Microsoft Defender IoT Security Alert Types API

The IoT Security Alert Types API from Microsoft Defender — 2 operation(s) for iot security alert types.

Documentation GitHub OpenAPI

Operations 2

GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/iotAlertTypes Iot alert types list #

GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/iotAlertTypes/{iotAlertTypeName} Iot alert types get #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/microsoft-defender:microsoft-defender-iot-security-alert-types-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Microsoft Defender for Cloud REST API (Microsoft.Security)…
  version: stable-composite
  description: Composite of the latest stable Microsoft.Security resource-manager swagger files published by Microsoft in Azure/azure-rest-api-specs. Each path keeps its own api-version via x-source.
  x-source-repo: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/security/resource-manager/Microsoft.Security/Security
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: IoT Security Alert Types
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/iotAlertTypes
  : get:
      x-ms-examples:
        Get IoT Alert Types:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2019-08-01/examples/IotAlertTypes/GetIoTAlertTypeList.json
      tags:
      - IoT Security Alert Types
      description: List IoT alert types
      operationId: IotAlertTypes_List
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/SubscriptionId
      - $ref: ./common/v1/types.json#/parameters/ResourceGroupName
      - $ref: '#/components/parameters/SolutionName'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IotAlertTypeList'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2019-08-01/iotAlertTypes.json
      summary: Iot alert types list
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/iotAlertTypes/{iotAlertTypeName}
  : get:
      x-ms-examples:
        Get IoT Alert Type:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2019-08-01/examples/IotAlertTypes/GetIoTAlertType.json
      tags:
      - IoT Security Alert Types
      operationId: IotAlertTypes_Get
      description: Get IoT alert type
      parameters:
      - $ref: ./common/v1/types.json#/parameters/ApiVersion
      - $ref: ./common/v1/types.json#/parameters/SubscriptionId
      - $ref: ./common/v1/types.json#/parameters/ResourceGroupName
      - $ref: '#/components/parameters/SolutionName'
      - in: path
        name: iotAlertTypeName
        required: true
        description: Name of the alert type
        schema:
          type: string
      responses:
        '200':
          description: IoT alert type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IotAlertType'
        default:
          description: Error response describing why the operation failed.
          content:
            application/json:
              schema:
                $ref: ./common/v1/types.json#/definitions/CloudError
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2019-08-01/iotAlertTypes.json
      summary: Iot alert types get
      x-summary-source: derived
components:
  schemas:
    IotAlertType:
      type: object
      description: IoT alert type.
      properties:
        properties:
          x-ms-client-flatten: true
          description: Alert type properties
          $ref: '#/components/schemas/IotAlertTypeProperties'
      allOf:
      - $ref: ./common/v1/types.json#/definitions/Resource
    IotAlertTypeList:
      type: object
      description: List of alert types
      properties:
        value:
          type: array
          description: List data
          items:
            $ref: '#/components/schemas/IotAlertType'
    IotAlertTypeProperties:
      type: object
      description: IoT alert type information.
      properties:
        alertDisplayName:
          readOnly: true
          type: string
          example: Privileged container detected
          description: The display name of the alert
        severity:
          readOnly: true
          type: string
          example: Medium
          description: The severity of the alert
          enum:
          - Informational
          - Low
          - Medium
          - High
          x-ms-enum:
            name: alertSeverity
            modelAsString: true
            values:
            - value: Informational
            - value: Low
            - value: Medium
            - value: High
        description:
          readOnly: true
          type: string
          description: Description of the suspected vulnerability and meaning.
          example: Machine logs indicate that a privileged Docker container is running. A privileged container has full access to host  resources. If compromised, a malicious actor can use the privileged container to gain access to the host machine.
        providerName:
          readOnly: true
          type: string
          example: IoTSecurity
          description: The name of the alert provider or internal partner
        productName:
          readOnly: true
          type: string
          example: Azure Security Center for IoT
          description: The name of the product which published this alert
        productComponentName:
          readOnly: true
          type: string
          example: IoT Hub
          description: The name of a component inside the product which generated the alert
        vendorName:
          readOnly: true
          type: string
          example: Microsoft
          description: The name of the vendor that raise the alert
        intent:
          readOnly: true
          type: string
          example: Exploitation,Execution
          description: Kill chain related intent behind the alert. Could contain multiple enum values (separated by commas)
          enum:
          - Unknown
          - PreAttack
          - InitialAccess
          - Persistence
          - PrivilegeEscalation
          - DefenseEvasion
          - CredentialAccess
          - Discovery
          - LateralMovement
          - Execution
          - Collection
          - Exfiltration
          - CommandAndControl
          - Impact
          - Probing
          - Exploitation
          x-ms-enum:
            name: alertIntent
            modelAsString: true
            values:
            - value: Unknown
            - value: PreAttack
            - value: InitialAccess
            - value: Persistence
            - value: PrivilegeEscalation
            - value: DefenseEvasion
            - value: CredentialAccess
            - value: Discovery
            - value: LateralMovement
            - value: Execution
            - value: Collection
            - value: Exfiltration
            - value: CommandAndControl
            - value: Impact
            - value: Probing
            - value: Exploitation
        remediationSteps:
          readOnly: true
          description: Manual action items to take to remediate the alert
          type: array
          items:
            type: string
            example: If the container doesn't need to run in privileged mode, remove the privileges from the container.
  parameters:
    SolutionName:
      name: solutionName
      in: path
      required: true
      description: The name of the IoT Security solution.
      x-ms-parameter-location: method
      schema:
        type: string
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.