Modify the configuration of a Defender payload item within a profile

Modify Windows Defender policy payload

Endpoints

put /api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}

Copy full URL

Request URL

https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}

Scope

MDMDeviceMgmt.UPDATECopied!

Header

Authorization: d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory

application/jsonCopied!

AcceptstringMandatory

application/jsonCopied!

- Path Parameters

profile_idstringMandatory

Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response

payload_idstringMandatory

Unique identifier of the payload item. Obtain from the Get Payload Item IDs response

- Request Body

application/json

JSON Object

Hide Sub-Attributes

allow_archive_scanningbooleanOptional

Allow Archive Scanning. Default: true

allow_behavior_monitoringbooleanOptional

Allow Behavior Monitoring. Default: true

allow_cloud_protectionbooleanOptional

Allow Cloud Protection. Default: true

allow_email_scanningbooleanOptional

Allow Email Scanning. Default: false

allow_full_scan_on_mapped_networkdrivesbooleanOptional

Allow Full Scan On Mapped Networkdrives. Default: false

allow_full_scan_removable_drive_scanningbooleanOptional

Allow Full Scan Removable Drive Scanning. Default: true

allow_intrusion_prevention_systembooleanOptional

Allow Intrusion Prevention System. Default: true

allow_ioav_protectionbooleanOptional

Allow Ioav Protection. Default: true

cloud_block_levelintegerOptional

Cloud Block Level. Default: 0

allow_onaccess_protectionbooleanOptional

Allow Onaccess Protection. Default: true

allow_realtime_monitoringbooleanOptional

Allow Realtime Monitoring. Default: true

allow_scanning_network_filesbooleanOptional

Allow Scanning Network Files. Default: false

allow_script_scanningbooleanOptional

Allow Script Scanning. Default: true

allow_user_ui_accessbooleanOptional

Allow User Ui Access. Default: true

check_for_signatures_before_runningscanbooleanOptional

Check For Signatures Before Runningscan. Default: false

pua_protectionintegerOptional

Pua Protection. Default: 0

realtime_scan_directionintegerOptional

Realtime Scan Direction. Default: 0

scan_parameterintegerOptional

Scan Parameter. Default: 1

allow_switch_to_async_inspectionbooleanOptional

Allow Switch To Async Inspection. Default: false

disable_cpu_throttle_on_idle_scansbooleanOptional

Disable Cpu Throttle On Idle Scans. Default: true

disable_network_protection_perf_telemetrybooleanOptional

Disable Network Protection Perf Telemetry. Default: false

enable_filehash_computationbooleanOptional

Enable Filehash Computation. Default: false

hide_exclusions_from_local_adminsbooleanOptional

Hide Exclusions From Local Admins. Default: false

hide_exclusions_from_local_usersbooleanOptional

Hide Exclusions From Local Users. Default: false

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request PUT \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id} \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"allow_behavior_monitoring":true,"disable_cpu_throttle_on_idle_scans":true,"allow_switch_to_async_inspection":false,"hide_exclusions_from_local_admins":false,"allow_full_scan_removable_drive_scanning":true,"allow_scanning_network_files":false,"scan_parameter":"2","allow_realtime_monitoring":true,"disable_network_protection_perf_telemetry":false,"allow_email_scanning":false,"hide_exclusions_from_local_users":false,"allow_onaccess_protection":true,"allow_archive_scanning":true,"allow_ioav_protection":true,"allow_full_scan_on_mapped_networkdrives":false,"allow_user_ui_access":true,"allow_cloud_protection":true,"pua_protection":"1","enable_filehash_computation":false,"allow_intrusion_prevention_system":true,"allow_script_scanning":true,"realtime_scan_direction":"1","cloud_block_level":"2","check_for_signatures_before_runningscan":false}'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}"))
        .header("Content-Type", "application/json")
        .header("Accept", "application/json")
        .header("Authorization", " d92d4xxxxxxxxxxxxx15f52")
