

Is there an undocumented method to query URLs and hashes today?

If not, is support for these IoC types planned, and is there an ETA?

References:

[Graph Security API – Threat Intelligence Overview](https://learn.microsoft.com/en-us/graph/api/resources/security-threatintelligence-overview?view=graph-rest-1.0)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.