Empty result set for security/alerts_v2 for a large number of tenants

Question

Hi there,

I am trying to query the security/alerts_v2 API endpoint for a customer, and we receive a 200 OK response, but the data set is empty.

When I send a HTTP GET to https://graph.microsoft.com/v1.0/security/alerts_v2 without any query parameters, the response we receive is:

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#security/alerts_v2","value":[]}

The response headers we receive:

{
  "Transfer-Encoding": "chunked",
  "Content-Type": "application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=false;charset=utf-8",
  "Content-Encoding": "gzip",
  "Vary": "Accept-Encoding",
  "Strict-Transport-Security": "max-age=31536000",
  "request-id": "7d773b29-d6d2-4177-b884-525c42deaabf",
  "client-request-id": "7d773b29-d6d2-4177-b884-525c42deaabf",
  "x-ms-ags-diagnostic": '{"ServerInfo":{"DataCenter":"Australia Southeast","Slice":"E","Ring":"4","ScaleUnit":"002","RoleInstance":"ML1PEPF0000BB12"}}',
  "OData-Version": "4.0",
  "Date": "Tue, 27 Jun 2023 06:30:42 GMT",
}

This endpoint is only working for about 26 of the 57 tenants that has our application installed, but we are able to query /security/secureScores for all 57 tenants without issue, using the same application.

I have confirmed the application has the required permissions.

For the sake of troubleshooting, we have re-authorised the application on a problematic tenant, but the issue still remains.

Answer 1

After checking the customer dashboard manually, I have found there are no alerts listed - it looks like this is related to a tenant specific configuration and not the graph API.