alert resource type
Namespace: microsoft.graph.security
This resource corresponds to the latest generation of alerts in the Microsoft Graph security API, representing potential security issues within a customer's tenant that Microsoft 365 Defender, or a security provider integrated with Microsoft 365 Defender, has identified.
When detecting a threat, a security provider creates an alert in the system. Microsoft 365 Defender pulls this alert data from the security provider, and consumes the alert data to return valuable clues in an alert resource about any related attack, impacted assets, and associated evidence. It automatically correlates other alerts with the same attack techniques or the same attacker into an incident to provide a broader context of an attack. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats.
Note
This resource is one of the two types of alerts that the v1.0 version of the Microsoft Graph security API offers. For more information, see alerts.
Methods
Method | Return type | Description |
---|---|---|
List alerts_v2 | microsoft.graph.security.alert collection | Get a list of alert resources that have been created to track suspicious activities in an organization. |
Get alert | microsoft.graph.security.alert | Get the properties of an alert object in an organization based on the specified alert id property. |
Update alert | microsoft.graph.security.alert | Update the properties of an alert object in an organization based on the specified alert id property. |
Create comment for alert | alertComment | Create a comment for an existing alert based on the specified alert id property. |
Properties
Property | Type | Description |
---|---|---|
actorDisplayName | String | The adversary or activity group that is associated with this alert. |
alertWebUrl | String | URL for the alert page in the Microsoft 365 Defender portal. |
assignedTo | String | Owner of the alert, or null if no owner is assigned. |
category | String | The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework. |
classification | microsoft.graph.security.alertClassification | Specifies whether the alert represents a true threat. Possible values are: unknown , falsePositive , truePositive , informationalExpectedActivity , unknownFutureValue . |
comments | microsoft.graph.security.alertComment collection | Array of comments created by the Security Operations (SecOps) team during the alert management process. |
createdDateTime | DateTimeOffset | Time when Microsoft 365 Defender created the alert. |
description | String | String value describing each alert. |
detectionSource | microsoft.graph.security.detectionSource | Detection technology or sensor that identified the notable component or activity. Possible values are: unknown , microsoftDefenderForEndpoint , antivirus , smartScreen , customTi , microsoftDefenderForOffice365 , automatedInvestigation , microsoftThreatExperts , customDetection , microsoftDefenderForIdentity , cloudAppSecurity , microsoft365Defender , azureAdIdentityProtection , manual , microsoftDataLossPrevention , appGovernancePolicy , appGovernanceDetection , unknownFutureValue , microsoftDefenderForCloud . Note that you must use the Prefer: include-unknown-enum-members request header to get the following value(s) in this evolvable enum: microsoftDefenderForCloud . |
detectorId | String | The ID of the detector that triggered the alert. |
determination | microsoft.graph.security.alertDetermination | Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. Possible values are: unknown , apt , malware , securityPersonnel , securityTesting , unwantedSoftware , other , multiStagedAttack , compromisedUser , phishing , maliciousUserActivity , clean , insufficientData , confirmedUserActivity , lineOfBusinessApplication , unknownFutureValue . |
evidence | microsoft.graph.security.alertEvidence collection | Collection of evidence related to the alert. |
firstActivityDateTime | DateTimeOffset | The earliest activity associated with the alert. |
id | String | Unique identifier to represent the alert resource. |
incidentId | String | Unique identifier to represent the incident this alert resource is associated with. |
incidentWebUrl | String | URL for the incident page in the Microsoft 365 Defender portal. |
lastActivityDateTime | DateTimeOffset | The oldest activity associated with the alert. |
lastUpdateDateTime | DateTimeOffset | Time when the alert was last updated at Microsoft 365 Defender. |
mitreTechniques | Collection(Edm.String) | The attack techniques, as aligned with the MITRE ATT&CK framework. |
providerAlertId | String | The ID of the alert as it appears in the security provider product that generated the alert. |
recommendedActions | String | Recommended response and remediation actions to take in the event this alert was generated. |
resolvedDateTime | DateTimeOffset | Time when the alert was resolved. |
serviceSource | microsoft.graph.security.serviceSource | The service or product that created this alert. Possible values are: unknown , microsoftDefenderForEndpoint , microsoftDefenderForIdentity , microsoftDefenderForCloudApps , microsoftDefenderForOffice365 , microsoft365Defender , azureAdIdentityProtection , microsoftAppGovernance , dataLossPrevention , unknownFutureValue , microsoftDefenderForCloud . Note that you must use the Prefer: include-unknown-enum-members request header to get the following value(s) in this evolvable enum: microsoftDefenderForCloud . |
severity | microsoft.graph.security.alertSeverity | Indicates the possible impact on assets. The higher the severity the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are: unknown , informational , low , medium , high , unknownFutureValue . |
status | microsoft.graph.security.alertStatus | The status of the alert. Possible values are: new , inProgress , resolved , unknownFutureValue . |
tenantId | String | The Azure Active Directory tenant the alert was created in. |
threatDisplayName | String | The threat associated with this alert. |
threatFamilyName | String | Threat family associated with this alert. |
title | String | Brief identifying string value describing the alert. |
alertClassification values
Member | Description |
---|---|
unknown | The alert isn't classified yet. |
falsePositive | The alert is a false positive and didn't detect malicious activity. |
