Defender 365 REST API (您没有访问资源所需的任何应用程序权限(Incident.ReadWrite.All、Incident.Read.All) )

Question

我正在尝试从Defender 365 (MDATP)下载事件列表。

我有一个获取不记名令牌的脚本：

. 'Functions\Credentials.ps1'

Function GET_BEARER_TOKEN_FOR_MDATP_AUTHENTICATION {

    $Body = [Ordered] @{
        resource      = "$ResourceApplicationIdUri"
        client_id     = "$ApplicationId"
        client_secret = "$ApplicationSecret"
        grant_type    = 'client_credentials'
    }

    try {
        $Response = Invoke-RestMethod -Method Post -Uri $OAuthenticationURI -Body $body -ErrorAction Stop
    }
    catch {
        Write-Output("unable to get the bearer token") 
        Exit
    }  
    $BearerToken = $Response.access_token
    
    return $BearerToken
}

$xx = GET_BEARER_TOKEN_FOR_MDATP_AUTHENTICATION
$xx | Out-File '.\Bearer_Token.txt'

这个脚本运行得很好。今天，我被授予了显示事件的权限。

当我尝试这样做时，我得到了错误消息：

{
    "error": {
        "code": "Forbidden",
        "message": "The application does not have any of the required application permissions (Incident.ReadWrite.All, Incident.Read.All) to access the resource.",
 }
}

当我登录令牌测试器网站时：https://jwt.ms/

我看不到这些incident.Read.All角色，只能看到：

  "roles": [
    "Alert.ReadWrite.All",
    "AdvancedQuery.Read.All"
  ]

本说明书中给出了以下角色：

https://docs.microsoft.com/en-us/microsoft-365/security/defender/api-create-app-web?view=o365-worldwide

非常感谢，艾斯特

Answer 1

所以我找到了问题所在：

$ResourceApplicationIdUri = 'https://api.securitycenter.microsoft.com‘(允许警报) $ResourceApplicationIdUri = 'https://api.security.microsoft.com’(允许事件)

致敬，艾斯特