openapi: 3.1.0
info:
title: Microsoft Graph Admin Admin.admin Security.alert API
description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.
This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,
site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,
SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
version: 1.0.0
contact:
name: Microsoft Graph API Support
url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
description: Microsoft Graph API v1.0 endpoint
tags:
- name: Security.alert
x-ms-docs-toc-type: page
paths:
/security/alerts:
description: Provides operations to manage the alerts property of the microsoft.graph.security entity.
get:
tags:
- Security.alert
summary: Microsoft Graph List alerts
description: Retrieve a list of alert objects.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/alert-list?view=graph-rest-1.0
operationId: security.ListAlerts
parameters:
- $ref: '#/components/parameters/top'
- $ref: '#/components/parameters/skip'
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
- $ref: '#/components/parameters/count'
- name: $orderby
in: query
description: Order items by property values
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
$ref: '#/components/responses/microsoft.graph.alertCollectionResponse'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
deprecated: true
x-ms-deprecation:
removalDate: '2026-04-10'
date: '2024-04-10'
version: 2024-01/Deprecation
description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
x-ms-pageable:
nextLinkName: '@odata.nextLink'
operationName: listMore
x-ms-docs-operation-type: operation
post:
tags:
- Security.alert
summary: Microsoft Graph Create new navigation property to alerts for security
operationId: security.CreateAlerts
requestBody:
description: New navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.alert'
required: true
responses:
2XX:
description: Created navigation property.
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.alert'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
deprecated: true
x-ms-deprecation:
removalDate: '2026-04-10'
date: '2024-04-10'
version: 2024-01/Deprecation
description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
x-ms-docs-operation-type: operation
/security/alerts_v2:
description: Provides operations to manage the alerts_v2 property of the microsoft.graph.security entity.
get:
tags:
- Security.alert
summary: Microsoft Graph List alerts_v2
description: Get a list of alert resources created to track suspicious activities in an organization. This operation lets you filter and sort through alerts to create an informed cyber security response. It exposes a collection of alerts that were flagged in your network, within the time range you specified in your environment retention policy. The most recent alerts are displayed at the top of the list.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/security-list-alerts_v2?view=graph-rest-1.0
operationId: security.ListAlerts_v2
parameters:
- $ref: '#/components/parameters/top'
- $ref: '#/components/parameters/skip'
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
- $ref: '#/components/parameters/count'
- name: $orderby
in: query
description: Order items by property values
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
$ref: '#/components/responses/microsoft.graph.security.alertCollectionResponse'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-pageable:
nextLinkName: '@odata.nextLink'
operationName: listMore
x-ms-docs-operation-type: operation
post:
tags:
- Security.alert
summary: Microsoft Graph Create new navigation property to alerts_v2 for security
operationId: security.CreateAlerts_v2
requestBody:
description: New navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security.alert'
required: true
responses:
2XX:
description: Created navigation property.
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security.alert'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
/security/alerts_v2/{alert-id}:
description: Provides operations to manage the alerts_v2 property of the microsoft.graph.security entity.
parameters:
- name: alert-id
in: path
description: The unique identifier of alert
required: true
schema:
type: string
x-ms-docs-key-type: alert
get:
tags:
- Security.alert
summary: Microsoft Graph Get alert
description: Get the properties and relationships of an alert object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/security-alert-get?view=graph-rest-1.0
operationId: security.GetAlerts_v2
parameters:
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security.alert'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- Security.alert
summary: Microsoft Graph Update alert
description: Update the properties of an alert object in an organization based on the specified alert id property.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/security-alert-update?view=graph-rest-1.0
operationId: security.UpdateAlerts_v2
requestBody:
description: New navigation property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security.alert'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security.alert'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
delete:
tags:
- Security.alert
summary: Microsoft Graph Delete navigation property alerts_v2 for security
operationId: security.DeleteAlerts_v2
parameters:
- name: If-Match
in: header
description: ETag
schema:
type: string
responses:
'204':
description: Success
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
/security/alerts_v2/{alert-id}/comments:
parameters:
- name: alert-id
in: path
description: The unique identifier of alert
required: true
schema:
type: string
x-ms-docs-key-type: alert
post:
tags:
- Security.alert
summary: Microsoft Graph Create comment for alert
description: Create a comment for an existing alert based on the specified alert id property.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/security-alert-post-comments?view=graph-rest-1.0
operationId: security.alerts_v2.SetComments
parameters:
- name: If-Match
in: header
description: ETag
schema:
type: string
requestBody:
description: New property values
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.security.alertComment'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.security.alertComment'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
/security/alerts_v2/{alert-id}/comments/$count:
description: Provides operations to count the resources in the collection.
