How can i get forensic data (match count, purview DLP policy name, rule matched, etc) for alerts

Question

https://learn.microsoft.com/en-us/graph/api/security-alert-get?view=graph-rest-1.0&tabs=http

How can we get forensic data related to the incidents or alerts with graph API ?

the response does not include purview DLP related data like Policy name, number of matches against the policy, action status (blocked, quarantined, allowed).

For example, i have a purview policy that looks for a keyword in Exchange Online. it then creates the related alerts and thier incident. When i call
GET https://graph.microsoft.com/v1.0/security/incidents?$expand=alerts

the response does not have this option.

The Q&A assist solution returns could not find a property named 'incidentStates' on microsoft.graph.alerts

Answer 1

To get forensic data related to incidents or alerts with Graph API, you can use the security/alerts endpoint and include the $expand query parameter to include additional information about the alert. The response will include the policy name, rule matched, and action status. Here's an example request:

GET https://graph.microsoft.com/v1.0/security/alerts?$expand=incidentStates($expand=additionalData)

The additionalData property in the incidentStates object will contain the forensic data you're looking for. Note that this endpoint will only return alerts that have not been resolved. To get resolved alerts, you can use the security/alerts?$filter=status eq 'resolved' endpoint.

---

References:

• Microsoft Graph security API overview - Learn
• Get started with the data loss prevention Alerts dashboard - Learn