Reference: Security & Microsoft Defender

StratoLens's own security findings plus Microsoft Defender for Cloud data (plans, assessments, alerts, vulnerabilities) and how they changed between scans. This is the data behind the Defender integration pages. Defender routes need View Defender Assessments; the three security-findings routes need View Resources.

StratoLens Security Findings

`GET /api/security-recommendations`

Permission: View Resources

Current StratoLens security findings (configuration checks such as RDP open to the internet). Independent of scans. No parameters.

Response: { recommendations[], metadata, totalCount, availableFilters: { categories[], severities[], checkIds[] }, lastUpdatedScanId, lastUpdatedTimestamp }. metadata is { totalFindings, bySeverity: { Critical, High, Medium, Low }, byCategory, privateEndpointBypassCount, lastUpdatedScanId, lastUpdatedTimestamp }; counts are over your scope and null before the first scan. Each finding:

security-recommendations finding fields
Field	Meaning
`resourceId` (lower-case), `originalResourceId`, `resourceName`, `resourceType`, `subscriptionId`, `subscriptionName`, `resourceGroupName`	Resource
`checkId`	E.g. `nsg_rdp_internet`
`checkTitle`, `recommendation`	Title and what to do
`category`	`PublicExposure`, `InsecureConfiguration`, `Hardening`, `Identity`, `Governance`
`severity`	`Critical`, `High`, `Medium`, `Low`
`currentValue`, `expectedValue`	Setting as found / as expected
`instanceKey`, `instanceLabel?`	E.g. the NSG rule, for per-rule checks
`evidence?`	`nsgRule { ruleName, priority, direction, access, protocol, sources[], ports[], matchedPorts? }`; `privateEndpointBypass { count, endpointNames[] }` (severity raised one level); `firewallRules { present, ipRuleCount, virtualNetworkRuleCount, defaultAction? }` (PublicExposure downgraded to Low when present); `details`
`firstDetectedScanId`, `firstDetectedTimestamp`, `lastUpdatedScanId`, `lastUpdatedTimestamp`	When first detected / last changed

Notes

Hidden findings are included, with no hidden marker.
"New" in the UI means first detected within 7 days.
Unordered.

Example

GET /api/security-recommendations

`GET /api/resolved-security-findings`

Permission: View Resources

Findings that have gone away. No parameters. Kept about 2 years; removed if the finding comes back.

Response: { resolvedFindings[], totalCount, bySeverity, byCategory }. Each item has the finding fields above (without lastUpdated*) plus:

resolved-security-findings extra fields
Field	Meaning
`resolutionType`	`configuration_remediated` or `resource_deleted`
`resolvedAt`, `resolvedByScanId`	When and in which scan it resolved

Example

GET /api/resolved-security-findings

`GET /api/security-recommendations/attribution`

Permission: View Resources

Who most likely caused one finding. Costs a query per call, so don't loop it over every finding.

Parameters

security-recommendations/attribution parameters
Name	Required	Notes
`resourceId`	yes	Any case
`checkId`	yes

Errors

400Both resourceId and checkId query parameters are required

Response: { actor, actorKind, timestamp, changeId, basis }.

security-recommendations/attribution response fields
Field	Meaning
`basis`	`change`: a recorded change touched the setting. `creation`: no such change, so this is who created the resource. `none`: nothing found; every other field is null
`actor`	Display name (may be null)
`actorKind`	`user`, `automation`, `system`, or null
`timestamp`, `changeId`	The matched change

Notes

An unknown check or an out-of-scope resource returns basis: "none", not an error.

Example

GET /api/security-recommendations/attribution?resourceId=%2Fsubscriptions%2F…&checkId=nsg_rdp_internet

Defender Plans and Assessments

`GET /api/defender-plans`

Permission: View Defender Assessments

Defender plan inventory per subscription in a scan. This route does not accept latest.