parameters:
- name: alert-id
in: path
description: The unique identifier of alert
required: true
schema:
type: string
x-ms-docs-key-type: alert
get:
tags:
- Security.alert
summary: Microsoft Graph Get the number of the resource
operationId: security.alerts_v2.Comments.GetCount-2f70
parameters:
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
responses:
2XX:
$ref: '#/components/responses/ODataCountResponse'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
/security/alerts_v2/$count:
description: Provides operations to count the resources in the collection.
get:
tags:
- Security.alert
summary: Microsoft Graph Get the number of the resource
operationId: security.alerts_v2.GetCount-9522
parameters:
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
responses:
2XX:
$ref: '#/components/responses/ODataCountResponse'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
/security/alerts/{alert-id}:
description: Provides operations to manage the alerts property of the microsoft.graph.security entity.
parameters:
- name: alert-id
in: path
description: The unique identifier of alert
required: true
schema:
type: string
x-ms-docs-key-type: alert
get:
tags:
- Security.alert
summary: Microsoft Graph Get alert
description: Retrieve the properties and relationships of an alert object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/alert-get?view=graph-rest-1.0
operationId: security.GetAlerts
parameters:
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.alert'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
deprecated: true
x-ms-deprecation:
removalDate: '2026-04-10'
date: '2024-04-10'
version: 2024-01/Deprecation
description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
x-ms-docs-operation-type: operation
patch:
tags:
- Security.alert
summary: Microsoft Graph Update alert
description: Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions. This method updates any solution that has a record of the referenced alert ID.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/alert-update?view=graph-rest-1.0
operationId: security.UpdateAlerts
requestBody:
description: New navigation property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.alert'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.alert'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
deprecated: true
x-ms-deprecation:
removalDate: '2026-04-10'
date: '2024-04-10'
version: 2024-01/Deprecation
description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
x-ms-docs-operation-type: operation
/security/alerts/$count:
description: Provides operations to count the resources in the collection.
get:
tags:
- Security.alert
summary: Microsoft Graph Get the number of the resource
operationId: security.alerts.GetCount-82d4
parameters:
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
responses:
2XX:
$ref: '#/components/responses/ODataCountResponse'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
deprecated: true
x-ms-deprecation:
removalDate: '2026-04-10'
date: '2024-04-10'
version: 2024-01/Deprecation
description: The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.
components:
schemas:
microsoft.graph.security.alertEvidence:
title: alertEvidence
required:
- '@odata.type'
type: object
properties:
createdDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: The date and time when the evidence was created and added to the alert. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
format: date-time
detailedRoles:
type: array
items:
type: string
nullable: true
description: Detailed description of the entity role/s in an alert. Values are free-form.
remediationStatus:
$ref: '#/components/schemas/microsoft.graph.security.evidenceRemediationStatus'
remediationStatusDetails:
type: string
description: Details about the remediation status.
nullable: true
roles:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.security.evidenceRole'
description: The role/s that an evidence entity represents in an alert, for example, an IP address that is associated with an attacker has the evidence role Attacker.
tags:
type: array
items:
type: string
nullable: true
description: Array of custom tags associated with an evidence instance, for example, to denote a group of devices, high-value assets, etc.
