alert resource type

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

Represents potential security issues within a customer's tenant that Microsoft or partner security solutions have identified. Use alerts to unify and streamline security issue management across all integrated solutions. To learn more, see the sample queries in Graph Explorer.

Alerts can be retrieved from different security providers listed in the Microsoft Graph Security Overview.

Methods

Method Return Type Description
Get alert alert Read properties and relationships of an alert object.
Update alert alert Update an alert object.
List alerts alert collection Get an alert object collection.
Update alerts alert collection Update multiple alert objects.

Properties

Property Type Description
activityGroupName String Name or alias of the activity group (attacker) this alert is attributed to.
assignedTo String Name of the analyst the alert is assigned to for triage, investigation, or remediation (supports update).
azureSubscriptionId String Azure subscription ID, present if this alert is related to an Azure resource.
azureTenantId String Azure Active Directory tenant ID. Required.
category String Category of the alert (for example, credentialTheft, ransomware, etc.).
closedDateTime DateTimeOffset Time at which the alert was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z' (supports update).
cloudAppStates cloudAppSecurityState collection Security-related stateful information generated by the provider about the cloud application/s related to this alert.
comments String collection Customer-provided comments on alert (for customer alert management) (supports update).
confidence Int32 Confidence of the detection logic (percentage between 1-100).
createdDateTime DateTimeOffset Time at which the alert was created by the alert provider. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Required.
description String Alert description.
detectionIds String collection Set of alerts related to this alert entity (each alert is pushed to the SIEM as a separate record).
eventDateTime DateTimeOffset Time at which the event(s) that served as the trigger(s) to generate the alert occurred. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Required.
feedback alertFeedback Analyst feedback on the alert. Possible values are: unknown, truePositive, falsePositive, benignPositive. (supports update)
fileStates fileSecurityState collection Security-related stateful information generated by the provider about the file(s) related to this alert.
historyStates alertHistoryState collection A collection of alertHistoryStates comprising an audit log of all updates made to an alert.
hostStates hostSecurityState collection Security-related stateful information generated by the provider about the host(s) related to this alert.
id String Provider-generated GUID/unique identifier. Read-only. Required.
lastModifiedDateTime DateTimeOffset Time at which the alert entity was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
malwareStates malwareState collection Threat Intelligence pertaining to malware related to this alert.
networkConnections networkConnection collection Security-related stateful information generated by the provider about the network connection(s) related to this alert.
processes process collection Security-related stateful information generated by the provider about the process or processes related to this alert.
recommendedActions String collection Vendor/provider recommended action(s) to take as a result of the alert (for example, isolate machine, enforce2FA, reimage host).
registryKeyStates registryKeyState collection Security-related stateful information generated by the provider about the registry keys related to this alert.
severity alertSeverity Alert severity - set by vendor/provider. Possible values are: unknown, informational, low, medium, high. Required.
sourceMaterials String collection Hyperlinks (URIs) to the source material related to the alert, for example, provider's user interface for alerts or log search, etc.
status alertStatus Alert lifecycle status (stage). Possible values are: unknown, newAlert, inProgress, resolved. (supports update). Required.
tags String collection User-definable labels that can be applied to an alert and can serve as filter conditions (for example "HVA", "SAW", etc.) (supports update).
title String Alert title. Required.
triggers alertTrigger collection Security-related information about the specific properties that triggered the alert (properties appearing in the alert). Alerts might contain information about multiple users, hosts, files, ip addresses. This field indicates which properties triggered the alert generation.
userStates userSecurityState collection Security-related stateful information generated by the provider about the user accounts related to this alert.
vendorInformation securityVendorInformation Complex type containing details about the security product/service vendor, provider, and subprovider (for example, vendor=Microsoft; provider=Windows Defender ATP; subProvider=AppLocker). Required.
vulnerabilityStates vulnerabilityState collection Threat intelligence pertaining to one or more vulnerabilities related to this alert.

Relationships

None.

JSON representation

The following is a JSON representation of the resource.

{
  "activityGroupName": "String",
  "assignedTo": "String",
  "azureSubscriptionId": "String",
  "azureTenantId": "String",
  "category": "String",
  "closedDateTime": "String (timestamp)",
  "cloudAppStates": [{"@odata.type": "microsoft.graph.cloudAppSecurityState"}],
  "comments": ["String"],
  "confidence": 1024,
  "createdDateTime": "String (timestamp)",
  "description": "String",
  "detectionIds": ["String"],
  "eventDateTime": "String (timestamp)",
  "feedback": "@odata.type: microsoft.graph.alertFeedback",
  "fileStates": [{"@odata.type": "microsoft.graph.fileSecurityState"}],
  "historyStates": [{"@odata.type": "microsoft.graph.alertHistoryState"}],
  "hostStates": [{"@odata.type": "microsoft.graph.hostSecurityState"}],
  "id": "String (identifier)",
  "lastModifiedDateTime": "String (timestamp)",
  "malwareStates": [{"@odata.type": "microsoft.graph.malwareState"}],
  "networkConnections": [{"@odata.type": "microsoft.graph.networkConnection"}],
  "processes": [{"@odata.type": "microsoft.graph.process"}],
  "recommendedActions": ["String"],
  "registryKeyStates": [{"@odata.type": "microsoft.graph.registryKeyState"}],
  "severity": "@odata.type: microsoft.graph.alertSeverity",
  "sourceMaterials": ["String"],
  "status": "@odata.type: microsoft.graph.alertStatus",
  "tags": ["String"],
  "title": "String",
  "triggers": [{"@odata.type": "microsoft.graph.alertTrigger"}],
  "userStates": [{"@odata.type": "microsoft.graph.userSecurityState"}],
  "vendorInformation": {"@odata.type": "microsoft.graph.securityVendorInformation"},
  "vulnerabilityStates": [{"@odata.type": "microsoft.graph.vulnerabilityState"}]
}