The CustomRecommendations API from Microsoft Defender — 2 operation(s) for customrecommendations.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/microsoft-defender:microsoft-defender-customrecommendations-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Microsoft Defender for Cloud REST API (Microsoft.Security)…
version: stable-composite
description: Composite of the latest stable Microsoft.Security resource-manager swagger files published by Microsoft in Azure/azure-rest-api-specs. Each path keeps its own api-version via x-source.
x-source-repo: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/security/resource-manager/Microsoft.Security/Security
servers:
- url: https://management.azure.com
security:
- azure_auth:
- user_impersonation
tags:
- name: CustomRecommendations
paths:
/{scope}/providers/Microsoft.Security/customRecommendations:
get:
operationId: CustomRecommendations_List
tags:
- CustomRecommendations
description: Get a list of all relevant custom recommendations over a scope
parameters:
- $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- name: scope
in: path
description: The fully qualified Azure Resource manager identifier of the resource.
required: true
x-ms-skip-url-encoding: true
schema:
type: string
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/CustomRecommendationsList'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ErrorResponse
x-ms-examples:
List custom recommendations by management group scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/ListByManagementGroupCustomRecommendations_example.json
List custom recommendations by security connector scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/ListBySecurityConnectorCustomRecommendations_example.json
List custom recommendations by subscription scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/ListBySubscriptionCustomRecommendations_example.json
x-ms-pageable:
nextLinkName: nextLink
x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/security-SecurityStandards.json
summary: Custom recommendations list
x-summary-source: derived
/{scope}/providers/Microsoft.Security/customRecommendations/{customRecommendationName}:
get:
operationId: CustomRecommendations_Get
tags:
- CustomRecommendations
description: Get a specific custom recommendation for the requested scope by customRecommendationName
parameters:
- $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- name: scope
in: path
description: The fully qualified Azure Resource manager identifier of the resource.
required: true
x-ms-skip-url-encoding: true
schema:
type: string
- name: customRecommendationName
in: path
description: Name of the Custom Recommendation.
required: true
schema:
type: string
pattern: '[{]?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$'
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/CustomRecommendation'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ErrorResponse
x-ms-examples:
Get a custom recommendation over management group scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/GetByManagementGroupCustomRecommendation_example.json
Get a custom recommendation over security connector scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/GetBySecurityConnectorCustomRecommendation_example.json
Get a custom recommendation over subscription scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/GetBySubscriptionCustomRecommendation_example.json
x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/security-SecurityStandards.json
summary: Custom recommendations get
x-summary-source: derived
put:
operationId: CustomRecommendations_CreateOrUpdate
tags:
- CustomRecommendations
description: Creates or updates a custom recommendation over a given scope
parameters:
- $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- name: scope
in: path
description: The fully qualified Azure Resource manager identifier of the resource.
required: true
x-ms-skip-url-encoding: true
schema:
type: string
- name: customRecommendationName
in: path
description: Name of the Custom Recommendation.
required: true
schema:
type: string
pattern: '[{]?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$'
responses:
'200':
description: Resource 'CustomRecommendation' update operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/CustomRecommendation'
'201':
description: Resource 'CustomRecommendation' create operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/CustomRecommendation'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ErrorResponse
x-ms-examples:
Create or update custom recommendation over management group scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/PutByManagementGroupCustomRecommendation_example.json
Create or update custom recommendation over security connector scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/PutBySecurityConnectorCustomRecommendation_example.json
Create or update custom recommendation over subscription scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/PutBySubscriptionCustomRecommendation_example.json
x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/security-SecurityStandards.json
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CustomRecommendation'
description: Custom Recommendation body
required: true
summary: Custom recommendations create or update
x-summary-source: derived
delete:
operationId: CustomRecommendations_Delete
tags:
- CustomRecommendations
description: Delete a custom recommendation over a given scope
parameters:
- $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- name: scope
in: path
description: The fully qualified Azure Resource manager identifier of the resource.
required: true
x-ms-skip-url-encoding: true
schema:
type: string
- name: customRecommendationName
in: path
description: Name of the Custom Recommendation.
required: true
schema:
type: string
pattern: '[{]?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$'
responses:
'200':
description: Resource deleted successfully.
'204':
description: Resource does not exist.
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ErrorResponse
x-ms-examples:
Delete a custom recommendation over management group scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/DeleteByManagementGroupCustomRecommendation_example.json
Delete a custom recommendation over security connector scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/DeleteBySecurityConnectorCustomRecommendation_example.json
Delete a custom recommendation over subscription scope:
$ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/examples/CustomRecommendations/DeleteBySubscriptionCustomRecommendation_example.json
x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-08-01/security-SecurityStandards.json
summary: Custom recommendations delete
x-summary-source: derived
components:
schemas:
CustomRecommendation:
type: object
description: Custom Recommendation
properties:
properties:
$ref: '#/components/schemas/CustomRecommendationProperties'
description: describes Custom Recommendation properties.
x-ms-client-flatten: true
allOf:
- $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ProxyResource
CustomRecommendationsList:
type: object
description: A list of Custom Recommendations
properties:
value:
type: array
description: Collection of Custom Recommendations
items:
$ref: '#/components/schemas/CustomRecommendation'
readOnly: true
nextLink:
type: string
description: The link used to get the next page of operations.
required:
- value
CustomRecommendationProperties:
type: object
description: describes the Custom Recommendation properties
properties:
query:
type: string
description: KQL query representing the Recommendation results required.
cloudProviders:
type: array
description: List of all standard supported clouds.
items:
$ref: '#/components/schemas/RecommendationSupportedClouds'
severity:
type: string
description: The severity to relate to the assessments generated by this Recommendation.
default: Low
enum:
- High
- Medium
- Low
x-ms-enum:
name: SeverityEnum
modelAsString: true
values:
- name: High
value: High
description: High
- name: Medium
value: Medium
description: Medium
- name: Low
value: Low
description: Low
securityIssue:
type: string
description: The severity to relate to the assessments generated by this Recommendation.
default: BestPractices
enum:
- Vulnerability
- ExcessivePermissions
- AnonymousAccess
- NetworkExposure
- TrafficEncryption
- BestPractices
x-ms-enum:
name: SecurityIssue
modelAsString: true
values:
- name: Vulnerability
value: Vulnerability
description: Vulnerability
- name: ExcessivePermissions
value: ExcessivePermissions
description: ExcessivePermissions
- name: AnonymousAccess
value: AnonymousAccess
description: AnonymousAccess
- name: NetworkExposure
value: NetworkExposure
description: NetworkExposure
- name: TrafficEncryption
value: TrafficEncryption
description: TrafficEncryption
- name: BestPractices
value: BestPractices
description: BestPractices
displayName:
type: string
description: The display name of the assessments generated by this Recommendation.
description:
type: string
description: The description to relate to the assessments generated by this Recommendation.
remediationDescription:
type: string
description: The remediation description to relate to the assessments generated by this Recommendation.
assessmentKey:
type: string
description: The assessment metadata key used when an assessment is generated for this Recommendation.
readOnly: true
RecommendationSupportedClouds:
type: string
description: The cloud that the recommendation is supported on.
enum:
- Azure
- AWS
- GCP
x-ms-enum:
name: RecommendationSupportedClouds
modelAsString: true
values:
- name: Azure
value: Azure
description: Azure
- name: AWS
value: AWS
description: AWS
- name: GCP
value: GCP
description: GCP
securitySchemes:
azure_auth:
type: oauth2
flows:
implicit:
scopes:
user_impersonation: impersonate your user account
authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
description: Azure Active Directory OAuth2 Flow.