        .method("PUT", HttpRequest.BodyPublishers.ofString("{\"allow_behavior_monitoring\":true,\"disable_cpu_throttle_on_idle_scans\":true,\"allow_switch_to_async_inspection\":false,\"hide_exclusions_from_local_admins\":false,\"allow_full_scan_removable_drive_scanning\":true,\"allow_scanning_network_files\":false,\"scan_parameter\":\"2\",\"allow_realtime_monitoring\":true,\"disable_network_protection_perf_telemetry\":false,\"allow_email_scanning\":false,\"hide_exclusions_from_local_users\":false,\"allow_onaccess_protection\":true,\"allow_archive_scanning\":true,\"allow_ioav_protection\":true,\"allow_full_scan_on_mapped_networkdrives\":false,\"allow_user_ui_access\":true,\"allow_cloud_protection\":true,\"pua_protection\":\"1\",\"enable_filehash_computation\":false,\"allow_intrusion_prevention_system\":true,\"allow_script_scanning\":true,\"realtime_scan_direction\":\"1\",\"cloud_block_level\":\"2\",\"check_for_signatures_before_runningscan\":false}"))
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"allow_behavior_monitoring\":true,\"disable_cpu_throttle_on_idle_scans\":true,\"allow_switch_to_async_inspection\":false,\"hide_exclusions_from_local_admins\":false,\"allow_full_scan_removable_drive_scanning\":true,\"allow_scanning_network_files\":false,\"scan_parameter\":\"2\",\"allow_realtime_monitoring\":true,\"disable_network_protection_perf_telemetry\":false,\"allow_email_scanning\":false,\"hide_exclusions_from_local_users\":false,\"allow_onaccess_protection\":true,\"allow_archive_scanning\":true,\"allow_ioav_protection\":true,\"allow_full_scan_on_mapped_networkdrives\":false,\"allow_user_ui_access\":true,\"allow_cloud_protection\":true,\"pua_protection\":\"1\",\"enable_filehash_computation\":false,\"allow_intrusion_prevention_system\":true,\"allow_script_scanning\":true,\"realtime_scan_direction\":\"1\",\"cloud_block_level\":\"2\",\"check_for_signatures_before_runningscan\":false}"

headers = {
    'Content-Type': "application/json",
    'Accept': "application/json",
    'Authorization': " d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("PUT", "/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Content-Type", "application/json");
    headersMap.put("Accept", "application/json");

    data=Map();
    data.put("allow_archive_scanning",true);
    data.put("allow_behavior_monitoring",true);
    data.put("allow_cloud_protection",true);
    data.put("allow_email_scanning",true);
    data.put("allow_full_scan_on_mapped_networkdrives",true);
    data.put("allow_full_scan_removable_drive_scanning",true);
    data.put("allow_intrusion_prevention_system",true);
    data.put("allow_ioav_protection",true);
    data.put("cloud_block_level","1");
    data.put("allow_onaccess_protection",true);
    data.put("allow_realtime_monitoring",true);
    data.put("allow_scanning_network_files",true);
    data.put("allow_script_scanning",true);
    data.put("allow_user_ui_access",true);
    data.put("check_for_signatures_before_runningscan",true);
    data.put("pua_protection","1");
    data.put("realtime_scan_direction","1");
    data.put("scan_parameter","1");
    data.put("allow_switch_to_async_inspection",true);
    data.put("disable_cpu_throttle_on_idle_scans",true);
    data.put("disable_network_protection_perf_telemetry",true);
    data.put("enable_filehash_computation",true);
    data.put("hide_exclusions_from_local_admins",true);
    data.put("hide_exclusions_from_local_users",true);

    response = invokeUrl
    [
        url: "https://appDomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}"
        type: PUT
        headers: headersMap
        body: data
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Content-Type", "application/json")
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", " d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/windowsdefenderpolicy/payloaditems/{payload_id}' -Method PUT -Headers $headers -ContentType 'application/json' -Body '{"allow_behavior_monitoring":true,"disable_cpu_throttle_on_idle_scans":true,"allow_switch_to_async_inspection":false,"hide_exclusions_from_local_admins":false,"allow_full_scan_removable_drive_scanning":true,"allow_scanning_network_files":false,"scan_parameter":"2","allow_realtime_monitoring":true,"disable_network_protection_perf_telemetry":false,"allow_email_scanning":false,"hide_exclusions_from_local_users":false,"allow_onaccess_protection":true,"allow_archive_scanning":true,"allow_ioav_protection":true,"allow_full_scan_on_mapped_networkdrives":false,"allow_user_ui_access":true,"allow_cloud_protection":true,"pua_protection":"1","enable_filehash_computation":false,"allow_intrusion_prevention_system":true,"allow_script_scanning":true,"realtime_scan_direction":"1","cloud_block_level":"2","check_for_signatures_before_runningscan":false}'

Sample Request Body

Modify Defender payload item

Copied!

