Legacy and v2 List Alerts Endpoints Return Different Results When Using createdDateTime Filter

GA-4357 10

I am querying the Microsoft Graph security API for alerts created in the last 4 hrs. When I query the legacy API endpoint with:

https://graph.microsoft.com/v1.0/security/alerts?$filter=createdDateTime ge 2023-09-13T16:05:00Z

the expected alerts are returned.

However, when I query the new List alerts_v2 endpoint with:

https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=createdDateTime ge 2023-09-13T16:05:00Z

only a subset of the alerts are returned, with the IPC provider alerts notably being absent.

The List alerts_v2 documentation (https://learn.microsoft.com/en-us/graph/api/security-list-alerts_v2?view=graph-rest-1.0&tabs=http) states that createdDateTime is a supported query parameter.

We would like to use the new List alerts_v2 endpoint but cannot do so if it only returns a subset of the alerts. I did not see this issue mentioned under the "Microsoft Graph Known Issues" page (https://developer.microsoft.com/en-us/graph/known-issues/?search=).

Catherine Kyalo 665 Reputation points Microsoft Employee

2023-09-28T06:57:03.4666667+00:00

I have checked this with the Graph security API team and confirmed that security/alerts endpoint does include IPC alerts.

security/alerts_v2 schema is published by a different team and IPC alerts are not visible here.

This is still the case: -> https://techcommunity.microsoft.com/t5/microsoft-365-developer-platform/graph-api-add-support-for-change-notifications-for-alerts-v2/idi-p/3794287

I will reach out to the team and update any feedback.

https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-1.0#legacy-alerts
Catherine Kyalo 665 Reputation points Microsoft Employee

2023-09-29T06:04:13.0866667+00:00
On further consultation below are some issues you will need to be aware of before using v2 schema:

The Microsoft Graph Security API Alerts use the v1.0 endpoint of the Microsoft Graph, while the Microsoft Graph Alerts V2 Schema use the beta endpoint. This means that the Alerts V2 Schema are subject to change and may not be available in all environments1.

The Microsoft Graph Security API Alerts can be used to update alerts, such as adding tags, comments, feedback, status, and assignments. The Microsoft Graph Alerts V2 Schema can only be used to read alerts, such as listing and getting alerts by ID1 4.
JohnJackson-4955 0 Reputation points

2024-06-13T10:44:29.2966667+00:00

Is there any update on whether Alerts_V2 is still in Beta, as the documentation seems to recommend using this and not alerts but IPC alerts are still not available in the V2 which prevents us from migrating to it. Is there a date when they will be available in Alerts_V2 so we can plan our migration?

Share via

Legacy and v2 List Alerts Endpoints Return Different Results When Using createdDateTime Filter

Your answer