Get alert
Namespace: microsoft.graph
Retrieve the properties and relationships of an alert object.
Permissions
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.
Permission type | Permissions (from least to most privileged) |
---|---|
Delegated (work or school account) | SecurityEvents.Read.All, SecurityEvents.ReadWrite.All |
Delegated (personal Microsoft account) | Not supported. |
Application | SecurityEvents.Read.All, SecurityEvents.ReadWrite.All |
HTTP request
GET /security/alerts/{alert_id}
Request headers
Name | Description |
---|---|
Authorization | Bearer {code}. Required. |
Request body
Do not supply a request body for this method.
Response
If successful, this method returns a 200 OK
response code and an alert object in the response body. If a status code other than 2xx or 404 is returned from a provider or if a provider times out, the response will be a 206 Partial Content
status code with the provider's response in a warning header. For more information, see Microsoft Graph Security API error responses.
Example
Request
The following is an example of the request.
Response
The following is an example of the response.
HTTP/1.1 200 OK
Content-type: application/json
{
"activityGroupName": "String",
"assignedTo": "String",
"azureSubscriptionId": "String",
"azureTenantId": "String",
"category": "String",
"closedDateTime": "String (timestamp)",
"cloudAppStates": [
{
"destinationServiceIp": "String",
"destinationServiceName": "String",
"riskScore": "String"
}
],
"comments": ["String"],
"confidence": 1024,
"createdDateTime": "String (timestamp)",
"description": "String",
"detectionIds": ["String"],
"eventDateTime": "String (timestamp)",
"feedback": "@odata.type: microsoft.graph.alertFeedback",
"fileStates": [
{
"fileHash": {
"hashType": "@odata.type: microsoft.graph.fileHashType",
"hashValue": "String"
},
"name": "String",
"path": "String",
"riskScore": "String"
}
],
"hostStates": [
{
"fqdn": "String",
"isAzureAadJoined": true,
"isAzureAadRegistered": true,
"isHybridAzureDomainJoined": true,
"netBiosName": "String",
"os": "String",
"privateIpAddress": "String",
"publicIpAddress": "String",
"riskScore": "String"
}
],
"id": "String (identifier)",
"incidentIds": ["String"],
"lastModifiedDateTime": "String (timestamp)",
"malwareStates": [
{
"category": "String",
"family": "String",
"name": "String",
"severity": "String",
"wasRunning": true
}
],
"networkConnections": [
{
"applicationName": "String",
"destinationAddress": "String",
"destinationDomain": "String",
"destinationLocation": "String",
"destinationPort": "String",
"destinationUrl": "String",
"direction": "@odata.type: microsoft.graph.connectionDirection",
"domainRegisteredDateTime": "String (timestamp)",
"localDnsName": "String",
"natDestinationAddress": "String",
"natDestinationPort": "String",
"natSourceAddress": "String",
"natSourcePort": "String",
"protocol": "@odata.type: microsoft.graph.securityNetworkProtocol",
"riskScore": "String",
"sourceAddress": "String",
"sourceLocation": "String",
"sourcePort": "String",
"status": "@odata.type: microsoft.graph.connectionStatus",
"urlParameters": "String"
}
],
"processes": [
{
"accountName": "String",
"commandLine": "String",
"createdDateTime": "String (timestamp)",
"fileHash": {
"hashType": "@odata.type: microsoft.graph.fileHashType",
"hashValue": "String"
},
"integrityLevel": "@odata.type: microsoft.graph.processIntegrityLevel",
"isElevated": true,
"name": "String",
"parentProcessCreatedDateTime": "String (timestamp)",
"parentProcessId": 1024,
"parentProcessName": "String",
"path": "String",
"processId": 1024
}
],
"recommendedActions": ["String"],
"registryKeyStates": [
{
"hive": "@odata.type: microsoft.graph.registryHive",
"key": "String",
"oldKey": "String",
"oldValueData": "String",
"oldValueName": "String",
"operation": "@odata.type: microsoft.graph.registryOperation",
"processId": 1024,
"valueData": "String",
"valueName": "String",
"valueType": "@odata.type: microsoft.graph.registryValueType"
}
],
"securityResources": [
{
"resource": "String",
"resourceType": "@odata.type: microsoft.graph.securityResourceType"
}
],
"severity": "@odata.type: microsoft.graph.alertSeverity",
"sourceMaterials": ["String"],
"status": "@odata.type: microsoft.graph.alertStatus",
"tags": ["String"],
"title": "String",
"triggers": [
{
"name": "String",
"type": "String",
"value": "String"
}
],
"userStates": [
{
"aadUserId": "String",
"accountName": "String",
"domainName": "String",
"emailRole": "@odata.type: microsoft.graph.emailRole",
"isVpn": true,
"logonDateTime": "String (timestamp)",
"logonId": "String",
"logonIp": "String",
"logonLocation": "String",
"logonType": "@odata.type: microsoft.graph.logonType",
"onPremisesSecurityIdentifier": "String",
"riskScore": "String",
"userAccountType": "@odata.type: microsoft.graph.userAccountSecurityType",
"userPrincipalName": "String"
}
],
"vendorInformation": {
"provider": "String",
"providerVersion": "String",
"subProvider": "String",
"vendor": "String"
},
"vulnerabilityStates": [
{
"cve": "String",
"severity": "String",
"wasRunning": true
}
]
}
Feedback
Submit and view feedback for