walzer
walzer

Reputation: 11

Cannot run a AntiVirusScan via API

I'm trying to run a scan via API using this endpoint: https://api.security.microsoft.com/api/machines/{id}/runAntiVirusScan.

The request is successful, and the status is Pending

But for some reason, when I get the status of my scan on the following endpoint: https://api.securitycenter.microsoft.com/api/machineactions/{machine_action}, the status goes to Failed with errorHRresult "-2147020579". This HResult code refers to 0x8007007B - ERROR_INVALID_NAME (correct me if I'm wrong).

As I'm able to isolate my target device, I assume that my machine_id and token are well set and I can communicate with my remote laptop.

My permissions are well set:

API/Permissions name Type Description
Machine.Isolate Application Isolate machine
Machine.ReadWrite.All Application Read and write all machine information
Machine.Scan Application Scan machine
Machine.StopAndQuarantine Application Stop and quarantine file

I do not understand what's going on. Did someone already encounter this issue?

Here are my two functions:

def run_antivirus_scan(id, aadToken):
    url = f"https://api.security.microsoft.com/api/machines/{id}/runAntiVirusScan"
    json_data = {
        'Comment': 'Test',
        'ScanType': 'Quick'
    }
    headers = {
        'Authorization': 'Bearer ' + aadToken,
        'Content-Type': 'application/json'
    }
   
    try:
        response = requests.post(url=url, headers=headers, json=json_data)
        response.raise_for_status()
        result = response.json()
        print(result)
        return result.get("id")
    except requests.exceptions.HTTPError as http_err:
        print(f"HTTP error occurred: {http_err}")
    except requests.exceptions.RequestException as req_err:
        print(f"Request error occurred: {req_err}")
    except ValueError as json_err:
        print(f"JSON decode error: {json_err}")
    except KeyError as key_err:
        print(f"Key error: {key_err}")
def check_scan_result(machine_action, aadToken):
    url = f"https://api.securitycenter.microsoft.com/api/machineactions/{machine_action}"
    headers = {
        'Authorization': 'Bearer ' + aadToken,
        'Content-Type': 'application/json'
    }
    
    try:
        response = requests.get(url=url, headers=headers)
        response.raise_for_status() 
        result = response.json()
        print(result)
        return result
    except requests.exceptions.HTTPError as http_err:
        print(f"HTTP error occurred: {http_err}")
    except requests.exceptions.RequestException as req_err:
        print(f"Request error occurred: {req_err}")
    except ValueError as json_err:
        print(f"JSON decode error: {json_err}")
    except KeyError as key_err:
        print(f"Key error: {key_err}")

Upvotes: 0

Views: 41

Answers (0)

Related Questions