Parameters

defender-plans parameters
Name	Required
`scanId`	yes

Errors

400scanId parameter is required
500Failed to retrieve Defender plan inventory(also for an unknown scan)

Response: { scanId, scanTimestamp, planNames[], subscriptions[] }. Each subscription is { subscriptionId, subscriptionName, enabledBillableCount, plans[] }, sorted by name. Each plan:

defender-plans plan fields
Field	Meaning
`planKey`	Stable `<sub>/<plan>`
`planName`	E.g. VirtualMachines, StorageAccounts, CloudPosture
`pricingTier`	`Free` or `Standard`
`isEnabled`, `subPlan?`	Sub-plan e.g. P1/P2
`enablementTime?`, `freeTrialRemainingTime?`	The latter is an ISO 8601 duration
`enforce?`, `resourcesCoverageStatus?`	`FullyCovered` \| `PartiallyCovered` \| `NotCovered`
`deprecated?`, `replacedBy?[]`	Deprecation
`extensions[]`	`{ name, isEnabled, additionalExtensionProperties? }`
`originalResourceId`	Azure-cased ID

Example

GET /api/defender-plans?scanId=…

`GET /api/defender-plan-costs`

Permission: View Defender Assessments

Defender spend per subscription and plan: this month to date and last month. No parameters. A heavier call: it reads two months of cost data. Only subscriptions with Defender costs appear.

Response: { window: { currentMonth: "YYYY-MM", previousMonth }, subscriptions[] }. Each subscription is { subscriptionId, currentMonthCost, previousMonthCost, currency, mixedCurrency, plans[] }. Each plan:

defender-plan-costs plan fields
Field	Meaning
`planName`	Or `other`
`currentMonthCost`, `previousMonthCost`	Amounts
`bySubPlan?`	Servers P1/P2
`trialMeterSeen`	A $0 cost with a trial meter means trial, not free

Errors

500Failed to retrieve Defender plan costs

Example

GET /api/defender-plan-costs

`GET /api/defender-hierarchy-summary`

Permission: View Defender Assessmentsaccepts scanId=latest

Defender assessment counts per resource.

Parameters

defender-hierarchy-summary parameters
Name	Required
`scanId`	yes

Errors

400scanId parameter is required
500Failed to retrieve defender hierarchy summaries

Response: { compactSummaries[], availableFilters: { severities, statuses, assessmentTypes, resourceTypes, categories }, totalCount }. Severity is Low, Medium, High, Critical; status is Healthy, Unhealthy, NotApplicable. Each summary:

defender-hierarchy-summary summary fields
Field	Meaning
`entityId`, `displayName`, `entityType`	`entityId` is `subscriptionId\|resourceGroupName\|resourceName\|resourceType` (one summary per resource and type); `displayName` is the resource name
`subscriptionId`, `subscriptionName`, `resourceGroupName?`, `resourceType`	Location
`totalCount`	Assessments
`severityCounts`, `statusCounts`	Dictionaries
`hiddenCounts`	`{ "true", "false" }`
`categoryCounts`	E.g. `SoftwareUpdate`; missing = `Unknown`
`combinedCounts`	Key `severity\|status\|hidden\|category`

Example

GET /api/defender-hierarchy-summary?scanId=latest

`GET /api/defender-resource-details`

Permission: View Defender Assessmentsaccepts scanId=latest

All Defender assessments for one subscription or resource. An out-of-scope subscription returns an empty result.

Parameters

defender-resource-details parameters
Name	Required	Notes
`scanId`, `subscriptionId`	yes
`entityType`	no	`subscription` or `resource`; default `resource`
`resourceGroupName`, `resourceName`	for `resource`

Errors

400entityType must be one of subscription, resource
400subscriptionId and scanId parameters are required
400resourceName and resourceGroupName parameters are required for resource queries
500Failed to retrieve defender resource details

Response: { assessments[], totalCount, cveDetails? }, newest first. cveDetails maps CVE ID to a catalog entry of the shape shown under vulnerability routes. Each assessment:

