Create alert API

Applies to:

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.


If you are a US Government customer, please use the URIs listed in Microsoft Defender for Endpoint for US Government customers.


For better performance, you can use server closer to your geo location:


API description

Creates new Alert on top of Event.

  • Microsoft Defender for Endpoint Event is required for the alert creation.
  • You need to supply three parameters from the Event in the request: Event Time, Machine ID, and Report ID. See example below.
  • You can use an event found in Advanced Hunting API or Portal.
  • If there existing an open alert on the same Device with the same Title, the new created alert will be merged with it.
  • An automatic investigation starts automatically on alerts created via the API.


  1. Rate limitations for this API are 15 calls per minute.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Use Microsoft Defender for Endpoint APIs

Permission type Permission Permission display name
Application Alert.ReadWrite.All 'Read and write all alerts'
Delegated (work or school account) Alert.ReadWrite 'Read and write alerts'


When obtaining a token using user credentials:

  • The user needs to have at least the following role permission: 'Alerts investigation' (For more information see Create and manage roles)
  • The user needs to have access to the device associated with the alert, based on device group settings (For more information, see Create and manage device groups

Device Group creation is supported in both Defender for Endpoint Plan 1 and Plan 2

HTTP request


Request headers

Name Type Description
Authorization String Bearer {token}. Required.
Content-Type String application/json. Required.

Request body

In the request body, supply the following values (all are required):

Property Type Description
eventTime DateTime(UTC) The precise time of the event as string, as obtained from advanced hunting. e.g., 2018-08-03T16:45:21.7115183Z Required.
reportId String The reportId of the event, as obtained from advanced hunting. Required.
machineId String Id of the device on which the event was identified. Required.
severity String Severity of the alert. The property values are: 'Low', 'Medium' and 'High'. Required.
title String Title for the alert. Required.
description String Description of the alert. Required.
recommendedAction String Security officer needs to take this action when analyzing the alert. Required.
category String Category of the alert. The property values are: "General", "CommandAndControl", "Collection", "CredentialAccess", "DefenseEvasion", "Discovery", "Exfiltration", "Exploit", "Execution", "InitialAccess", "LateralMovement", "Malware", "Persistence", "PrivilegeEscalation", "Ransomware", "SuspiciousActivity" Required.


If successful, this method returns 200 OK, and a new alert object in the response body. If event with the specified properties (reportId, eventTime and machineId) was not found - 404 Not Found.



Here's an example of the request.

    "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
    "severity": "Low",
    "title": "example",
    "description": "example alert",
    "recommendedAction": "nothing",
    "eventTime": "2018-08-03T16:45:21.7115183Z",
    "reportId": "20776",
    "category": "Exploit"


Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.