Microsoft Graph Security.alert API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Security.alert API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: Security.alert
  x-ms-docs-toc-type: page
paths:
  /security/alerts:
    description: Provides operations to manage the alerts property of the microsoft.graph.security entity.
    get:
      tags:
      - Security.alert
      summary: Microsoft Graph List alerts
      description: Retrieve a list of alert objects.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/alert-list?view=graph-rest-1.0
      operationId: security.ListAlerts
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.alertCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      deprecated: true
      x-ms-deprecation:
        removalDate: '2026-04-10'
        date: '2024-04-10'
        version: 2024-01/Deprecation
        description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - Security.alert
      summary: Microsoft Graph Create new navigation property to alerts for security
      operationId: security.CreateAlerts
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.alert'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      deprecated: true
      x-ms-deprecation:
        removalDate: '2026-04-10'
        date: '2024-04-10'
        version: 2024-01/Deprecation
        description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
      x-ms-docs-operation-type: operation
  /security/alerts_v2:
    description: Provides operations to manage the alerts_v2 property of the microsoft.graph.security entity.
    get:
      tags:
      - Security.alert
      summary: Microsoft Graph List alerts_v2
      description: Get a list of alert resources created to track suspicious activities in an organization. This operation lets you filter and sort through alerts to create an informed cyber security response. It exposes a collection of alerts that were flagged in your network, within the time range you specified in your environment retention policy. The most recent alerts are displayed at the top of the list.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-list-alerts_v2?view=graph-rest-1.0
      operationId: security.ListAlerts_v2
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.alertCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - Security.alert
      summary: Microsoft Graph Create new navigation property to alerts_v2 for security
      operationId: security.CreateAlerts_v2
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.alert'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/alerts_v2/{alert-id}:
    description: Provides operations to manage the alerts_v2 property of the microsoft.graph.security entity.
    parameters:
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    get:
      tags:
      - Security.alert
      summary: Microsoft Graph Get alert
      description: Get the properties and relationships of an alert object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-alert-get?view=graph-rest-1.0
      operationId: security.GetAlerts_v2
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - Security.alert
      summary: Microsoft Graph Update alert
      description: Update the properties of an alert object in an organization based on the specified alert id property.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-alert-update?view=graph-rest-1.0
      operationId: security.UpdateAlerts_v2
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.alert'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - Security.alert
      summary: Microsoft Graph Delete navigation property alerts_v2 for security
      operationId: security.DeleteAlerts_v2
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/alerts_v2/{alert-id}/comments:
    parameters:
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    post:
      tags:
      - Security.alert
      summary: Microsoft Graph Create comment for alert
      description: Create a comment for an existing alert based on the specified alert id property.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-alert-post-comments?view=graph-rest-1.0
      operationId: security.alerts_v2.SetComments
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      requestBody:
        description: New property values
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/microsoft.graph.security.alertComment'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/microsoft.graph.security.alertComment'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/alerts_v2/{alert-id}/comments/$count:
    description: Provides operations to count the resources in the collection.
    parameters:
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    get:
      tags:
      - Security.alert
      summary: Microsoft Graph Get the number of the resource
      operationId: security.alerts_v2.Comments.GetCount-2f70
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/alerts_v2/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - Security.alert
      summary: Microsoft Graph Get the number of the resource
      operationId: security.alerts_v2.GetCount-9522
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/alerts/{alert-id}:
    description: Provides operations to manage the alerts property of the microsoft.graph.security entity.
