Create alert comment
Action ID:tools.microsoft_graph_security.create_alert_comment
Create a comment for an existing alert based on the specified alert id property. Least privileged permission: SecurityAlert.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-alert-post-comments?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The unique identifier of the alert.
string
required
The comment to be added.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.Create audit log query
Action ID:tools.microsoft_graph_security.create_audit_log_query
Create a new auditLogQuery object. Returns 201 Created and the auditLogQuery, whose status moves from notStarted to succeeded before records can be read. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: AuditLogsQuery-Entra.Read.All for both delegated (work or school account) and application; higher privileged: AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-OneDrive.Read.All, AuditLogsQuery-SharePoint.Read.All or AuditLogsQuery.Read.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-auditcoreroot-post-auditlogqueries?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
array[string] | null
Administrative units tagged to an audit log record.Default:
null.string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. This endpoint is only available in the global service.Default: null.string | null
Display name for the saved audit log query.Default:
null.string | null
End date of the date range in the query, as an ISO 8601 timestamp, for example “2024-10-08T00:00:00Z”.Default:
null.string | null
Start date of the date range in the query, as an ISO 8601 timestamp, for example “2024-10-01T00:00:00Z”.Default:
null.array[string] | null
The IP address of the device that was used when the activity was logged.Default:
null.string | null
Free text field to search non-indexed properties of the audit log.Default:
null.array[string] | null
For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For Exchange admin audit logging, the name of the object that was modified by the cmdlet.Default:
null.array[string] | null
The name of the user or admin activity.Default:
null.array[string] | null
The operation type or types indicated by the record, for example “azureActiveDirectory”, “exchangeAdmin”, “sharePointFileOperation” or “microsoftTeams”. See the auditLogRecordType enumeration for the full list of members.Default:
null.string | null
Refers to the workload property in the audit record. This is the Microsoft service where the activity occurred.Default:
null.string | null
Current status of the query. The possible values are notStarted, running, succeeded, failed, cancelled and unknownFutureValue.Default:
null.array[string] | null
The UPN (user principal name) of the user who performed the action (specified in the operation property) that resulted in the record being logged.Default:
null.Create incident comment
Action ID:tools.microsoft_graph_security.create_incident_comment
Create a comment for an existing incident based on the specified incident id property. Least privileged permission: SecurityIncident.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Microsoft does not document national cloud availability for this endpoint. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-incident-post-comments?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The comment to be added.
string
required
The unique identifier of the incident.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.Get alert
Action ID:tools.microsoft_graph_security.get_alert
Get the properties and relationships of an alert object. Least privileged permission: SecurityAlert.Read.All for both delegated (work or school account) and application; higher privileged: SecurityAlert.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-alert-get?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The unique identifier of the alert.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.Get audit log query
Action ID:tools.microsoft_graph_security.get_audit_log_query
Read the properties and relationships of an auditLogQuery object, including its status. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: ThreatIntelligence.Read.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-auditlogquery-get?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The unique identifier of the auditLogQuery.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. This endpoint is only available in the global service.Default: null.Get incident
Action ID:tools.microsoft_graph_security.get_incident
Retrieve the properties and relationships of an incident object. Least privileged permission: SecurityIncident.Read.All for both delegated (work or school account) and application; higher privileged: SecurityIncident.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-incident-get?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The unique identifier of the incident.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.Get secure score
Action ID:tools.microsoft_graph_security.get_secure_score
Retrieve the properties and relationships of a secureScore object. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. If a status code other than 2xx or 404 is returned from a provider, or if a provider times out, Microsoft Graph responds 206 Partial Content with the provider’s response in a warning header. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/securescore-get?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The
id of the secureScore, for example “00000001-0001-0001-0001-000000000001c_2019-03-19”.string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.Get secure score control profile
Action ID:tools.microsoft_graph_security.get_secure_score_control_profile
Retrieve the properties and relationships of a secureScoreControlProfile object. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. If a status code other than 2xx or 404 is returned from a provider, or if a provider times out, Microsoft Graph responds 206 Partial Content with the provider’s response in a warning header. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/securescorecontrolprofile-get?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The
id of the secureScoreControlProfile, for example “DLPEnabled”.string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.List alerts
Action ID:tools.microsoft_graph_security.list_alerts