Defender assessment fields
Field	Meaning
`assessmentId`	Stable identity
`displayName`, `description`, `remediationDescription?`	Text
`status`, `severity`, `riskLevel?`	State
`recommendationCategory?`, `assessmentType?`	Classification
`resourceId`, `originalResourceId`, `resourceName`, `resourceGroupName`, `resourceType`, `subscriptionId`, `subscriptionName`, `entityType`	Resource
`portalLink?`	Azure portal link
`softwareVendor?`, `softwareName?`, `packageType?` (`OS` \| `DevPackage`), `detectedSoftwareVersions?`, `fixedVersion?`, `fixAvailable?`, `maxCvssScore?`	Vulnerability rows
`cveIds?`	Up to 100, ranked
`totalCveCount?`	The true count; use this, not `cveIds.length`
`targetType?`, `imageRegistryHost?`, `imageRepository?`, `imageDigest?`, `imageTags?`	Container images
`firstEvaluationDate?`, `statusChangeDate?`, `firstScanTimestamp`, `lastScanTimestamp`	Times
`isHidden?`, `notes?`	User annotations, with the audit fields `lastNotesUpdatedBy?`, `lastNotesUpdatedAt?`, `lastHiddenUpdatedBy?`, `lastHiddenUpdatedAt?`
Also present	`assessmentName`, `timestamp`, `initiatedBy`, `riskFactors?`, `isContextualRisk?`, `resourceProvider?`, `source?`, `policyDefinitionId?`, `implementationEffort?`, `userImpact?`, `threats?`, `tactics?`, `techniques?`, `securityCategories?`, `cloudProviders?`, `preview?`, `statusCause?`, `statusDescription?`, `language?`, `imagePushedAt?`. The `riskFactors`, `threats`, `tactics`, `techniques`, `securityCategories` and `cloudProviders` fields are string arrays

Example

GET /api/defender-resource-details?scanId=latest&subscriptionId=<guid>&resourceGroupName=rg-web&resourceName=vm-web-01

Defender Alerts

`GET /api/defender-alerts-hierarchy-summary`

Permission: View Defender Assessmentsaccepts scanId=latest

Security alert counts per entity. Includes resolved and dismissed alerts.

Parameters

defender-alerts-hierarchy-summary parameters
Name	Required
`scanId`	yes

Errors

400scanId parameter is required
500Failed to retrieve defender alert hierarchy summaries

Response: { compactSummaries[], availableFilters: { severities, statuses, intents }, totalCount }. Each summary:

defender-alerts-hierarchy-summary summary fields
Field	Meaning
`entityId`, `displayName`, `entityType`	`entityId` is `subscriptionId\|resourceGroup\|resourceName\|resourceType`
`subscriptionId`, `subscriptionName`, `resourceGroupName?`, `resourceType`	Location
`totalCount`	Alerts
`severityCounts`	`High`, `Medium`, `Low`, `Informational`
`statusCounts`	`Active`, `InProgress`, `Resolved`, `Dismissed`
`hiddenCounts`	Hidden vs. visible
`intentCounts`	MITRE intents; a multi-intent alert counts once per intent
`combinedCounts`	Key `severity\|status\|hidden\|intent`. The intent part can itself be a comma list, so split it on `,`

Example

GET /api/defender-alerts-hierarchy-summary?scanId=latest

`GET /api/defender-alerts-resource-details`

Permission: View Defender Assessmentsaccepts scanId=latest

Alerts for one entity, at that exact level only. A resource-group query does not include its resources' alerts. An out-of-scope subscription returns an empty 200 ({ alerts: [], totalCount: 0 }).

Parameters

defender-alerts-resource-details parameters
Name	Required	Notes
`scanId`, `subscriptionId`	yes
`entityType`	no	`subscription`, `resourceGroup`, `resource`; default `resource`
`resourceGroupName`, `resourceName`	per `entityType`

Errors

400entityType must be one of subscription, resourceGroup, resource
400subscriptionId and scanId parameters are required
400resourceName and resourceGroupName parameters are required for resource queries
400resourceGroupName parameter is required for resource group queries
500Failed to retrieve defender alert resource details

Response: { alerts[], totalCount }, newest first. Each alert:

Defender alert fields
Field	Meaning
`systemAlertId`	Alert instance ID
`alertType`	E.g. `VM_EICAR`
`alertDisplayName`, `description`	Text
`severity`, `status`	As in the summary
`compromisedEntity`	Most-affected resource
`intent`, `techniques[]`, `subTechniques[]`	MITRE
`startTimeUtc`, `endTimeUtc`, `timeGeneratedUtc`	Times
`remediationSteps[]`	Steps
`alertUri`	Azure portal link
`isIncident`, `correlationKey`	Grouping
`entities[]`, `resourceIdentifiers[]`	Raw Azure arrays
`vendorName`, `productName`, `productComponentName?`	Product info
Resource identity fields	As on assessments
`isHidden?`, `notes?`	User annotations

