Microsoft Sentinel Incident Alerts API

openapi: 3.2.0
info:
  title: Microsoft Sentinel Incident Alerts API
  version: '2025-09-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged IncidentAlerts across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: IncidentAlerts
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/alerts
  : post:
      operationId: Incidents_ListAlerts
      tags:
      - IncidentAlerts
      description: Gets all alerts for an incident.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: incidentId
        in: path
        description: Incident ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentAlertList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get all incident alerts.:
          $ref: ./examples/incidents/GetAllIncidentAlerts.json
      summary: Incidents list alerts
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
components:
  schemas:
    KillChainIntent:
      type: string
      description: The intent of the alert.
      enum:
      - Unknown
      - Probing
      - Exploitation
      - Persistence
      - PrivilegeEscalation
      - DefenseEvasion
      - CredentialAccess
      - Discovery
      - LateralMovement
      - Execution
      - Collection
      - Exfiltration
      - CommandAndControl
      - Impact
      x-ms-enum:
        name: KillChainIntent
        modelAsString: true
        values:
        - name: Unknown
          value: Unknown
          description: The default value.
        - name: Probing
          value: Probing
          description: Probing could be an attempt to access a certain resource regardless of a malicious intent or a failed attempt to gain access to a target system to gather information prior to exploitation. This step is usually detected as an attempt originating from outside the network in attempt to scan the target system and find a way in.
        - name: Exploitation
          value: Exploitation
          description: Exploitation is the stage where an attacker manage to get foothold on the attacked resource. This stage is applicable not only for compute hosts, but also for resources such as user accounts, certificates etc. Adversaries will often be able to control the resource after this stage.
        - name: Persistence
          value: Persistence
          description: Persistence is any access, action, or configuration change to a system that gives an adversary a persistent presence on that system. Adversaries will often need to maintain access to systems through interruptions such as system restarts, loss of credentials, or other failures that would require a remote access tool to restart or alternate backdoor for them to regain access.
        - name: PrivilegeEscalation
          value: PrivilegeEscalation
          description: Privilege escalation is the result of actions that allow an adversary to obtain a higher level of permissions on a system or network. Certain tools or actions require a higher level of privilege to work and are likely necessary at many points throughout an operation. User accounts with permissions to access specific systems or perform specific functions necessary for adversaries to achieve their objective may also be considered an escalation of privilege.
        - name: DefenseEvasion
          value: DefenseEvasion
          description: Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation.
        - name: CredentialAccess
          value: CredentialAccess
          description: Credential access represents techniques resulting in access to or control over system, domain, or service credentials that are used within an enterprise environment. Adversaries will likely attempt to obtain legitimate credentials from users or administrator accounts (local system administrator or domain users with administrator access) to use within the network. With sufficient access within a network, an adversary can create accounts for later use within the environment.
        - name: Discovery
          value: Discovery
          description: Discovery consists of techniques that allow the adversary to gain knowledge about the system and internal network. When adversaries gain access to a new system, they must navigate themselves to what they now have control of and what benefits operating from that system give to their current objective or overall goals during the intrusion. The operating system provides many native tools that aid in this post-compromise information-gathering phase.
        - name: LateralMovement
          value: LateralMovement
          description: Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access tool. An adversary can use lateral movement for many purposes, including remote Execution of tools, pivoting to additional systems, access to specific information or files, access to additional credentials, or to cause an effect.
        - name: Execution
          value: Execution
          description: The execution tactic represents techniques that result in execution of adversary-controlled code on a local or remote system. This tactic is often used in conjunction with lateral movement to expand access to remote systems on a network.
        - name: Collection
          value: Collection
          description: Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.
        - name: Exfiltration
          value: Exfiltration
          description: Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from a target network. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.
        - name: CommandAndControl
          value: CommandAndControl
          description: The command and control tactic represents how adversaries communicate with systems under their control within a target network.
        - name: Impact
          value: Impact
          description: The impact intent primary objective is to directly reduce the availability or integrity of a system, service, or network; including manipulation of data to impact a business or operational process. This would often refer to techniques such as ransom-ware, defacement, data manipulation and others.
    AlertSeverity:
      type: string
      description: The severity of the alert
      enum:
      - High
      - Medium
      - Low
      - Informational
      x-ms-enum:
        name: AlertSeverity
        modelAsString: true
        values:
        - name: High
          value: High
          description: High severity
        - name: Medium
          value: Medium
          description: Medium severity
        - name: Low
          value: Low
          description: Low severity
        - name: Informational
          value: Informational
          description: Informational severity
    SecurityAlertPropertiesConfidenceReasonsItem:
      type: object
      description: confidence reason item
      properties:
        reason:
          type: string
          description: The reason's description
          readOnly: true
        reasonType:
          type: string
          description: The type (category) of the reason
          readOnly: true
    AttackTactic:
      type: string
      description: The severity for alerts created by this alert rule.