truePositive | The alert is true positive and detected malicious activity. |
informationalExpectedActivity | The alert is benign positive and detected potentially malicious activity by a trusted/internal user, for example, security testing. |
unknownFutureValue | Evolvable enumeration sentinel value. Do not use. |
alertDetermination values
Member | Description |
---|---|
unknown | No determination value was set yet. |
apt | A true positive alert that detected an advanced persistent threat. |
malware | A true positive alert that detected malicious software. |
securityPersonnel | A true positive alert that detected valid suspicious activity that was performed by someone on the customer's security team. |
securityTesting | The alert detected valid suspicious activity that was performed as part of a known security testing. |
unwantedSoftware | The alert detected unwanted software. |
multiStagedAttack | A true positive alert that detected multiple kill-chain attack stages. |
compromisedAccount | A true positive alert that detected that the intended user's credentials were compromised or stolen. |
phishing | A true positive alert that detected a phishing email. |
maliciousUserActivity | A true positive alert that detected that the logged-on user performs malicious activities. |
notMalicious | A false alert, no suspicious activity. |
notEnoughDataToValidate | A false alert, without enough information to prove otherwise. |
confirmedActivity | The alert caught a true suspicious activity that is considered OK because it is a known user activity. |
lineOfBusinessApplication | The alert caught a true suspicious activity that is considered OK because it is a known and confirmed internal application. |
other | Other determination. |
unknownFutureValue | Evolvable enumeration sentinel value. Do not use. |
alertSeverity values
Member | Description |
---|---|
unknown | Unknown severity. |
informational | Alerts that may not be actionable or considered harmful to the network but can drive organizational security awareness on potential security issues. |
low | Alerts on threats associated with prevalent malware. For example, hack-tools, non-malware hack tools, such as running exploration commands and clearing logs, that often don't indicate an advanced threat that targets the organization. It can also come from an isolated security tool that is tested by a user in your organization. |
medium | Alerts generated from detections and response post-breach behaviors that might be a part of an advanced persistent threat (APT). This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth. Although some might be due to internal security testing, they are valid detections and require investigation as they may be a part of an advanced attack. |
high | Alerts commonly seen associated with advanced persistent threats (APT). These alerts indicate a high risk because of the severity of damage they can inflict on assets. Some examples are: credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary. |
unknownFutureValue | Evolvable enumeration sentinel value. Do not use. |
alertStatus values
Member | Description |
---|---|
unknown | Unknown status. |
new | New alert. |
inProgress | The alert is in mitigation progress. |
resolved | The alert is in resolved state. |
unknownFutureValue | Evolvable enumeration sentinel value. Do not use. |
serviceSource values
Value | Description |
---|---|
unknown | Unknown service source. |
microsoftDefenderForEndpoint | Microsoft Defender for Endpoint. |
microsoftDefenderForIdentity | Microsoft Defender for Identity. |
microsoftDefenderForCloudApps | Microsoft Defender for Cloud Apps. |
microsoftDefenderForOffice365 | Microsoft Defender For Office365. |
microsoft365Defender | Microsoft 365 Defender. |
azureAdIdentityProtection | Azure Active Directory Identity Protection. |
microsoftAppGovernance | Microsoft app governance. |
dataLossPrevention | Microsoft Purview Data Loss Prevention. |
unknownFutureValue | Evolvable enumeration sentinel value. Do not use. |
microsoftDefenderForCloud | Microsoft Defender for Cloud. |
detectionSource values
Value | Description |
---|---|
unknown | Unknown detection source. |
microsoftDefenderForEndpoint | Microsoft Defender For Endpoint. |
antivirus | Antivirus software. |
smartScreen | Microsoft Defender SmartScreen. |
customTi | Custom threat intelligence. |
microsoftDefenderForOffice365 | Microsoft Defender for Office 365. |
automatedInvestigation | Automated investigation. |
microsoftThreatExperts | Microsoft Threat Experts. |
customDetection | Custom detection. |
microsoftDefenderForIdentity | Microsoft Defender for Identity. |
cloudAppSecurity | Cloud app security. |
microsoft365Defender | Microsoft 365 Defender. |
azureAdIdentityProtection | Azure Active Directory Identity Protection. |
manual | Manual detection. |
microsoftDataLossPrevention | Microsoft Purview Data Loss Prevention. |
appGovernancePolicy | App governance policy. |
appGovernanceDetection | App governance detection. |
unknownFutureValue | Evolvable enumeration sentinel value. Do not use. |
microsoftDefenderForCloud | Microsoft Defender for Cloud. |
Relationships
None.
JSON representation
The following is a JSON representation of the resource.
{
"@odata.type": "#microsoft.graph.security.alert",
"id": "String (identifier)",
"providerAlertId": "String",
"incidentId": "String",
"status": "String",
"severity": "String",
"classification": "String",
"determination": "String",
"serviceSource": "String",
"detectionSource": "String",
"detectorId": "String",
"tenantId": "String",
"title": "String",
"description": "String",
"recommendedActions": "String",
"category": "String",
"assignedTo": "String",
"alertWebUrl": "String",
"incidentWebUrl": "String",
"actorDisplayName": "String",
"threatDisplayName": "String",
"threatFamilyName": "String",
"mitreTechniques": [
"String"
],
"createdDateTime": "String (timestamp)",
"lastUpdateDateTime": "String (timestamp)",
"resolvedDateTime": "String (timestamp)",
"firstActivityDateTime": "String (timestamp)",
"lastActivityDateTime": "String (timestamp)",
"comments": [
{
"@odata.type": "microsoft.graph.security.alertComment"
}
],
"evidence": [
{
"@odata.type": "microsoft.graph.security.alertEvidence"
}
]
}
Feedback
Submit and view feedback for