Represents the Threat Report from Secure->Threat Report in the Augmentt Portal for a specific company, including Risk Detection Trends, Identity and Security Compliance Scores, Risk detection locations and At Risk Accounts. This API provides the Threat Report content of a specific entity as indicated by the parameter customerId.

Properties

Property name	Description
totalRiskDetections	Array of license types in the tenant.
riskDetectionsTrend	Array of trends identified in the tenant.
locationOfRiskDetections	Location of risk detections, used in the UI's map.
integrationComplianceScore	Microsoft Identity Score achieved.
integrationSecurityScore	Microsoft Security Score.
riskDetections	Summary of risky events detected.
atRiskAccounts	Summary of accounts at risk.

riskDetectionsTrend values

Member	Description
key	Timestamp of the snapshot
value	Risk detections count in the snapshot

locationOfRiskDetections values

Member

Description

markers

Array of risk detections with their geolocation details, containing the sub-properties:

risk: Risk level of the event
coordinates: Array with latitude and longitude
radius: Radius range from coordinate point

risksByCountry

Array of risk detections by county, containing the sub-properties:

country: Country of origin (2 character identifier)
highRisks: Count of high level risky events
mediumRisks: Count of medium level risky events
lowRisks: Count of low level risky events
informationalRisks: Count of informational level risky events
unknownRisks: Count of risky events with unknown level
riskCount: Total count of risky events

integrationSecurityScore values

Member	Description
value	Security score achieved
count	Points achieved
total	Total points

riskDetections values

Member	Description
highRisk	Count of high level risky events
mediumRisk	Count of medium level risky events
lowRisk	Count of low level risky events
informationalRisk	Count of informational level risky events
unknownRisk	Count of risky events with unknown level
top5Types	Array with the 5 top risk types identified, containing the sub-properties: riskType: Type of risky event count: Count of risky events identified
top5AccountsAtRisk	Array with the 5 top user accounts at risk, containing the sub-properties: account: User's full name role: Array of roles assigned to the user count: Count of risky events identified userId: Microsoft's user ID
risks	Array of risky events, containing the following sub-properties: id: Identifier of the incident position in the array riskType: Risk event type displayName: User's full name firstName: User's first name lastName: User's last name location: Country of origin (2 character identifier) severity: Severity level of the event date: Date of the event (yyyy-mm-dd) userId: Microsoft's user ID

atRiskAccounts values

Member

Description

mfaStatus

Summary of MFA Status protection and list of users at risk, containing the sub-properties:

count: Count accounts at risk by MFA Status
overview: Summary of protection status
- protected: Count of protected users
- notProtected: Count of users not protected
- signInBlocked: Count of users with sign-in blocked
accounts: Accounts at risk details
- id: User's unique ID
- displayName: User's full name
- firstName: User's first name
- lastName: User's last name
- username: User's email address (service principal)
- licenseType: Array of Microsoft licenses assigned to the user
- role: Array of roles assigned to the user
- group: Array of groups assigned to the user
- mfaStatus: Status of MFA protection
- mfaRegistration: Status of MFA registration
- lastActive: Days since last login
- isInactive: Boolean identifier of inactivity
- userId: Microsoft's user ID
- lastAppActivity: Last application with recorded user activity

mfaRegistration

Summary of MFA Registration protection and list of users at risk, containing the sub-properties:

count: Count accounts at risk by MFA Registration
overview: Summary of registration status
- registered: Count of registered users
- notRegistered: Count of users not registered
- unknown: Count of users with unknown registration
accounts: Accounts at risk details
- id: User's unique ID
- displayName: User's full name
- firstName: User's first name
- lastName: User's last name
- username: User's email address (service principal)
- licenseType: Array of Microsoft licenses assigned to the user
- role: Array of roles assigned to the user
- group: Array of groups assigned to the user
- mfaStatus: Status of MFA protection
- mfaRegistration: Status of MFA registration
- lastActive: Days since last login
- isInactive: Boolean identifier of inactivity
- userId: Microsoft's user ID
- lastAppActivity: Last application with recorded user activity

inactiveAccounts

Summary of Inactive Accounts and list of users at risk, containing the sub-properties:

count: Count accounts at risk by inactivity
overview: Summary of inactivity status
- inactive: Count of inactive users
- active: Count of active users
accounts: Accounts at risk details
- id: User's unique ID
- displayName: User's full name
- firstName: User's first name
- lastName: User's last name
- username: User's email address (service principal)
- licenseType: Array of Microsoft licenses assigned to the user
- role: Array of roles assigned to the user
- group: Array of groups assigned to the user
- mfaStatus: Status of MFA protection
- mfaRegistration: Status of MFA registration
- lastActive: Days since last login
- isInactive: Boolean identifier of inactivity
- userId: Microsoft's user ID
- lastAppActivity: Last application with recorded user activity

HTTP request

GET - /v1/reports/threat/:customerId

Request headers

Name	Description
AccessKeyId	Access Key ID provided by our team
AccessKeySecret	Access Key Secret provided by our team

Request body

Don't supply a request body for this method

Response

A successful return is a 200 OK response code and a collection of risk detection totals, trends, locations, integration scores and at-risk account details.