    parameters:
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    get:
      tags:
      - Security.alert
      summary: Microsoft Graph Get alert
      description: Retrieve the properties and relationships of an alert object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/alert-get?view=graph-rest-1.0
      operationId: security.GetAlerts
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      deprecated: true
      x-ms-deprecation:
        removalDate: '2026-04-10'
        date: '2024-04-10'
        version: 2024-01/Deprecation
        description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - Security.alert
      summary: Microsoft Graph Update alert
      description: Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions. This method updates any solution that has a record of the referenced alert ID.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/alert-update?view=graph-rest-1.0
      operationId: security.UpdateAlerts
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.alert'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      deprecated: true
      x-ms-deprecation:
        removalDate: '2026-04-10'
        date: '2024-04-10'
        version: 2024-01/Deprecation
        description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
      x-ms-docs-operation-type: operation
  /security/alerts/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - Security.alert
      summary: Microsoft Graph Get the number of the resource
      operationId: security.alerts.GetCount-82d4
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      deprecated: true
      x-ms-deprecation:
        removalDate: '2026-04-10'
        date: '2024-04-10'
        version: 2024-01/Deprecation
        description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
components:
  schemas:
    ODataCountResponse:
      type: integer
      format: int32
    microsoft.graph.security.serviceSource:
      title: serviceSource
      enum:
      - unknown
      - microsoftDefenderForEndpoint
      - microsoftDefenderForIdentity
      - microsoftDefenderForCloudApps
      - microsoftDefenderForOffice365
      - microsoft365Defender
      - azureAdIdentityProtection
      - microsoftAppGovernance
      - dataLossPrevention
      - unknownFutureValue
      - microsoftDefenderForCloud
      - microsoftSentinel
      - microsoftInsiderRiskManagement
      - microsoftThreatIntelligence
      type: string
    microsoft.graph.security.investigationState:
      title: investigationState
      enum:
      - unknown
      - terminated
      - successfullyRemediated
      - benign
      - failed
      - partiallyRemediated
      - running
      - pendingApproval
      - pendingResource
      - queued
      - innerFailure
      - preexistingAlert
      - unsupportedOs
      - unsupportedAlertType
      - suppressedAlert
      - partiallyInvestigated
      - terminatedByUser
      - terminatedBySystem
      - unknownFutureValue
      type: string
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.connectionDirection:
      title: connectionDirection
      enum:
      - unknown
      - inbound
      - outbound
      - unknownFutureValue
      type: string
    microsoft.graph.registryOperation:
      title: registryOperation
      enum:
      - unknown
      - create
      - modify
      - delete
      - unknownFutureValue
      type: string
    microsoft.graph.alertHistoryState:
      title: alertHistoryState
      required:
      - '@odata.type'
      type: object
      properties:
        appId:
          type: string
          nullable: true
        assignedTo:
          type: string
          nullable: true
        comments:
          type: array
          items:
            type: string
            nullable: true
        feedback:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.alertFeedback'
          - type: object
            nullable: true
        status:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.alertStatus'
          - type: object
            nullable: true
        updatedDateTime:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          format: date-time
          nullable: true
        user:
          type: string
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.alertCollectionResponse:
      title: Collection of alert
      type: object
      allOf:
      - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse'
      - type: object
        properties:
          value:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.alert'
    microsoft.graph.logonType:
      title: logonType
      enum:
      - unknown
      - interactive
      - remoteInteractive
      - network
      - batch
      - service
      - unknownFutureValue
      type: string
    microsoft.graph.registryKeyState:
      title: registryKeyState
      required:
      - '@odata.type'
      type: object
      properties:
        hive:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.registryHive'
          - type: object
            nullable: true
          description: 'A Windows registry hive : HKEYCURRENTCONFIG HKEYCURRENTUSER HKEYLOCALMACHINE/SAM HKEYLOCALMACHINE/Security HKEYLOCALMACHINE/Software HKEYLOCALMACHINE/System HKEY_USERS/.Default. The possible values are: unknown, currentConfig, currentUser, localMachineSam, localMachineSecurity, localMachineSoftware, localMachineSystem, usersDefault.'
        key:
          type: string
          description: Current (i.e. changed) registry key (excludes HIVE).
          nullable: true
        oldKey:
          type: string
          description: Previous (i.e. before changed) registry key (excludes HIVE).
          nullable: true
        oldValueData:
          type: string
          description: Previous (i.e. before changed) registry key value data (contents).
          nullable: true
        oldValueName:
          type: string
          description: Previous (i.e. before changed) registry key value name.
          nullable: true
        operation:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.registryOperation'
          - type: object
            nullable: true
          description: 'Operation that changed the registry key name and/or value. The possible values are: unknown, create, modify, delete.'
        processId:
          maximum: 2147483647
          minimum: -2147483648
          type: number
          description: Process ID (PID) of the process that modified the registry key (process details will appear in the alert 'processes' collection).
          format: int32
          nullable: true
        valueData:
          type: string
          description: Current (i.e. changed) registry key value data (contents).
          nullable: true
        valueName:
          type: string
          description: Current (i.e. changed) registry key value name
          nullable: true
        valueType:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.registryValueType'
          - type: object
            nullable: true
          description: 'Registry key value type REGBINARY REGDWORD REGDWORDLITTLEENDIAN REGDWORDBIGENDIANREGEXPANDSZ REGLINK REGMULTISZ REGNONE REGQWORD REGQWORDLITTLEENDIAN REG_SZ The possible values are: unknown, binary, dword, dwordLittleEndian, dwordBigEndian, expandSz, link, multiSz, none, qword, qwordlittleEndian, sz.'
        '@odata.type':
          type: string
    microsoft.graph.alertStatus:
      title: alertStatus
      enum:
      - unknown
      - newAlert
      - inProgress
      - resolved
      - dismissed
      - unknownFutureValue
      type: string
    microsoft.graph.securityResource:
      title: securityResource
      required:
      - '@odata.type'
      type: object
      properties:
        resource:
          type: string
          description: Name of the resource that is related to current alert. Required.
          nullable: true
        resourceType:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.securityResourceType'
          - type: object
            nullable: true
          description: 'Represents type of security resources related to an alert. The possible values are: attacked, related.'
