Feature Request: Support URL and File Hash Reputation Queries in MDTI Premium API
- Dominant language
- Jupyter Notebook
- Stars
- 82
- Forks
- 23
- PR merge metrics
- No merged PRs in 30d
Description
**Description:**
The Microsoft Defender Threat Intelligence (MDTI) Premium API currently appears to only support querying domains (hosts) and IP addresses for reputation data.
Many security operations teams require the ability to also query full URLs and file hashes (SHA256, MD5, SHA1) for threat intelligence and reputation details via the API.
**Use Case:**
- Security teams enrich Indicators of Compromise (IoCs) during incident investigation.
- Current domain/IP-only support limits automated enrichment workflows.
- URLs and file hashes are common IoCs in phishing, malware, and intrusion investigations.
**Feature Request:**
Add support for the following in the MDTI Premium API:
URLs → Return reputation score, category, and threat details.
File hashes → Return reputation score, category, and threat details.
**Benefit:**
This would allow security teams to fully leverage MDTI Premium as a single source of truth for IoC enrichment without relying on third-party APIs.
**Questions:**
Is there an undocumented method to query URLs and hashes today?
If not, is support for these IoC types planned, and is there an ETA?
References:
[Graph Security API – Threat Intelligence Overview](https://learn.microsoft.com/en-us/graph/api/resources/security-threatintelligence-overview?view=graph-rest-1.0)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.