Why Microsoft Sentinel alerts doesn't appear in graph api

Question

Why Microsoft Sentinel alerts doesn't appear in graph api

Jérôme 90

Hello,

I was wondering why when I query graph api to get Microsoft sentinel alerts, I can't see security alerts. is there some configuration to do ?

User's image

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-12-11T19:51:20.93+00:00

@Jérôme

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

1 answer

Your answer

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-12-11T19:51:20.93+00:00

@Jérôme

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Clive Watson 7,866 MVP Volunteer Moderator

Hello, the graph api gets data from Microsoft XDR (formally Defender 365) alerts, you need to use the Sentinel API for the ones you need.

https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0

This resource corresponds to the latest generation of alerts in the Microsoft Graph security API, representing potential security issues within a customer's tenant that Microsoft 365 Defender, or a security provider integrated with Microsoft 365 Defender, has identified.

Jérôme 90 Reputation points

2023-12-04T17:50:04.6566667+00:00

Yes I have tried to list alerts from azure sentinel with azure.management api but apparently we can only get incidents or alerts rules but not generated alerts.

https://learn.microsoft.com/en-us/rest/api/securityinsights/?view=rest-securityinsights-2023-02-01
Clive Watson 7,866 Reputation points MVP Volunteer Moderator

2023-12-04T22:14:02.5666667+00:00

Hi, Alerts in Sentinel are part/contained within Incidents (until the recent Defender XDR unification, where security.microsoft.com also lists both).

In KQL we'd look at both, to see how many Alerts were within an Incident (it maybe 1:1, but often 1 Incident and "n" Alerts):
Jérôme 90 Reputation points

2023-12-05T05:52:31.23+00:00

Thanks very much for your explanation, that's all I wanted to know.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-01-03T15:57:23.11+00:00

@Jérôme Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Share via

Why Microsoft Sentinel alerts doesn't appear in graph api

1 answer

Your answer