Get a list of alert resources created to track suspicious activities in an organization. Returns the single Microsoft Graph page, including @odata.nextLink. Least privileged permission: SecurityAlert.Read.All for both delegated (work or school account) and application; higher privileged: SecurityAlert.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-list-alerts_v2?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.boolean | null
OData
$count. Include a count of the matching resources.Default: null.string | null
OData
$filter. The following properties support $filter: assignedTo, classification, determination, createdDateTime, lastUpdateDateTime, severity, serviceSource and status.Default: null.integer | null
OData
$skip. Number of alerts to skip.Default: null.integer | null
OData
$top. Number of alerts to return.Default: null.List audit log queries
Action ID:tools.microsoft_graph_security.list_audit_log_queries
List auditLogQuery objects. Returns the single Microsoft Graph page, including @odata.nextLink. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: AuditLogsQuery-Entra.Read.All for both delegated (work or school account) and application; higher privileged: AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-OneDrive.Read.All, AuditLogsQuery-SharePoint.Read.All or AuditLogsQuery.Read.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft says this method supports unnamed OData query parameters, so this action exposes none. For other parameters, use tools.microsoft_graph_sdk.call_method with oauth_provider set to microsoft_graph_security. No separate licensing requirement is documented.
Reference: https://learn.microsoft.com/en-us/graph/api/security-auditcoreroot-list-auditlogqueries?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. This endpoint is only available in the global service.Default: null.List audit log records
Action ID:tools.microsoft_graph_security.list_audit_log_records
List auditLogRecord objects for a completed audit log query. Returns the single Microsoft Graph page, including @odata.nextLink. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: AuditLogsQuery-Entra.Read.All for both delegated (work or school account) and application; higher privileged: AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-OneDrive.Read.All, AuditLogsQuery-SharePoint.Read.All or AuditLogsQuery.Read.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft says this method supports unnamed OData query parameters, so this action exposes none. For other parameters, use tools.microsoft_graph_sdk.call_method with oauth_provider set to microsoft_graph_security. No separate licensing requirement is documented.
Reference: https://learn.microsoft.com/en-us/graph/api/security-auditlogquery-list-records?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The unique identifier of the auditLogQuery.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. This endpoint is only available in the global service.Default: null.List incidents
Action ID:tools.microsoft_graph_security.list_incidents
Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Returns the single Microsoft Graph page, including @odata.nextLink. Least privileged permission: SecurityIncident.Read.All for both delegated (work or school account) and application; higher privileged: SecurityIncident.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-list-incidents?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.boolean | null
OData
$count. Include a count of the matching resources.Default: null.string | null
OData
$expand. The alerts relationship supports $expand.Default: null.string | null
OData
$filter. The following properties support $filter: assignedTo, classification, createdDateTime, determination, lastUpdateDateTime, severity and status.Default: null.integer | null
OData
$skip. Number of incidents to skip.Default: null.integer | null
OData
$top. Number of incidents to return.Default: null.List secure score control profiles
Action ID:tools.microsoft_graph_security.list_secure_score_control_profiles
Retrieve the properties and relationships of a secureScoreControlProfiles object. Returns the single Microsoft Graph page, including @odata.nextLink. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-list-securescorecontrolprofiles?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.boolean | null
OData
$count. Include a count of the matching resources.Default: null.string | null
OData
$filter, for example “controlCategory eq ‘Identity’”.Default: null.integer | null
OData
$skip. Number of control profiles to skip.Default: null.integer | null
OData
$top. Returns the aggregated top results from each security API provider.Default: null.List secure scores
Action ID:tools.microsoft_graph_security.list_secure_scores
Retrieve a list of secureScore objects. Returns the single Microsoft Graph page, including @odata.nextLink. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-list-securescores?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.boolean | null
OData
$count. Include a count of the matching resources.Default: null.string | null
OData
$filter, for example “createdDateTime eq ‘2024-01-01’”.Default: null.integer | null
OData
$skip. Number of secure scores to skip.Default: null.integer | null
OData
$top. Returns the aggregated top results from each security API provider. Secure score data is sorted by createdDateTime from latest to earliest, and 90 days of data is held by default, so $top=n returns the most recent n days.Default: null.Merge incidents
Action ID:tools.microsoft_graph_security.merge_incidents
Merge multiple incident resources into a single incident. Least privileged permission: SecurityData.Manage.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator (least privileged for this operation) or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-incident-mergeincidents?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
array[string]
required
The IDs of the incidents to merge.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.string | null
A comment to add to the merged incident.Default:
null.string | null
The correlation reasons for merging the incidents. This object is a flags enum that allows multiple values to be specified, for example “sameCampaign, sameActor”.Default:
null.Move alerts
Action ID:tools.microsoft_graph_security.move_alerts
Move one or more alert resources to a new or existing incident. Least privileged permission: SecurityData.Manage.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator (least privileged for this operation) or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-alert-movealerts?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
array[string]
required
The IDs of the alerts to move.