verdict:
$ref: '#/components/schemas/microsoft.graph.security.evidenceVerdict'
'@odata.type':
type: string
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.security.aiAgentEvidence': '#/components/schemas/microsoft.graph.security.aiAgentEvidence'
'#microsoft.graph.security.amazonResourceEvidence': '#/components/schemas/microsoft.graph.security.amazonResourceEvidence'
'#microsoft.graph.security.analyzedMessageEvidence': '#/components/schemas/microsoft.graph.security.analyzedMessageEvidence'
'#microsoft.graph.security.azureResourceEvidence': '#/components/schemas/microsoft.graph.security.azureResourceEvidence'
'#microsoft.graph.security.blobContainerEvidence': '#/components/schemas/microsoft.graph.security.blobContainerEvidence'
'#microsoft.graph.security.blobEvidence': '#/components/schemas/microsoft.graph.security.blobEvidence'
'#microsoft.graph.security.cloudApplicationEvidence': '#/components/schemas/microsoft.graph.security.cloudApplicationEvidence'
'#microsoft.graph.security.cloudLogonRequestEvidence': '#/components/schemas/microsoft.graph.security.cloudLogonRequestEvidence'
'#microsoft.graph.security.cloudLogonSessionEvidence': '#/components/schemas/microsoft.graph.security.cloudLogonSessionEvidence'
'#microsoft.graph.security.containerEvidence': '#/components/schemas/microsoft.graph.security.containerEvidence'
'#microsoft.graph.security.containerImageEvidence': '#/components/schemas/microsoft.graph.security.containerImageEvidence'
'#microsoft.graph.security.containerRegistryEvidence': '#/components/schemas/microsoft.graph.security.containerRegistryEvidence'
'#microsoft.graph.security.deviceEvidence': '#/components/schemas/microsoft.graph.security.deviceEvidence'
'#microsoft.graph.security.dnsEvidence': '#/components/schemas/microsoft.graph.security.dnsEvidence'
'#microsoft.graph.security.fileEvidence': '#/components/schemas/microsoft.graph.security.fileEvidence'
'#microsoft.graph.security.fileHashEvidence': '#/components/schemas/microsoft.graph.security.fileHashEvidence'
'#microsoft.graph.security.gitHubOrganizationEvidence': '#/components/schemas/microsoft.graph.security.gitHubOrganizationEvidence'
'#microsoft.graph.security.gitHubRepoEvidence': '#/components/schemas/microsoft.graph.security.gitHubRepoEvidence'
'#microsoft.graph.security.gitHubUserEvidence': '#/components/schemas/microsoft.graph.security.gitHubUserEvidence'
'#microsoft.graph.security.googleCloudResourceEvidence': '#/components/schemas/microsoft.graph.security.googleCloudResourceEvidence'
'#microsoft.graph.security.hostLogonSessionEvidence': '#/components/schemas/microsoft.graph.security.hostLogonSessionEvidence'
'#microsoft.graph.security.ioTDeviceEvidence': '#/components/schemas/microsoft.graph.security.ioTDeviceEvidence'
'#microsoft.graph.security.ipEvidence': '#/components/schemas/microsoft.graph.security.ipEvidence'
'#microsoft.graph.security.kubernetesClusterEvidence': '#/components/schemas/microsoft.graph.security.kubernetesClusterEvidence'
'#microsoft.graph.security.kubernetesControllerEvidence': '#/components/schemas/microsoft.graph.security.kubernetesControllerEvidence'
'#microsoft.graph.security.kubernetesNamespaceEvidence': '#/components/schemas/microsoft.graph.security.kubernetesNamespaceEvidence'
'#microsoft.graph.security.kubernetesPodEvidence': '#/components/schemas/microsoft.graph.security.kubernetesPodEvidence'
'#microsoft.graph.security.kubernetesSecretEvidence': '#/components/schemas/microsoft.graph.security.kubernetesSecretEvidence'
'#microsoft.graph.security.kubernetesServiceAccountEvidence': '#/components/schemas/microsoft.graph.security.kubernetesServiceAccountEvidence'
'#microsoft.graph.security.kubernetesServiceEvidence': '#/components/schemas/microsoft.graph.security.kubernetesServiceEvidence'
'#microsoft.graph.security.mailboxConfigurationEvidence': '#/components/schemas/microsoft.graph.security.mailboxConfigurationEvidence'
'#microsoft.graph.security.mailboxEvidence': '#/components/schemas/microsoft.graph.security.mailboxEvidence'
'#microsoft.graph.security.mailClusterEvidence': '#/components/schemas/microsoft.graph.security.mailClusterEvidence'
'#microsoft.graph.security.malwareEvidence': '#/components/schemas/microsoft.graph.security.malwareEvidence'
'#microsoft.graph.security.networkConnectionEvidence': '#/components/schemas/microsoft.graph.security.networkConnectionEvidence'
'#microsoft.graph.security.nicEvidence': '#/components/schemas/microsoft.graph.security.nicEvidence'
'#microsoft.graph.security.oauthApplicationEvidence': '#/components/schemas/microsoft.graph.security.oauthApplicationEvidence'
'#microsoft.graph.security.processEvidence': '#/components/schemas/microsoft.graph.security.processEvidence'
'#microsoft.graph.security.registryKeyEvidence': '#/components/schemas/microsoft.graph.security.registryKeyEvidence'
'#microsoft.graph.security.registryValueEvidence': '#/components/schemas/microsoft.graph.security.registryValueEvidence'
'#microsoft.graph.security.sasTokenEvidence': '#/components/schemas/microsoft.graph.security.sasTokenEvidence'
'#microsoft.graph.security.securityGroupEvidence': '#/components/schemas/microsoft.graph.security.securityGroupEvidence'
'#microsoft.graph.security.servicePrincipalEvidence': '#/components/schemas/microsoft.graph.security.servicePrincipalEvidence'
'#microsoft.graph.security.submissionMailEvidence': '#/components/schemas/microsoft.graph.security.submissionMailEvidence'
'#microsoft.graph.security.teamsMessageEvidence': '#/components/schemas/microsoft.graph.security.teamsMessageEvidence'
'#microsoft.graph.security.urlEvidence': '#/components/schemas/microsoft.graph.security.urlEvidence'
'#microsoft.graph.security.userEvidence': '#/components/schemas/microsoft.graph.security.userEvidence'
microsoft.graph.alertFeedback:
title: alertFeedback
enum:
- unknown
- truePositive
- falsePositive
- benignPositive
- unknownFutureValue
type: string
microsoft.graph.alertCollectionResponse:
title: Collection of alert
type: object
allOf:
- $ref: '#/components/schemas/BaseCollectionPaginationCountResponse'
- type: object
properties:
value:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.alert'
microsoft.graph.userSecurityState:
title: userSecurityState
required:
- '@odata.type'
type: object
properties:
aadUserId:
type: string
description: AAD User object identifier (GUID) - represents the physical/multi-account user entity.
