ResourceNotFound for defender for Identity incidents

Question

Hi, we are trying to get Defender for Identity incidents using this:

curl -X GET https://api.security.microsoft.com/api/incidents/{} -H "Accept: application/json" -H "Authorization: Bearer <>" -H "Content-Type: application/json" --noproxy "*"

but we are getting this error:

{"error": {"code": "ResourceNotFound", "message": "Incident {} was not found"}

Although the incident ID exists in the MS portal, what should we do?

Answer 1

Hello itay4,

To get the list of all incidents try and run this request: https://api.security.microsoft.com/api/incidents. This should give you all the incidents in your tenant and the associated alerts.

To get the specific incident try running this request: https://api.security.microsoft.com/api/incidents/{incidentId}?tid={tenantId}. Replace the incidentId with the relevant Id and the tenantId with your tenantId.

I hope this helps answer your question.