        '@odata.type':
          type: string
    microsoft.graph.uriClickSecurityState:
      title: uriClickSecurityState
      required:
      - '@odata.type'
      type: object
      properties:
        clickAction:
          type: string
          nullable: true
        clickDateTime:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          format: date-time
          nullable: true
        id:
          type: string
          nullable: true
        sourceId:
          type: string
          nullable: true
        uriDomain:
          type: string
          nullable: true
        verdict:
          type: string
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.alertFeedback:
      title: alertFeedback
      enum:
      - unknown
      - truePositive
      - falsePositive
      - benignPositive
      - unknownFutureValue
      type: string
    microsoft.graph.security.alertSeverity:
      title: alertSeverity
      enum:
      - unknown
      - informational
      - low
      - medium
      - high
      - unknownFutureValue
      type: string
    microsoft.graph.registryHive:
      title: registryHive
      enum:
      - unknown
      - currentConfig
      - currentUser
      - localMachineSam
      - localMachineSecurity
      - localMachineSoftware
      - localMachineSystem
      - usersDefault
      - unknownFutureValue
      type: string
    BaseCollectionPaginationCountResponse:
      title: Base collection pagination and count responses
      type: object
      properties:
        '@odata.count':
          type: integer
          format: int64
          nullable: true
        '@odata.nextLink':
          type: string
          nullable: true
    microsoft.graph.security.alertDetermination:
      title: alertDetermination
      enum:
      - unknown
      - apt
      - malware
      - securityPersonnel
      - securityTesting
      - unwantedSoftware
      - other
      - multiStagedAttack
      - compromisedAccount
      - phishing
      - maliciousUserActivity
      - notMalicious
      - notEnoughDataToValidate
      - confirmedActivity
      - lineOfBusinessApplication
      - unknownFutureValue
      type: string
    microsoft.graph.ODataErrors.InnerError:
      title: InnerError
      required:
      - '@odata.type'
      type: object
      properties:
        request-id:
          type: string
          description: Request Id as tracked internally by the service
          nullable: true
        client-request-id:
          type: string
          description: Client request Id as sent by the client application.
          nullable: true
        date:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Date when the error occured.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.alert:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: alert
        required:
        - '@odata.type'
        type: object
        properties:
          activityGroupName:
            type: string
            description: Name or alias of the activity group (attacker) this alert is attributed to.
            nullable: true
          alertDetections:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.alertDetection'
          assignedTo:
            type: string
            description: Name of the analyst the alert is assigned to for triage, investigation, or remediation (supports update).
            nullable: true
          azureSubscriptionId:
            type: string
            description: Azure subscription ID, present if this alert is related to an Azure resource.
            nullable: true
          azureTenantId:
            type: string
            description: Microsoft Entra tenant ID. Required.
          category:
            type: string
            description: Category of the alert (for example, credentialTheft, ransomware).
            nullable: true
          closedDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Time at which the alert was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z (supports update).
            format: date-time
            nullable: true
          cloudAppStates:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.cloudAppSecurityState'
            description: Security-related stateful information generated by the provider about the cloud application/s related to this alert.
          comments:
            type: array
            items:
              type: string
              nullable: true
            description: Customer-provided comments on alert (for customer alert management) (supports update).
          confidence:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Confidence of the detection logic (percentage between 1-100).
            format: int32
            nullable: true
          createdDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Time at which the alert was created by the alert provider. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Required.
            format: date-time
            nullable: true
          description:
            type: string
            description: Alert description.
            nullable: true
          detectionIds:
            type: array
            items:
              type: string
              nullable: true
            description: Set of alerts related to this alert entity (each alert is pushed to the SIEM as a separate record).
          eventDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Time at which the event or events that served as the trigger to generate the alert occurred. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Required.
            format: date-time
            nullable: true
          feedback:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.alertFeedback'
            - type: object
              nullable: true
            description: 'Analyst feedback on the alert. The possible values are: unknown, truePositive, falsePositive, benignPositive. Supports update.'
          fileStates:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.fileSecurityState'
            description: Security-related stateful information generated by the provider about the file(s) related to this alert.
          historyStates:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.alertHistoryState'
          hostStates:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.hostSecurityState'
            description: Security-related stateful information generated by the provider about the host(s) related to this alert.
          incidentIds:
            type: array
            items:
              type: string
              nullable: true
            description: IDs of incidents related to current alert.
          investigationSecurityStates:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.investigationSecurityState'
          lastEventDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            format: date-time
            nullable: true
          lastModifiedDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T(

# --- truncated at 32 KB (203 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-security-alert-api-openapi.yml