string | null
A comment to add when moving the alerts.Default:
null.string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.string | null
The ID of the target incident. A request with
null creates a new incident.Default: null.string | null
The correlation reasons to associate with the move operation. This object is a flags enum that allows multiple values to be specified, for example “sameAsset, temporalProximity”.Default:
null.Run hunting query
Action ID:tools.microsoft_graph_security.run_hunting_query
Queries a specified set of event, activity, or entity data supported by Microsoft 365 Defender to proactively look for specific threats in your environment. Least privileged permission: ThreatHunting.Read.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-security-runhuntingquery?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The hunting query in Kusto Query Language (KQL).
string | null
The interval of time over which to query data, in ISO 8601 format. The default value is 30 days, meaning if no startTime is specified, the query looks back 30 days from now. If a time filter is specified in both the query and the startTime parameter, the shorter time span is applied.Default:
null.string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.string | null
The GUID of a specific Log Analytics workspace to target. If omitted, the service uses the caller’s primary workspace. If the workspace isn’t found or not accessible, the service falls back to the caller’s primary workspace.Default:
null.Update alert
Action ID:tools.microsoft_graph_security.update_alert
Update the properties of an alert object in an organization based on the specified alert id property. Least privileged permission: SecurityAlert.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-alert-update?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The unique identifier of the alert.
object
required
API-native request body. Supply only the values for properties to update. Updatable properties for PATCH /security/alerts_v2/{alertId}: status (new, inProgress, resolved, unknownFutureValue), classification (unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue), customDetails (user defined custom fields with string values), determination (unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue) and assignedTo (owner of the incident, or null if no owner is assigned).
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.Update incident
Action ID:tools.microsoft_graph_security.update_incident
Update the properties of an incident object. Least privileged permission: SecurityIncident.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft’s endpoint reference does not state a separate licensing requirement.
Reference: https://learn.microsoft.com/en-us/graph/api/security-incident-update?view=graph-rest-1.0
Secrets
Optional secrets:microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.microsoft_graph_security_oauth: OAuth tokenMICROSOFT_GRAPH_SECURITY_USER_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_SERVICE_TOKEN.microsoft_graph_oauth: OAuth tokenMICROSOFT_GRAPH_USER_TOKEN.
Input fields
string
required
The unique identifier of the incident.
object
required
API-native request body. Supply only the values for properties to update. Updatable properties for PATCH /security/incidents/{incidentId}: assignedTo (owner of the incident, or null if no owner is assigned), classification (unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue), customTags, description, determination (unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue), displayName, severity (unknown, informational, low, medium, high, unknownFutureValue), resolvingComment, status (active, resolved, redirected, unknownFutureValue) and summary.
string
Credential to use.
application requires MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN, then MICROSOFT_GRAPH_SERVICE_TOKEN; delegated requires MICROSOFT_GRAPH_SECURITY_USER_TOKEN, then MICROSOFT_GRAPH_USER_TOKEN; auto tries all four in that order.Default: "application".Allowed values: application, delegated, auto.string | null
Microsoft Graph v1.0 API root. If omitted, uses the workspace variable
microsoft_graph_security.base_url, then microsoft_graph.base_url, then https://graph.microsoft.com/v1.0. National clouds: https://graph.microsoft.us/v1.0 (US Government L4) and https://dod-graph.microsoft.us/v1.0 (US Government L5 DOD).Default: null.