Example

GET /api/defender-alerts-resource-details?scanId=latest&entityType=resourceGroup&subscriptionId=<guid>&resourceGroupName=rg-web

Vulnerabilities

Shared terms for the vulnerability routes

cveId: CVE-YYYY-NNNN (4+ digits, any case).
softwareKey: identifies a vulnerable package. Copy it from software[].softwareKey in defender-vulnerability-summary or getDefenderVulnerabilityDiff, then URL-encode it (| becomes %7C). Do not build it yourself.
resourceKey: identifies an assessed resource; container-image findings roll up under their registry. Copy it from resources[].resourceKey and URL-encode it.
resourceTypes: CSV of exact ARM types, e.g. microsoft.compute/virtualmachines. Valid values are in availableResourceTypes.
showHidden: on defender-vulnerability-summary, defender-vulnerability-resources and defender-vulnerability-findings only the string true includes hidden items (default excludes). The two vulnerability diff routes have no showHidden and always include hidden findings.
CVE catalog entries have the shape { cveId, severity, cvssScore?, cvssVersion?, epssScore?, epssPercentile?, isInExploitKit, isPubliclyDisclosed, exploitVerified, publishedDate?, lastModifiedDate? }.

Errors

400Provide only one of cveId or softwareKey
400cveId must be a CVE identifier (CVE-YYYY-NNNN)
400softwareKey is malformed
400Exactly one of cveId or softwareKey is required

These four are the selector errors referenced by the routes below.

`GET /api/defender-vulnerability-summary`

Permission: View Defender Assessments

Every CVE and vulnerable software package in a scan, with counts. Sorted by resourceCount, highest first.

Parameters

defender-vulnerability-summary parameters
Name	Required
`scanId`	yes
`showHidden`	no
`resourceTypes`	no

Errors

400scanId parameter is required
500Failed to retrieve vulnerability summary

Response: { scanId, scanTimestamp, cves[], software[], totals, catalogState, availableResourceTypes[], planCoverage? }.

defender-vulnerability-summary response fields
Field	Meaning
`cves[]`	`{ cveId, findingCount, resourceCount, subscriptionCount, fixAvailableCount, catalog? }`
`software[]`	`{ softwareKey, softwareVendor?, softwareName, packageType?, findingCount, resourceCount, subscriptionCount, fixAvailableCount, cveCount, exploitedCveCount, maxCvssScore?, maxSeverity }`
`totals`	`{ findingCount, resourceCount, cveCount, softwareCount }`
`catalogState`	`synced` or `never-synced`. When `never-synced`, CVE rows have no `catalog`
`planCoverage?`	Present only when there are no findings and no filter: `{ inventoryPresent, coveredSubscriptionCount, subscriptionCount }` tells you whether any vulnerability-assessment plan is on

Notes

Container images are counted per image in resourceCount.
fixAvailableCount means the package has a fix, not necessarily for that CVE.

Example

GET /api/defender-vulnerability-summary?scanId=…&resourceTypes=microsoft.compute/virtualmachines

`GET /api/defender-vulnerability-resources`

Permission: View Defender Assessments

Which resources one CVE or package affects, most severe first.

Parameters

defender-vulnerability-resources parameters
Name	Required
`scanId`	yes
`cveId` or `softwareKey`	yes (exactly one)
`showHidden`	no
`resourceTypes`	no

Errors

400scanId and selector errors
500Failed to retrieve affected resources

Response: { resources[], findingCount }. Each resource: { resourceKey, resourceName, resourceType, subscriptionId, subscriptionName?, resourceGroupName?, findingCount, imageCount, maxSeverity }.

Example

GET /api/defender-vulnerability-resources?scanId=…&cveId=CVE-2024-6387

`GET /api/defender-vulnerability-findings`

Permission: View Defender Assessments

One page of a CVE's or package's findings on one resource.

