Created by Claude - please verify

Security alerts and incidents - a read-only digest. Triage and close them in the Microsoft Defender portal.

Required Microsoft Graph permissions

SecurityIncident.Read.All SecurityAlert.Read.All — application permissions, granted to the app registration with admin consent.

Licence: A Microsoft Defender product (Defender for Endpoint / Office 365 / Identity / Cloud Apps, Microsoft 365 E5 or Business Premium). Without one there is nothing to report.

Endpoints: GET /v1.0/security/incidents · GET /v1.0/security/alerts_v2

Last 30 days. Uses the alerts_v2 endpoint; the legacy /security/alerts API is being retired.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Security Alerts & Incidents

What Microsoft Defender flagged in the last 30 days, what is still open, and what nobody has picked up. Every row links to the incident or alert in the Defender portal.

Microsoft Defender raised no incidents or alerts in the last 30 days.