Fix for removal of Defender XDR endpoint

[Ian Hellen (ianhelle)]

This pull request contains several changes focused on deprecating support for the M365 Defender Advanced Hunting API, consolidating API usage to the MDE Advanced Queries API, and updating related tests and configuration logic. It also includes minor bug fixes and cleanup in other modules. Below are the most significant changes:

M365 Defender API Deprecation and Consolidation

• Deprecated the use of the M365 Defender/Defender XDR Advanced Hunting API in mdatp_driver.py. All queries for the M365D environment now revert to the MDE Advanced Queries API, with a warning logged to inform users of the change and guidance to use the Microsoft Graph Security Hunting API (M365DGraph) instead. (msticpy/data/drivers/mdatp_driver.pyL293-R298)
• Updated test cases and mock data to reflect that M365D now uses the same endpoints and parameters as MDE, ensuring consistency across environments and removing references to the deprecated API. ([1], [2], [3], [4], [5]`)

Code Cleanup and Bug Fixes

• Removed the unused get_m365d_endpoint import from mdatp_driver.py and updated log messages for clarity. ([1], [2])
• Fixed a typo in the docstring of _value_or_default in query_source.py ("emtpy" to "empty"). (msticpy/data/core/query_source.pyL30-R30)
• Improved the logic in _get_driver_settings in odata_driver.py to avoid appending "-Default" to configuration keys, which could cause incorrect lookups. (msticpy/data/drivers/odata_driver.pyL561-R565)

Azure Monitor Driver Simplification

• Removed the unused datetime import and the _format_datetime method from azure_monitor_driver.py, and updated the FORMATTERS dictionary accordingly. ([1], [2], [3])

Version Bump

• Incremented the package version to 2.17.2. (msticpy/_version.pyL3-R3)

[Copilot]

Pull Request Overview

This PR addresses the deprecation of the Microsoft 365 Defender (M365D) Advanced Hunting API endpoint by consolidating M365D queries to use the MDE Advanced Queries API instead. Users are warned about this change and directed to use the Microsoft Graph Security Hunting API (M365DGraph) going forward.

Key Changes:

• Deprecated M365D Advanced Hunting API usage, with M365D environment now routing to MDE Advanced Queries API
• Updated test fixtures to reflect M365D using MDE endpoints (securitycenter domain instead of security domain)
• Minor code cleanup including removal of unused imports, typo fixes, and configuration key handling improvements

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
msticpy/data/drivers/mdatp_driver.py	Removed M365D-specific API logic, added deprecation warning, consolidated to MDE API path
tests/data/drivers/test_mdatp_driver.py	Updated M365D test assertions to expect MDE API endpoints and parameters
tests/data/drivers/test_odata_drivers.py	Changed M365D test data from security to securitycenter domain URLs
msticpy/data/drivers/odata_driver.py	Fixed configuration key logic to avoid appending "-Default" unnecessarily
msticpy/data/drivers/azure_monitor_driver.py	Removed unused datetime import and _format_datetime method
msticpy/data/core/query_source.py	Fixed typo in docstring ("emtpy" → "empty")
msticpy/_version.py	Bumped version to 2.17.2

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[FlorianBracq]

Minor update suggested for the depreciation warning, the rest looks OK.