Parameters

defender-vulnerability-findings parameters
Name	Required	Notes
`scanId`	yes
`cveId` or `softwareKey`	yes (exactly one)
`resourceKey`	yes
`showHidden`, `resourceTypes`	no
`page`	no	≥ 1, default 1
`pageSize`	no	1-100, default 20

Errors

400scanId parameter is required
400Selector errors (the four listed under the shared terms above); checked before resourceKey, page and pageSize
400resourceKey parameter is required
400page must be a positive integer
400pageSize must be between 1 and 100
500Failed to retrieve vulnerability findings

Response: { assessments[], totalCount, totalPages, currentPage, cveDetails }. Assessments are full objects, as in defender-resource-details.

Example

GET /api/defender-vulnerability-findings?scanId=…&softwareKey=red_hat%7Cpython3-libs_for_linux%7COS&resourceKey=%2Fsubscriptions%2F…&page=1&pageSize=50

`GET /api/defender-cve-detail`

Permission: View Defender Assessments

The full catalog entry for one CVE. The catalog is shared across the installation and is not scope-filtered. Only CVEs seen in a scan are present.

Parameters

defender-cve-detail parameters
Name	Required	Notes
`cveId`	yes	Any case

Errors

400cveId parameter is required and must be a CVE identifier (CVE-YYYY-NNNN)
404CVE not in catalog
500Failed to retrieve CVE detail

Response

defender-cve-detail response fields
Field	Meaning
`cveId`, `severity`	Identity and severity
`cvssScore?`, `cvssVersion?`, `cvssVectorString?`	CVSS
`epssScore?`, `epssPercentile?`	EPSS
`isInExploitKit`, `isPubliclyDisclosed`, `exploitVerified`	Exploit flags
`exploitTypes?`, `exploitUris?`	Up to 5 URIs
`summary?`, `impact?`, `remediation?`	Text
`weaknesses?`	CWE IDs
`references?`	Up to 10 of `{ source, title, url }`
`publishedDate?`, `lastModifiedDate?`, `lastSyncedAt`	Dates

Example

GET /api/defender-cve-detail?cveId=CVE-2024-6387

Scan-to-Scan Diffs

All of these take a scan pair. The summary routes return counts only; the details routes return the items.

`GET /api/getDefenderAssessmentDiff`

Permission: View Defender Assessments

Assessment change counts between two scans, by hierarchy. Any content change counts as modified, including a status change such as Unhealthy to Healthy.

Parameters

getDefenderAssessmentDiff parameters
Name	Required
`baseScanId`, `compareScanId`	yes

Errors

400Scan-pair errors
500An error occurred while processing the defender assessment comparison.

Response: { summary, assessments, hierarchySummary[], availableFilters: { categories[] } }.

getDefenderAssessmentDiff response fields
Field	Meaning
`summary`	`{ baseScanId, compareScanId, baseScanTime?, compareScanTime?, added, deleted, modified }`
`assessments`	Always empty; use the details route for the items
`hierarchySummary[]`	`{ subscriptionId, subscriptionName, resourceGroupName?, resourceName?, entityType, addedCount, modifiedCount, deletedCount, totalChanges }`. Don't sum across levels

Example

GET /api/getDefenderAssessmentDiff?baseScanId=<older>&compareScanId=<newer>

`GET /api/getDefenderAssessmentDiffDetails`

Permission: View Defender Assessments

Paged changed assessments for one entity. Order: added, then modified, then deleted. An out-of-scope subscription returns an empty 200 page. That scope check runs before the scan pair is resolved, so an out-of-scope subscription with an unknown or reversed pair also gets the empty 200, not a 404 or 400.

