Trying to pull events related to Action center in 365 defender using the microsoft graph API. Can you tell me what url i should be using

Question

Trying to pull events related to Action center in 365 defender using the microsoft graph API. Can you tell me what url i should be using

Jaynil 0

I am trying to create a playbook to send an email whenever there is a pending action in the Action Center of 365 Defender. However, I am unable to find the correct URL to use with the Microsoft Graph API. Can you provide the URL that allows me to retrieve the required information using Microsoft Graph API? Additionally, I have attached two images that show my current problem.

User's image

Fiona Matu 91 Reputation points Microsoft Employee

2024-01-23T07:05:44.64+00:00
Hi Jaynil, you can use the List alerts_v2 API with the following URL:

GET /security/alerts_v2

This will return a list of alert resources in your environment. You can filter out against specific status of alerts that you want emails to be generated for as shown in the example URL:

https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=status eq 'new'

Documentation on this API can be found here

Your answer

Fiona Matu 91 Reputation points Microsoft Employee

2024-01-23T07:05:44.64+00:00

Hi Jaynil, you can use the List alerts_v2 API with the following URL:

GET /security/alerts_v2

This will return a list of alert resources in your environment. You can filter out against specific status of alerts that you want emails to be generated for as shown in the example URL:

https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=status eq 'new'

Documentation on this API can be found here

Share via

Trying to pull events related to Action center in 365 defender using the microsoft graph API. Can you tell me what url i should be using

Your answer