GraphAPI/beta/security returning incomplete information

Alan Nicolas Daroca 0

I have 26 CustomDetections in this tenant.

User's image

However, when exporting this information using the GraphAPI with the URI "https://graph.microsoft.com/beta/security/rules/detectionRules" I only get a portion of those. Trying with different iterations of $select doesn't change anything.

By default, it seems that the ones that are using schemas such as "CloudApp" or "GraphAPI" are excluded.

User's image

Has anyone encountered this issue before?

Thanks!

Nico.

Carolyne-3676 876 Reputation points

2025-12-02T10:13:34.2333333+00:00

Could it be as a result of product-specific endpoints.
I think if you need all rules in one export, you’ll probably have to call multiple endpoints (detectionRules + CloudAppSecurity) and then merge results client-side.
For CloudApp rules I believe you should be targeting this: https://graph.microsoft.com/beta/security/cloudAppSecurity/.
Alan Nicolas Daroca 0 Reputation points

2025-12-02T15:32:15.2633333+00:00
I have been checking the endpoint you mentioned, and I haven't found it.

Just to give more information:

If you create an AH like

CloudAppEvents | where ActionType has_any ('Something')

It won't be exported.

Any other that has "DeviceProcess", would be fine.

If you can point me in the direction of any docs that explain which endpoints are product specific would help me a lot, at least to know where I'm missing data.

Thanks a lot for the help so far :)

Your answer