Parameters

getDefenderAssessmentDiffDetails parameters
Name	Required	Notes
`baseScanId`, `compareScanId`	yes
`subscriptionId`	yes	Exact; copy from `hierarchySummary`
`resourceGroupName`, `resourceName`	no	A resource group includes all its assessments
`resourceKey`	no	Exact resource, including registry image findings
`cveId` / `softwareKey`	no, at most one	Compares only vulnerable findings with that CVE or package. A finding that became healthy shows as deleted
`changeType`	no	CSV of `added`, `modified`, `deleted`
`severity`	no	CSV
`categories`	no	CSV; `Unknown` matches no category
`showHidden`	no	Here only `false` drops hidden items; anything else keeps them
`page`	no	Default 1
`pageSize`	no	1-100, default 25

Errors

400<name> must list at most 200 values
400Missing-pair message, selector errors, scan-pair 404/400
400Please provide 'subscriptionId' query parameter.
400Invalid 'changeType' parameter. Must be 'added', 'modified', or 'deleted'.
400page and pageSize errors as in defender-vulnerability-findings
500An error occurred while processing the defender assessment diff details.

Response: { assessments[], totalCount, totalPages, currentPage }. Each assessment is a full object plus changeStatus and changes[] of { property, before, after }. For added and deleted items this holds one entry with the whole object.

Example

GET /api/getDefenderAssessmentDiffDetails?baseScanId=…&compareScanId=…&subscriptionId=<guid>&changeType=added,modified&severity=Critical,High&showHidden=false&pageSize=50

`GET /api/getDefenderAlertDiff`

Permission: View Defender Assessments

Alert change counts between two scans. A status change (e.g. Active to Resolved) is modified.

Parameters

getDefenderAlertDiff parameters
Name	Required
`baseScanId`, `compareScanId`	yes

Errors

400Scan-pair errors
500An error occurred while processing the defender alert comparison.

Response: { summary, alerts: [] (always empty), hierarchySummary[] }, with the same shapes as the assessment diff.

Example

GET /api/getDefenderAlertDiff?baseScanId=…&compareScanId=…

`GET /api/getDefenderAlertDiffDetails`

Permission: View Defender Assessments

Paged changed alerts for one entity, newest first. An out-of-scope subscription returns an empty 200 ({ alerts: [], totalCount: 0, totalPages: 1, currentPage: 1 }), even when the scan pair is unknown or reversed, because the scope check runs first.

Parameters

getDefenderAlertDiffDetails parameters
Name	Required	Notes
`baseScanId`, `compareScanId`, `subscriptionId`	yes
`resourceGroupName`, `resourceName`	no
`entityType`	no	`subscription`, `resourceGroup`, `resource`
`changeType`	no	One value only
`severity`	no	CSV
`page`, `pageSize`	no	Default 15, max 100. Out-of-range values are adjusted silently, never a 400

Errors

400Missing-pair message, scan-pair 404/400
400Please provide 'subscriptionId' query parameter.
400Invalid 'changeType' parameter. Must be 'added', 'modified', or 'deleted'.
400Invalid 'entityType' parameter. Must be 'subscription', 'resourceGroup', or 'resource'.
500An error occurred while processing the defender alert diff details.

Response: { alerts[], totalCount, totalPages, currentPage }. Each alert is a full alert plus changeStatus. Modified items also carry changes[] covering status, severity, intent, alertDisplayName, description, compromisedEntity, techniques, subTechniques, remediationSteps, startTimeUtc, endTimeUtc, entities, isIncident, correlationKey.

Example

GET /api/getDefenderAlertDiffDetails?baseScanId=…&compareScanId=…&subscriptionId=<guid>&changeType=added&severity=High,Medium

`GET /api/getDefenderPlanDiff`

Permission: View Defender Assessments

Defender plan changes between two scans. Free-trial countdown and coverage-status changes do not count as modifications.

Parameters

getDefenderPlanDiff parameters
Name	Required
`baseScanId`, `compareScanId`	yes

Errors

400Scan-pair errors
500An error occurred while processing the Defender plan comparison.

Response: { summary: { …, added, modified, deleted }, subscriptions[] }. Each subscription is { subscriptionId, subscriptionName, addedCount, modifiedCount, deletedCount, changes[] }. Each change is a plan (fields as in defender-plans) plus changeStatus and, when modified, changes[] over pricingTier, subPlan, enablementTime, enforce, deprecated, replacedBy and extensions.<Name>.*.

Example

GET /api/getDefenderPlanDiff?baseScanId=…&compareScanId=…

`GET /api/getDefenderVulnerabilityDiff`

Permission: View Defender Assessments

Which CVEs and packages appeared, disappeared or changed reach between two scans. Hidden items are included.