Example

Request

GET https://api.augmentt.com/v1/reports/threat/123

Response

{

"totalRiskDetections": 9127,

"riskDetectionsTrend": [

{

"key": 1716508800000,

"value": 90

},

{

"key": 1716854400000,

"value": 1019

},

{

"key": 1717027200000,

"value": 81

},

{

"key": 1717113600000,

"value": 101

}

],

"locationOfRiskDetections": {

"markers": [

{

"risk": "low",

"coordinates": [

-79.51219,

43.70317

],

"radius": 5.026189436927106

},

{

"risk": "low",

"coordinates": [

-73.57,

45.52

],

"radius": 5.002182453077259

},

{

"risk": "low",

"coordinates": [

-73.97902,

40.75891

],

"radius": 5

}

],

"risksByCountry": [

{

"country": "CA",

"highRisks": 0,

"mediumRisks": 0,

"lowRisks": 20,

"informationalRisks": 0,

"unknownRisks": 0,

"riskCount": 20

},

{

"country": "US",

"highRisks": 334,

"mediumRisks": 399,

"lowRisks": 2,

"informationalRisks": 0,

"unknownRisks": 0,

"riskCount": 735

}

]

},

"integrationComplianceScore": {

"value": 73.77

},

"integrationSecurityScore": {

"value": 81.56,

"count": 230,

"total": 282

},

"riskDetections": {

"highRisk": 5924,

"mediumRisk": 2991,

"lowRisk": 198,

"informationalRisk": 14,

"unknownRisk": null,

"top5Types": [

{

"riskType": "office365_ualrule_failed_signin_outside_country_from_bad_country_list",

"count": 4401

},

{

"riskType": "office365_ualrule_five_failed_signin_attempts_from_outside_operating_country",

"count": 1481

},

{

"riskType": "office365_ualrule_failed_signin_outside_country_without_mfa",

"count": 1473

},

{

"riskType": "office365_ualrule_successful_signin_from_outside_operating_country",

"count": 879

},

{

"riskType": "office365_ualrule_successful_signin_outside_country_from_bad_country_list",

"count": 602

}

],

"top5AccountsAtRisk": [

{

"account": "John Doe",

"role": [],

"count": 1773,

"userId": "abcdefgh-i12j-34kl-m567-890123n4o567"

},

{

"account": "Jane Doe",

"count": 1708,

"userId": "8bcdefgh-i12j-34kl-m567-890123n4o226"

}

],

"risks": [

{

"id": "elastic-data-0",

"riskType": "Sign-in risk: undefined",

"displayName": "John Doe",

"firstName": "John",

"lastName": "Doe",

"location": "CA",

"severity": "low",

"date": "2024-06-11",

"userId": "abcdefgh-i12j-34kl-m567-890123n4o567"

},

{

"id": "elastic-data-1",

"riskType": "Sign-in risk: Unlikely Travel",

"displayName": "John Doe",

"firstName": "John",

"lastName": "Doe",

"location": "US",

"severity": "low",

"date": "2024-07-22",

"userId": "abcdefgh-i12j-34kl-m567-890123n4o567"

},

{

"id": "elastic-data-2",

"riskType": "Sign-in risk: Unlikely Travel",

"displayName": "Jane Doe",

"firstName": "Jane",

"lastName": "Doe",

"location": "UK",

"severity": "low",

"date": "2024-05-30",

"userId": "8bcdefgh-i12j-34kl-m567-890123n4o226"

}

]

},

"atRiskAccounts": {

"mfaStatus": {

"count": 2,

"overview": {

"protected": 91,

"notProtected": 6,

"signInBlocked": 3

},

"accounts": [

{

"id": 10,

"displayName": "John Doe",

"firstName": "John",

"lastName": "Doe",

"username": "John.Doe@company1.com",

"licenseType": [

"Microsoft 365 Business Premium",

"Intune"

],

"role": [],

"group": [],

"mfaStatus": "NOT_PROTECTED",

"mfaRegistration": "Not Registered",

"lastActive": "Never",

"isInactive": true,

"userId": "abcdefgh-i12j-34kl-m567-890123n4o567",

"lastAppActivity": ""

}

]

},

"mfaRegistration": {

"count": 1,

"overview": {

"registered": 0,

"notRegistered": 1,

"unknown": 0

},

"accounts": [

{

"id": 6,

"displayName": "Jane Doe",

"firstName": "Jane",

"lastName": "Doe",

"username": "jane.doe@company1.com",

"licenseType": [

"Microsoft 365 Business Premium",

"Intune"

],

"role": [],

"group": [],

"mfaStatus": "SIGN_IN_BLOCKED",

"mfaRegistration": "Not Registered",

"lastActive": "30d ago",

"isInactive": true,

"userId": "8bcdefgh-i12j-34kl-m567-890123n4o226",

"lastAppActivity": null

}

]

},

"inactiveAccounts": {

"count": 3,

"overview": {

"inactive": 9,

"active": 91

},

"accounts": [

{

"id": 6,

"displayName": "Jane Doe",

"firstName": "Jane",

"lastName": "Doe",

"username": "jane.doe@company1.com",

"licenseType": [

"Microsoft 365 Business Premium",

"Intune"

],

"role": [],

"group": [],

"mfaStatus": "SIGN_IN_BLOCKED",

"mfaRegistration": "Registered",

"lastActive": "30d ago",

"isInactive": true,

"userId": "8bcdefgh-i12j-34kl-m567-890123n4o226",

"lastAppActivity": null

}

]

}

}

}

Augmentt API