      enum:
      - Reconnaissance
      - ResourceDevelopment
      - InitialAccess
      - Execution
      - Persistence
      - PrivilegeEscalation
      - DefenseEvasion
      - CredentialAccess
      - Discovery
      - LateralMovement
      - Collection
      - Exfiltration
      - CommandAndControl
      - Impact
      - PreAttack
      - ImpairProcessControl
      - InhibitResponseFunction
      x-ms-enum:
        name: AttackTactic
        modelAsString: true
        values:
        - name: Reconnaissance
          value: Reconnaissance
          description: Reconnaissance
        - name: ResourceDevelopment
          value: ResourceDevelopment
          description: ResourceDevelopment
        - name: InitialAccess
          value: InitialAccess
          description: InitialAccess
        - name: Execution
          value: Execution
          description: Execution
        - name: Persistence
          value: Persistence
          description: Persistence
        - name: PrivilegeEscalation
          value: PrivilegeEscalation
          description: PrivilegeEscalation
        - name: DefenseEvasion
          value: DefenseEvasion
          description: DefenseEvasion
        - name: CredentialAccess
          value: CredentialAccess
          description: CredentialAccess
        - name: Discovery
          value: Discovery
          description: Discovery
        - name: LateralMovement
          value: LateralMovement
          description: LateralMovement
        - name: Collection
          value: Collection
          description: Collection
        - name: Exfiltration
          value: Exfiltration
          description: Exfiltration
        - name: CommandAndControl
          value: CommandAndControl
          description: CommandAndControl
        - name: Impact
          value: Impact
          description: Impact
        - name: PreAttack
          value: PreAttack
          description: PreAttack
        - name: ImpairProcessControl
          value: ImpairProcessControl
          description: ImpairProcessControl
        - name: InhibitResponseFunction
          value: InhibitResponseFunction
          description: InhibitResponseFunction
    EntityCommonProperties:
      type: object
      description: Entity common property bag.
      properties:
        additionalData:
          type: object
          description: A bag of custom fields that should be part of the entity and will be presented to the user.
          additionalProperties: {}
          readOnly: true
        friendlyName:
          type: string
          description: The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.
          readOnly: true
    ConfidenceLevel:
      type: string
      description: The confidence level of this alert.
      enum:
      - Unknown
      - Low
      - High
      x-ms-enum:
        name: ConfidenceLevel
        modelAsString: true
        values:
        - name: Unknown
          value: Unknown
          description: Unknown confidence, the is the default value
        - name: Low
          value: Low
          description: Low confidence, meaning we have some doubts this is indeed malicious or part of an attack
        - name: High
          value: High
          description: High confidence that the alert is true positive malicious
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    ConfidenceScoreStatus:
      type: string
      description: The confidence score calculation status, i.e. indicating if score calculation is pending for this alert, not applicable or final.
      enum:
      - NotApplicable
      - InProcess
      - NotFinal
      - Final
      x-ms-enum:
        name: ConfidenceScoreStatus
        modelAsString: true
        values:
        - name: NotApplicable
          value: NotApplicable
          description: Score will not be calculated for this alert as it is not supported by virtual analyst
        - name: InProcess
          value: InProcess
          description: No score was set yet and calculation is in progress
        - name: NotFinal
          value: NotFinal
          description: Score is calculated and shown as part of the alert, but may be updated again at a later time following the processing of additional data
        - name: Final
          value: Final
          description: Final score was calculated and available
    EntityKindEnum:
      type: string
      description: The kind of the entity
      enum:
      - Account
      - Host
      - File
      - AzureResource
      - CloudApplication
      - DnsResolution
      - FileHash
      - Ip
      - Malware
      - Process
      - RegistryKey
      - RegistryValue
      - SecurityGroup
      - Url
      - IoTDevice
      - SecurityAlert
      - Bookmark
      - MailCluster
      - MailMessage
      - Mailbox
      - SubmissionMail
      x-ms-enum:
        name: EntityKindEnum
        modelAsString: true
        values:
        - name: Account
          value: Account
          description: Entity represents account in the system.
        - name: Host
          value: Host
          description: Entity represents host in the system.
        - name: File
          value: File
          description: Entity represents file in the system.
        - name: AzureResource
          value: AzureResource
          description: Entity represents azure resource in the system.
        - name: CloudApplication
          value: CloudApplication
          description: Entity represents cloud application in the system.
        - name: DnsResolution
          value: DnsResolution
          description: Entity represents dns resolution in the system.
        - name: FileHash
          value: FileHash
          description: Entity represents file hash in the system.
        - name: Ip
          value: Ip
          description: Entity represents ip in the system.
        - name: Malware
          value: Malware
          description: Entity represents malware in the system.
        - name: Process
          value: Process
          description: Entity represents process in the system.
        - name: RegistryKey
          value: RegistryKey
          description: Entity represents registry key in the system.
        - name: RegistryValue
          value: RegistryValue
          description: Entity represents registry value in the system.
        - name: SecurityGroup
          value: SecurityGroup
          description: Entity represents security group in the system.
        - name: Url
          value: Url
          description: Entity represents url in the system.
        - name: IoTDevice
          value: IoTDevice
          description: Entity represents IoT device in the system.
        - name: SecurityAlert
          value: SecurityAlert
          description: Entity represents security alert in the system.