Parameters

getDefenderVulnerabilityDiff parameters
Name	Required
`baseScanId`, `compareScanId`	yes
`resourceTypes`	no

Errors

400Scan-pair errors
500An error occurred while processing the vulnerability comparison.

Response: { summary: { …, totals: { cves: { added, modified, deleted }, software: { … } } }, cves[], software[], catalogState, availableResourceTypes[] }. Each row (CVE or software):

getDefenderVulnerabilityDiff row fields
Field	Meaning
`changeStatus`	Decided by the set of affected resources: none before = added, none after = deleted, different = modified
`olderResourceCount`, `newerResourceCount`	Reach before and after
`addedResourceCount`, `removedResourceCount`	Resources gained and lost
`subscriptionCount`	Subscriptions affected
`addedFindingCount`, `modifiedFindingCount`, `deletedFindingCount`	Finding-level counts
CVE rows	Add `cveId` and `catalog?`
Software rows	Add `softwareKey`, `softwareVendor?`, `softwareName`, `packageType?`, `cveCount`, `exploitedCveCount`, `maxCvssScore?`, `maxSeverity`

Notes

A CVE affecting the same resources in both scans is omitted, even if versions changed.

Example

GET /api/getDefenderVulnerabilityDiff?baseScanId=…&compareScanId=…

`GET /api/defender-vulnerability-resource-diff`

Permission: View Defender Assessments

For one CVE or package, which resources' findings changed between two scans.

Parameters

defender-vulnerability-resource-diff parameters
Name	Required
`baseScanId`, `compareScanId`	yes
`cveId` or `softwareKey`	yes (exactly one)
`resourceTypes`	no

Errors

400Selector and scan-pair errors
500An error occurred while processing the vulnerability resource comparison.

Response: { resources[] }. Each resource: { resourceKey, resourceName, resourceType, subscriptionId, subscriptionName?, resourceGroupName?, addedCount, modifiedCount, deletedCount }.

Notes

To list the changed findings, pass resourceKey with the same selector to getDefenderAssessmentDiffDetails.

Example

GET /api/defender-vulnerability-resource-diff?baseScanId=…&compareScanId=…&cveId=CVE-2024-6387

Reference: Security & Microsoft Defender

20 Routes

StratoLens Security Findings

GET /api/security-recommendations

GET /api/resolved-security-findings

GET /api/security-recommendations/attribution

Defender Plans and Assessments

GET /api/defender-plans

GET /api/defender-plan-costs

GET /api/defender-hierarchy-summary

GET /api/defender-resource-details

Defender Alerts

GET /api/defender-alerts-hierarchy-summary

GET /api/defender-alerts-resource-details

Vulnerabilities

GET /api/defender-vulnerability-summary

GET /api/defender-vulnerability-resources

GET /api/defender-vulnerability-findings

GET /api/defender-cve-detail

Scan-to-Scan Diffs

GET /api/getDefenderAssessmentDiff

GET /api/getDefenderAssessmentDiffDetails

GET /api/getDefenderAlertDiff

GET /api/getDefenderAlertDiffDetails

GET /api/getDefenderPlanDiff

GET /api/getDefenderVulnerabilityDiff

GET /api/defender-vulnerability-resource-diff

`GET /api/security-recommendations`

`GET /api/resolved-security-findings`

`GET /api/security-recommendations/attribution`

`GET /api/defender-plans`

`GET /api/defender-plan-costs`

`GET /api/defender-hierarchy-summary`

`GET /api/defender-resource-details`

`GET /api/defender-alerts-hierarchy-summary`

`GET /api/defender-alerts-resource-details`

`GET /api/defender-vulnerability-summary`

`GET /api/defender-vulnerability-resources`

`GET /api/defender-vulnerability-findings`

`GET /api/defender-cve-detail`

`GET /api/getDefenderAssessmentDiff`

`GET /api/getDefenderAssessmentDiffDetails`

`GET /api/getDefenderAlertDiff`

`GET /api/getDefenderAlertDiffDetails`

`GET /api/getDefenderPlanDiff`

`GET /api/getDefenderVulnerabilityDiff`

`GET /api/defender-vulnerability-resource-diff`