Create alert API


Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender Advanced Threat Protection. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.

Applies to: Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

API description

Creates new Alert on top of Event.
Microsoft Defender ATP Event is required for the alert creation.
You will need to supply 3 parameters from the Event in the request: Event Time, Machine ID and Report ID. See example below.
You can use an event found in Advanced Hunting API or Portal.
If there existing an open alert on the same Device with the same Title, the new created alert will be merged with it.
An automatic investigation starts automatically on alerts created via the API.


  1. Rate limitations for this API are 15 calls per minute.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Use Microsoft Defender ATP APIs

Permission type Permission Permission display name
Application Alerts.ReadWrite.All 'Read and write all alerts'
Delegated (work or school account) Alert.ReadWrite 'Read and write alerts'


When obtaining a token using user credentials:

  • The user needs to have at least the following role permission: 'Alerts investigation' (See Create and manage roles for more information)
  • The user needs to have access to the device associated with the alert, based on device group settings (See Create and manage device groups for more information)

HTTP request


Request headers

Name Type Description
Authorization String Bearer {token}. Required.
Content-Type String application/json. Required.

Request body

In the request body, supply the following values (all are required):

Property Type Description
eventTime DateTime(UTC) The precise time of the event as string, as obtained from advanced hunting. e.g. 2018-08-03T16:45:21.7115183Z Required.
reportId String The reportId of the event, as obtained from advanced hunting. Required.
machineId String Id of the device on which the event was identified. Required.
severity String Severity of the alert. The property values are: 'Low', 'Medium' and 'High'. Required.
title String Title for the alert. Required.
description String Description of the alert. Required.
recommendedAction String Action that is recommended to be taken by security officer when analyzing the alert. Required.
category String Category of the alert. The property values are: "General", "CommandAndControl", "Collection", "CredentialAccess", "DefenseEvasion", "Discovery", "Exfiltration", "Exploit", "Execution", "InitialAccess", "LateralMovement", "Malware", "Persistence", "PrivilegeEscalation", "Ransomware", "SuspiciousActivity" Required.


If successful, this method returns 200 OK, and a new alert object in the response body. If event with the specified properties (reportId, eventTime and machineId) was not found - 404 Not Found.



Here is an example of the request.


For better performance, you can use server closer to your geo location:

	"machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
	"severity": "Low",
	"title": "example",
	"description": "example alert",
	"recommendedAction": "nothing",
	"eventTime": "2018-08-03T16:45:21.7115183Z",
	"reportId": "20776",
	"category": "Exploit"