Filtering Security Alerts on 'Feedback' field returns an empty list

Question

When trying to identify security alerts that have a 'truePositive' feedback value, Graph API erroneously returns an empty set.

https://graph.microsoft.com/v1.0/security/alerts?$filter=feedback eq 'truePositive' results in:
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/alerts",
"value": []
}

However, when filtering to security alerts with a null value, valid results are returned. https://graph.microsoft.com/v1.0/security/alerts?$filter=feedback eq null

Other fields work with non-null values, such as category: https://graph.microsoft.com/v1.0/security/alerts?$filter=category eq 'Discovery'

Answer 1

Hi @Alex H ,

Thanks for reaching out.

I am unable to reproduce this issue. As per the documentation, I have tried to get the security alerts where the feedback = truePosstive and I am getting the expected response from graph API: GET https://graph.microsoft.com/v1.0/security/alerts?$filter=feedback eq 'truePostive'.
As you have mentioned you are getting the response for feedback eq null, can you please check whether you have the security alerts where feedback = truePositive in your tenant. You can check it by updating one of the alert's feedback=truePosstive and confirm whether you are getting it in response.

Also please refer this documentation for more details about filter query parameter for security alert.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.