nullable: true
accountName:
type: string
description: Account name of user account (without Active Directory domain or DNS domain) - (also called mailNickName).
nullable: true
domainName:
type: string
description: NetBIOS/Active Directory domain of user account (that is, domain/account format).
nullable: true
emailRole:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.emailRole'
- type: object
nullable: true
description: 'For email-related alerts - user account''s email ''role''. The possible values are: unknown, sender, recipient.'
isVpn:
type: boolean
description: Indicates whether the user logged on through a VPN.
nullable: true
logonDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Time at which the sign-in occurred. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
format: date-time
nullable: true
logonId:
type: string
description: User sign-in ID.
nullable: true
logonIp:
type: string
description: IP Address the sign-in request originated from.
nullable: true
logonLocation:
type: string
description: Location (by IP address mapping) associated with a user sign-in event by this user.
nullable: true
logonType:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.logonType'
- type: object
nullable: true
description: 'Method of user sign in. The possible values are: unknown, interactive, remoteInteractive, network, batch, service.'
onPremisesSecurityIdentifier:
type: string
description: Active Directory (on-premises) Security Identifier (SID) of the user.
nullable: true
riskScore:
type: string
description: Provider-generated/calculated risk score of the user account. Recommended value range of 0-1, which equates to a percentage.
nullable: true
userAccountType:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.userAccountSecurityType'
- type: object
nullable: true
description: 'User account type (group membership), per Windows definition. The possible values are: unknown, standard, power, administrator.'
userPrincipalName:
type: string
description: 'User sign-in name - internet format: (user account name)@(user account DNS domain name).'
nullable: true
'@odata.type':
type: string
microsoft.graph.security.dictionary:
title: dictionary
required:
- '@odata.type'
type: object
properties:
'@odata.type':
type: string
microsoft.graph.alert:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: alert
required:
- '@odata.type'
type: object
properties:
activityGroupName:
type: string
description: Name or alias of the activity group (attacker) this alert is attributed to.
nullable: true
alertDetections:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.alertDetection'
assignedTo:
type: string
description: Name of the analyst the alert is assigned to for triage, investigation, or remediation (supports update).
nullable: true
azureSubscriptionId:
type: string
description: Azure subscription ID, present if this alert is related to an Azure resource.
nullable: true
azureTenantId:
type: string
description: Microsoft Entra tenant ID. Required.
category:
type: string
description: Category of the alert (for example, credentialTheft, ransomware).
nullable: true
closedDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Time at which the alert was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z (supports update).
format: date-time
nullable: true
cloudAppStates:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.cloudAppSecurityState'
description: Security-related stateful information generated by the provider about the cloud application/s related to this alert.
comments:
type: array
items:
type: string
nullable: true
description: Customer-provided comments on alert (for customer alert management) (supports update).
confidence:
maximum: 2147483647
minimum: -2147483648
type: number
description: Confidence of the detection logic (percentage between 1-100).
format: int32
nullable: true
createdDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Time at which the alert was created by the alert provider. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Required.
format: date-time
nullable: true
description:
type: string
description: Alert description.
nullable: true
detectionIds:
type: array
items:
type: string
nullable: true
description: Set of alerts related to this alert entity (each alert is pushed to the SIEM as a separate record).
eventDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Time at which the event or events that served as the trigger to generate the alert occurred. The Timestamp type repr
# --- truncated at 32 KB (203 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-security-alert-api-openapi.yml