Hi @Alex H ,
Thanks for reaching out.
I am unable to reproduce this issue. As per the documentation, I have tried to get the security alerts where the feedback = truePosstive and I am getting the expected response from graph API: GET https://graph.microsoft.com/v1.0/security/alerts?$filter=feedback eq 'truePostive'
.
As you have mentioned you are getting the response for feedback eq null, can you please check whether you have the security alerts where feedback = truePositive in your tenant. You can check it by updating one of the alert's feedback=truePosstive and confirm whether you are getting it in response.
Also please refer this documentation for more details about filter query parameter for security alert.
Hope this helps.
If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.