Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions. This method updates any solution that has a record of the referenced alert ID.
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
Permission type
Least privileged permissions
Higher privileged permissions
Delegated (work or school account)
SecurityEvents.ReadWrite.All
Not available.
Delegated (personal Microsoft account)
Not supported.
Not supported.
Application
SecurityEvents.ReadWrite.All
Not available.
HTTP request
Note: You must include the alert ID as a parameter and vendorInformation containing the provider and vendor with this method.
PATCH /security/alerts/{alert_id}
Request headers
Name
Description
Authorization
Bearer {code}. Required.
Prefer
return=representation. Optional.
Request body
In the request body, supply a JSON representation of the values for relevant fields that should be updated. The body must contain the vendorInformation property with valid provider and vendor fields. The following table lists the fields that can be updated for an alert. The values for existing properties that are not included in the request body will not change. For best performance, don't include existing values that haven't changed.
Property
Type
Description
assignedTo
String
Name of the analyst the alert is assigned to for triage, investigation, or remediation.
closedDateTime
DateTimeOffset
Time at which the alert was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
comments
String collection
Analyst comments on the alert (for customer alert management). This method can update the comments field with the following values only: Closed in IPC, Closed in MCAS.
feedback
alertFeedback
Analyst feedback on the alert. Possible values are: unknown, truePositive, falsePositive, benignPositive.
status
alertStatus
Alert life cycle status (stage). Possible values are: unknown, newAlert, inProgress, resolved.
tags
String collection
User-definable labels that can be applied to an alert and can serve as filter conditions (for example, "HVA", "SAW".
Complex type that contains details about the security product/service vendor, provider, and subprovider (for example, vendor=Microsoft; provider=Windows Defender ATP; subProvider=AppLocker). Provider and vendor fields are required.
Response
If successful, this method returns a 204 No Content response code.
If the optional request header is used, the method returns a 200 OK response code and an updated alert object in the response body.
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Models;
var requestBody = new Alert
{
AssignedTo = "String",
ClosedDateTime = DateTimeOffset.Parse("String (timestamp)"),
Comments = new List<string>
{
"String",
},
Feedback = AlertFeedback.Unknown,
Status = AlertStatus.Unknown,
Tags = new List<string>
{
"String",
},
VendorInformation = new SecurityVendorInformation
{
Provider = "String",
Vendor = "String",
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts["{alert-id}"].PatchAsync(requestBody);
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Alert alert = new Alert();
alert.setAssignedTo("String");
OffsetDateTime closedDateTime = OffsetDateTime.parse("String (timestamp)");
alert.setClosedDateTime(closedDateTime);
LinkedList<String> comments = new LinkedList<String>();
comments.add("String");
alert.setComments(comments);
alert.setFeedback(AlertFeedback.Unknown);
alert.setStatus(AlertStatus.Unknown);
LinkedList<String> tags = new LinkedList<String>();
tags.add("String");
alert.setTags(tags);
SecurityVendorInformation vendorInformation = new SecurityVendorInformation();
vendorInformation.setProvider("String");
vendorInformation.setVendor("String");
alert.setVendorInformation(vendorInformation);
Alert result = graphClient.security().alerts().byAlertId("{alert-id}").patch(alert);
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.alert import Alert
from msgraph.generated.models.alert_feedback import AlertFeedback
from msgraph.generated.models.alert_status import AlertStatus
from msgraph.generated.models.security_vendor_information import SecurityVendorInformation
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Alert(
assigned_to = "String",
closed_date_time = "String (timestamp)",
comments = [
"String",
],
feedback = AlertFeedback.Unknown,
status = AlertStatus.Unknown,
tags = [
"String",
],
vendor_information = SecurityVendorInformation(
provider = "String",
vendor = "String",
),
)
result = await graph_client.security.alerts.by_alert_id('alert-id').patch(request_body)
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Models;
var requestBody = new Alert
{
AssignedTo = "String",
ClosedDateTime = DateTimeOffset.Parse("String (timestamp)"),
Comments = new List<string>
{
"String",
},
Feedback = AlertFeedback.Unknown,
Status = AlertStatus.Unknown,
Tags = new List<string>
{
"String",
},
VendorInformation = new SecurityVendorInformation
{
Provider = "String",
Vendor = "String",
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts["{alert-id}"].PatchAsync(requestBody, (requestConfiguration) =>
{
requestConfiguration.Headers.Add("Prefer", "return=representation");
});
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Alert alert = new Alert();
alert.setAssignedTo("String");
OffsetDateTime closedDateTime = OffsetDateTime.parse("String (timestamp)");
alert.setClosedDateTime(closedDateTime);
LinkedList<String> comments = new LinkedList<String>();
comments.add("String");
alert.setComments(comments);
alert.setFeedback(AlertFeedback.Unknown);
alert.setStatus(AlertStatus.Unknown);
LinkedList<String> tags = new LinkedList<String>();
tags.add("String");
alert.setTags(tags);
SecurityVendorInformation vendorInformation = new SecurityVendorInformation();
vendorInformation.setProvider("String");
vendorInformation.setVendor("String");
alert.setVendorInformation(vendorInformation);
Alert result = graphClient.security().alerts().byAlertId("{alert-id}").patch(alert, requestConfiguration -> {
requestConfiguration.headers.add("Prefer", "return=representation");
});
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.security.alerts.item.alert_item_request_builder import AlertItemRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
from msgraph.generated.models.alert import Alert
from msgraph.generated.models.alert_feedback import AlertFeedback
from msgraph.generated.models.alert_status import AlertStatus
from msgraph.generated.models.security_vendor_information import SecurityVendorInformation
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Alert(
assigned_to = "String",
closed_date_time = "String (timestamp)",
comments = [
"String",
],
feedback = AlertFeedback.Unknown,
status = AlertStatus.Unknown,
tags = [
"String",
],
vendor_information = SecurityVendorInformation(
provider = "String",
vendor = "String",
),
)
request_configuration = RequestConfiguration()
request_configuration.headers.add("Prefer", "return=representation")
result = await graph_client.security.alerts.by_alert_id('alert-id').patch(request_body, request_configuration = request_configuration)