Edit

alert: createAlert

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Create a Microsoft 365 Defender alert by invoking a bound action on the alerts_v2 collection and returning the created alert resource. The action accepts a createAlertInput complex type that combines alert metadata and creation-specific options in one request object.

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type Least privileged permissions Higher privileged permissions
Delegated (work or school account) SecurityAlert.Create.All SecurityAlert.ReadWrite.All
Delegated (personal Microsoft account) Not supported. Not supported.
Application SecurityAlert.Create.All SecurityAlert.ReadWrite.All

HTTP request

POST /security/alerts_v2/createAlert

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type application/json. Required.

Request body

In the request body, supply a JSON representation of the parameters.

The following table lists the parameters that are required when you call this action.

Parameter Type Description
createAlertInput microsoft.graph.security.createAlertInput Required. The input containing alert properties, incident-linking options, workspace routing, and inline entity definitions.

Response

If successful, this action returns a 201 Created response code and an alert object in the response body.

Examples

Example 1: Create an alert linked to an existing incident

Request

The following example shows a request that creates an alert and links it to incident 42.

POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json

{
  "createAlertInput": {
    "title": "Suspicious PowerShell activity",
    "severity": "medium",
    "description": "PowerShell script execution was identified during analyst triage.",
    "category": "Execution",
    "recommendedActions": "Review the script contents and isolate the affected device.",
    "mitreTechniques": ["T1059.001"],
    "linkToIncident": 42,
    "isExcludedFromCorrelation": false,
    "entityDefinitions": [
      {
        "entityType": "device",
        "entityIdentifier": "deviceId",
        "identifierValue": "d1234567-abcd-4f01-8abc-890123456789",
        "role": "impacted"
      }
    ]
  }
}

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.security.alert",
  "id": "ea2c5e5341-c60a-42fc-953f-3da427c85e2d_aml",
  "providerAlertId": "manual_ea2c5e5341-c60a-42fc-953f-3da427c85e2d",
  "incidentId": "42",
  "title": "Suspicious PowerShell activity",
  "description": "PowerShell script execution was identified during analyst triage.",
  "severity": "medium",
  "status": "new",
  "classification": "unknown",
  "determination": "unknown",
  "category": "Execution",
  "serviceSource": "microsoft365Defender",
  "detectionSource": "manual",
  "createdDateTime": "2026-07-27T11:00:00Z",
  "lastUpdateDateTime": "2026-07-27T11:00:00Z",
  "recommendedActions": "Review the script contents and isolate the affected device.",
  "mitreTechniques": ["T1059.001"],
  "alertWebUrl": "https://security.microsoft.com/alerts/ea2c5e5341-c60a-42fc-953f-3da427c85e2d_aml"
}

Example 2: Create an alert with a new incident

Request

The following example shows a request that creates an alert without specifying an incident, causing the backend to create a new incident.

POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json

{
  "createAlertInput": {
    "title": "Unauthorized access attempt",
    "severity": "high",
    "description": "Multiple failed login attempts from an unusual location.",
    "category": "InitialAccess",
    "mitreTechniques": ["T1078"],
    "isExcludedFromCorrelation": false,
    "entityDefinitions": [
      {
        "entityType": "user",
        "entityIdentifier": "userPrincipalName",
        "identifierValue": "admin@contoso.com",
        "role": "impacted"
      },
      {
        "entityType": "ip",
        "entityIdentifier": "address",
        "identifierValue": "198.51.100.42",
        "role": "related"
      }
    ]
  }
}

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.security.alert",
  "id": "bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f_aml",
  "providerAlertId": "manual_bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f",
  "incidentId": "128",
  "title": "Unauthorized access attempt",
  "severity": "high",
  "status": "new",
  "category": "InitialAccess",
  "serviceSource": "microsoft365Defender",
  "detectionSource": "manual",
  "createdDateTime": "2026-07-27T12:30:00Z",
  "lastUpdateDateTime": "2026-07-27T12:30:00Z",
  "alertWebUrl": "https://security.microsoft.com/alerts/bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f_aml"
}
  • Last updated on