Microsoft Graph security API alerts v2

This page gives you an overview of the integration.

Microsoft Graph security

Microsoft Graph security is a unified gateway that consolidates security insights from various Microsoft products and services via version 2 of the API, also called the Alerts and incidents API. This replaces the previous legacy Alerts endpoint provided by Microsoft.

Depending on the customer's underlying Microsoft license, such as E5, we'll ingest rich alerts that have been escalated to Microsoft Graph security alerts from the following security telemetry sources:

• Microsoft Entra ID Protection
• Microsoft 365 Defender
• Microsoft Defender for Cloud Apps
• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Defender for Office 365
• Microsoft Purview Data Loss Prevention
• Microsoft Purview Insider Risk Management

What we ingest

Sample alerts we see:

• Hidden file execution detected
• An attempt to run Linux commands on a Windows App Service
• Suspicious password access
• Website tagged as malicious in the threat intelligence feed
• Detected suspicious use of the useradd command
• Possible attack tool detected
• Possible credential access tool detected

Alerts ingested in full

We ingest alerts from MS Graph security in the microsoft.graph.security namespace. For full documentation, see alert resource type.

Filtering

No filters are applied except to confirm that the format returned from the API is as expected.

Data provided by this integration

Data provided by the Microsoft 365 Graph Security API gets normalized to the following schemas:

• antivirus
• cloudAudit
• email
• thirdparty

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation

• Use Microsoft Graph security API alerts v2: Alerts and incidents
• Microsoft Graph security API alerts v2: List alerts_v2