  {
    "allow_behavior_monitoring": true,
    "disable_cpu_throttle_on_idle_scans": true,
    "allow_switch_to_async_inspection": false,
    "hide_exclusions_from_local_admins": false,
    "allow_full_scan_removable_drive_scanning": true,
    "allow_scanning_network_files": false,
    "scan_parameter": "2",
    "allow_realtime_monitoring": true,
    "disable_network_protection_perf_telemetry": false,
    "allow_email_scanning": false,
    "hide_exclusions_from_local_users": false,
    "allow_onaccess_protection": true,
    "allow_archive_scanning": true,
    "allow_ioav_protection": true,
    "allow_full_scan_on_mapped_networkdrives": false,
    "allow_user_ui_access": true,
    "allow_cloud_protection": true,
    "pua_protection": "1",
    "enable_filehash_computation": false,
    "allow_intrusion_prevention_system": true,
    "allow_script_scanning": true,
    "realtime_scan_direction": "1",
    "cloud_block_level": "2",
    "check_for_signatures_before_runningscan": false
  }

▼ Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

payload_idlong

Unique identifier of the payload item

allow_archive_scanningboolean

Allow Archive Scanning. Default: true

allow_behavior_monitoringboolean

Allow Behavior Monitoring. Default: true

allow_cloud_protectionboolean

Allow Cloud Protection. Default: true

allow_email_scanningboolean

Allow Email Scanning. Default: false

allow_full_scan_on_mapped_networkdrivesboolean

Allow Full Scan On Mapped Networkdrives. Default: false

allow_full_scan_removable_drive_scanningboolean

Allow Full Scan Removable Drive Scanning. Default: true

allow_intrusion_prevention_systemboolean

Allow Intrusion Prevention System. Default: true

allow_ioav_protectionboolean

Allow Ioav Protection. Default: true

cloud_block_levelinteger

Cloud Block Level. Default: 0

allow_onaccess_protectionboolean

Allow Onaccess Protection. Default: true

allow_realtime_monitoringboolean

Allow Realtime Monitoring. Default: true

allow_scanning_network_filesboolean

Allow Scanning Network Files. Default: false

allow_script_scanningboolean

Allow Script Scanning. Default: true

allow_user_ui_accessboolean

Allow User Ui Access. Default: true

check_for_signatures_before_runningscanboolean

Check For Signatures Before Runningscan. Default: false

pua_protectioninteger

Pua Protection. Default: 0

realtime_scan_directioninteger

Realtime Scan Direction. Default: 0

scan_parameterinteger

Scan Parameter. Default: 1

allow_switch_to_async_inspectionboolean

Allow Switch To Async Inspection. Default: false

disable_cpu_throttle_on_idle_scansboolean

Disable Cpu Throttle On Idle Scans. Default: true

disable_network_protection_perf_telemetryboolean

Disable Network Protection Perf Telemetry. Default: false

enable_filehash_computationboolean

Enable Filehash Computation. Default: false

hide_exclusions_from_local_adminsboolean

Hide Exclusions From Local Admins. Default: false

hide_exclusions_from_local_usersboolean

Hide Exclusions From Local Users. Default: false

Possible Response Codes

200HTTP code

Sample Response: HTTP 200

Defender payload item successfully modified

Copied!

  {
    "allow_behavior_monitoring": true,
    "disable_cpu_throttle_on_idle_scans": true,
    "allow_switch_to_async_inspection": false,
    "hide_exclusions_from_local_admins": false,
    "allow_scanning_network_files": false,
    "scan_parameter": "2",
    "allow_realtime_monitoring": true,
    "disable_network_protection_perf_telemetry": false,
    "allow_email_scanning": false,
    "hide_exclusions_from_local_users": false,
    "allow_onaccess_protection": true,
    "allow_archive_scanning": true,
    "allow_ioav_protection": true,
    "allow_full_scan_on_mapped_networkdrives": false,
    "allow_cloud_protection": true,
    "pua_protection": "1",
    "allow_script_scanning": true,
    "cloud_block_level": "2",
    "check_for_signatures_before_runningscan": false,
    "payload_id": "9007199254741295",
    "allow_full_scan_removable_drive_scanning": true,
    "allow_user_ui_access": true,
    "enable_filehash_computation": false,
    "allow_intrusion_prevention_system": true,
    "realtime_scan_direction": "1"
  }

▼ Show full

Duration: 1 minute | Threshold: 60 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.