Invoke-MgBetaCreateSecurityAlert

Module:

Microsoft.Graph.Beta.Security Module

Create a Microsoft 365 Defender alert by invoking a bound action on the alerts_v2 collection and returning the created alert resource. The action accepts a createAlertInput complex type that combines alert metadata and creation-specific options in one request object.

Syntax

CreateExpanded1 (Default)

Invoke-MgBetaCreateSecurityAlert
    [-ResponseHeadersVariable <string>]
    [-AdditionalProperties <hashtable>]
    [-CreateAlertInput <IMicrosoftGraphSecurityCreateAlertInput>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Create1

Invoke-MgBetaCreateSecurityAlert

    -BodyParameter <IPaths17Ljn1USecurityAlertsV2MicrosoftGraphSecurityCreatealertPostRequestbodyContentApplicationJsonSchema>
    [-ResponseHeadersVariable <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Parameters

-AdditionalProperties

Additional Parameters

Parameter properties

Type:	System.Collections.Hashtable
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded1

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-BodyParameter

To construct, see NOTES section for BODYPARAMETER properties and create a hash table.

Parameter properties

Type:	Microsoft.Graph.Beta.PowerShell.Models.IPaths17Ljn1USecurityAlertsV2MicrosoftGraphSecurityCreatealertPostRequestbodyContentApplicationJsonSchema
Supports wildcards:	False
DontShow:	False

Parameter sets

Create1

Position:	Named
Mandatory:	True
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Break

Wait for .NET debugger to attach

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Supports wildcards:	False
DontShow:	False
Aliases:	cf

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-CreateAlertInput

createAlertInput To construct, see NOTES section for CREATEALERTINPUT properties and create a hash table.

Parameter properties

Type:	Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSecurityCreateAlertInput
Supports wildcards:	False
DontShow:	False

Parameter sets

CreateExpanded1

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Headers

Optional headers that will be added to the request.

Parameter properties

Type:	System.Collections.IDictionary
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	True
Value from pipeline by property name:	False
Value from remaining arguments:	False

-HttpPipelineAppend

SendAsync Pipeline Steps to be appended to the front of the pipeline

Parameter properties

Type:	Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-HttpPipelinePrepend

SendAsync Pipeline Steps to be prepended to the front of the pipeline

Parameter properties

Type:	Microsoft.Graph.Beta.PowerShell.Runtime.SendAsyncStep[]
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Proxy

The URI for the proxy server to use

Parameter properties

Type:	System.Uri
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ProxyCredential

Credentials for a proxy server to use for the remote call

Parameter properties

Type:	System.Management.Automation.PSCredential
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ProxyUseDefaultCredentials

Use the default credentials for the proxy

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ResponseHeadersVariable

Optional Response Headers Variable.

Parameter properties

Type:	System.String
Supports wildcards:	False
DontShow:	False
Aliases:	RHV

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-WhatIf

Runs the command in a mode that only reports what would happen without performing the actions.

Parameter properties

Type:	System.Management.Automation.SwitchParameter
Supports wildcards:	False
DontShow:	False
Aliases:	wi

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

Microsoft.Graph.Beta.PowerShell.Models.IPaths17Ljn1USecurityAlertsV2MicrosoftGraphSecurityCreatealertPostRequestbodyContentApplicationJsonSchema

{{ Fill in the Description }}

System.Collections.IDictionary

{{ Fill in the Description }}

Outputs

Microsoft.Graph.Beta.PowerShell.Models.IMicrosoftGraphSecurityAlert

{{ Fill in the Description }}

Notes

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

BODYPARAMETER <IPaths17Ljn1USecurityAlertsV2MicrosoftGraphSecurityCreatealertPostRequestbodyContentApplicationJsonSchema>: . [(Any) <Object>]: This indicates any property can be added to this object. [CreateAlertInput <IMicrosoftGraphSecurityCreateAlertInput>]: createAlertInput [(Any) <Object>]: This indicates any property can be added to this object. [Category <String>]: MITRE ATT&CK category for the alert. [Description <String>]: Free-text explanation of the suspicious activity or policy violation. [EntityDefinitions <IMicrosoftGraphSecurityEntityDefinition[]>]: Inline entity definitions that associate entities with the alert. [EntityIdentifier <String>]: The identifier kind for the selected entity type, such as userPrincipalName, deviceId, or address. [EntityType <String>]: manualAlertEntityType [IdentifierValue <String>]: The value for the selected entity identifier. [Role <String>]: entityDefinitionInputRole [IsExcludedFromCorrelation <Boolean?>]: Whether the alert is excluded from automatic correlation. Defaults to false. [LinkToIncident <Int64?>]: Incident ID to link the alert to. Use 0 or omit the value to create a new incident. [MitreTechniques <String[]>]: MITRE ATT&CK technique identifiers associated with the alert. [RecommendedActions <String>]: Recommended remediation actions for the alert. [SentinelWorkspace <String>]: Microsoft Sentinel workspace identifier used for workspace routing. [Severity <String>]: alertSeverity [Title <String>]: Short display name shown for the alert in the Defender portal.

CREATEALERTINPUT <IMicrosoftGraphSecurityCreateAlertInput>: createAlertInput [(Any) <Object>]: This indicates any property can be added to this object. [Category <String>]: MITRE ATT&CK category for the alert. [Description <String>]: Free-text explanation of the suspicious activity or policy violation. [EntityDefinitions <IMicrosoftGraphSecurityEntityDefinition[]>]: Inline entity definitions that associate entities with the alert. [EntityIdentifier <String>]: The identifier kind for the selected entity type, such as userPrincipalName, deviceId, or address. [EntityType <String>]: manualAlertEntityType [IdentifierValue <String>]: The value for the selected entity identifier. [Role <String>]: entityDefinitionInputRole [IsExcludedFromCorrelation <Boolean?>]: Whether the alert is excluded from automatic correlation. Defaults to false. [LinkToIncident <Int64?>]: Incident ID to link the alert to. Use 0 or omit the value to create a new incident. [MitreTechniques <String[]>]: MITRE ATT&CK technique identifiers associated with the alert. [RecommendedActions <String>]: Recommended remediation actions for the alert. [SentinelWorkspace <String>]: Microsoft Sentinel workspace identifier used for workspace routing. [Severity <String>]: alertSeverity [Title <String>]: Short display name shown for the alert in the Defender portal.

Related Links

• Invoke-MgBetaCreateSecurityAlert
• Graph API Reference