        - name: Bookmark
          value: Bookmark
          description: Entity represents bookmark in the system.
        - name: MailCluster
          value: MailCluster
          description: Entity represents mail cluster in the system.
        - name: MailMessage
          value: MailMessage
          description: Entity represents mail message in the system.
        - name: Mailbox
          value: Mailbox
          description: Entity represents mailbox in the system.
        - name: SubmissionMail
          value: SubmissionMail
          description: Entity represents submission mail in the system.
    AlertStatus:
      type: string
      description: The lifecycle status of the alert.
      enum:
      - Unknown
      - New
      - Resolved
      - Dismissed
      - InProgress
      x-ms-enum:
        name: AlertStatus
        modelAsString: true
        values:
        - name: Unknown
          value: Unknown
          description: Unknown value
        - name: New
          value: New
          description: New alert
        - name: Resolved
          value: Resolved
          description: Alert closed after handling
        - name: Dismissed
          value: Dismissed
          description: Alert dismissed as false positive
        - name: InProgress
          value: InProgress
          description: Alert is being handled
    IncidentAlertList:
      type: object
      description: List of incident alerts.
      properties:
        value:
          type: array
          description: Array of incident alerts.
          items:
            $ref: '#/components/schemas/SecurityAlert'
          x-ms-identifiers: []
      required:
      - value
    SecurityAlert:
      type: object
      description: Represents a security alert entity.
      properties:
        properties:
          $ref: '#/components/schemas/SecurityAlertProperties'
          description: SecurityAlert entity properties
          x-ms-client-flatten: true
      allOf:
      - $ref: '#/components/schemas/Entity'
      x-ms-discriminator-value: SecurityAlert
    Entity:
      type: object
      description: Specific entity.
      properties:
        kind:
          $ref: '#/components/schemas/EntityKindEnum'
          description: Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type.  If supported, the resource provider must validate and persist this value.
      discriminator:
        propertyName: kind
      required:
      - kind
      allOf:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
    SecurityAlertProperties:
      type: object
      description: SecurityAlert entity property bag.
      properties:
        alertDisplayName:
          type: string
          description: The display name of the alert.
          readOnly: true
        alertType:
          type: string
          description: The type name of the alert.
          readOnly: true
        compromisedEntity:
          type: string
          description: Display name of the main entity being reported on.
          readOnly: true
        confidenceLevel:
          $ref: '#/components/schemas/ConfidenceLevel'
          description: The confidence level of this alert.
          readOnly: true
        confidenceReasons:
          type: array
          description: The confidence reasons
          items:
            $ref: '#/components/schemas/SecurityAlertPropertiesConfidenceReasonsItem'
          readOnly: true
          x-ms-identifiers: []
        confidenceScore:
          type: number
          format: double
          description: The confidence score of the alert.
          readOnly: true
        confidenceScoreStatus:
          $ref: '#/components/schemas/ConfidenceScoreStatus'
          description: The confidence score calculation status, i.e. indicating if score calculation is pending for this alert, not applicable or final.
          readOnly: true
        description:
          type: string
          description: Alert description.
          readOnly: true
        endTimeUtc:
          type: string
          format: date-time
          description: The impact end time of the alert (the time of the last event contributing to the alert).
          readOnly: true
        intent:
          $ref: '#/components/schemas/KillChainIntent'
          description: Holds the alert intent stage(s) mapping for this alert.
          readOnly: true
        providerAlertId:
          type: string
          description: The identifier of the alert inside the product which generated the alert.
          readOnly: true
        processingEndTime:
          type: string
          format: date-time
          description: The time the alert was made available for consumption.
          readOnly: true
        productComponentName:
          type: string
          description: The name of a component inside the product which generated the alert.
          readOnly: true
        productName:
          type: string
          description: The name of the product which published this alert.
          readOnly: true
        productVersion:
          type: string
          description: The version of the product generating the alert.
          readOnly: true
        remediationSteps:
          type: array
          description: Manual action items to take to remediate the alert.
          items:
            type: string
          readOnly: true
        severity:
          $ref: '#/components/schemas/AlertSeverity'
          description: The severity of the alert
        startTimeUtc:
          type: string
          format: date-time
          description: The impact start time of the alert (the time of the first event contributing to the alert).
          readOnly: true
        status:
          $ref: '#/components/schemas/AlertStatus'
          description: The lifecycle status of the alert.
          readOnly: true
        systemAlertId:
          type: string
          description: Holds the product identifier of the alert for the product.
          readOnly: true
        tactics:
          type: array
          description: The tactics of the alert
          items:
            $ref: '#/components/schemas/AttackTactic'
          readOnly: true
        timeGenerated:
          type: string
          format: date-time
          description: The time the alert was generated.
          readOnly: true
        vendorName:
          type: string
          description: The name of the vendor that raise the alert.
          readOnly: true
        alertLink:
          type: string
          description: The uri link of the alert.
          readOnly: true
        resourceIdentifiers:
          type: array
          description: The list of resource identifiers of the alert.
          items: {}
          readOnly: true
      allOf:
      - $ref: '#/components/schemas/EntityCommonProperties'
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml