Skip to content

security-incidenttask-get.md

Latest commit

 

History

History
149 lines (118 loc) · 4.63 KB

security-incidenttask-get.md

File metadata and controls

149 lines (118 loc) · 4.63 KB
title Get incidentTask
description Read properties and relationships of an incident task in Microsoft Defender XDR.
author BenAlfasi
ms.date 05/07/2025
ms.localizationpriority medium
ms.subservice security
doc_type apiPageType

Get incidentTask

Namespace: microsoft.graph.security

[!INCLUDE beta-disclaimer]

Get the properties and relationships of a specific incident task in Microsoft Defender XDR.

[!INCLUDE national-cloud-support]

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

[!INCLUDE permissions-table]

[!INCLUDE rbac-security-alerts-apis-read]

HTTP request

GET /security/incidentTasks/{incidentTaskId}

Request headers

Name Description
Authorization Bearer {token}. Required.

Request body

Don't supply a request body for this method.

Response

If successful, this method returns a 200 OK response code and the security-incidentTask object in the response body.

Examples

Request

HTTP

GET https://graph.microsoft.com/beta/security/incidentTasks/213213

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

HTTP/1.1 200 OK
Content-type: application/json

{
    "@odata.type": "#microsoft.graph.security.incidentTask",
    "id": "213213",
    "incident": {
        "@odata.type": "#microsoft.graph.security.incident",
        "id": "123"
    },
    "status": "open",
    "source": "defenderExpertsXDR",
    "displayName": "Isolate device testmachine20",
    "description": "This action will isolate device testmachine20 from the network.",
    "createdDateTime": "2023-06-26T19:07:39.7433333Z",
    "createdByDisplayName": "Defender Experts",
    "lastModifiedDateTime": "2023-06-27T10:49:33.98Z",
    "lastModifiedByDisplayName": "bealfasi",
    "actionType": "isolateDevice",
    "actionStatus": "notStarted",
    "responseAction": {
        "@odata.type": "#microsoft.graph.security.isolateDeviceResponseAction",
        "isolationType": "full",
        "identifierValue": "02851525-dc00-438b-83f5-3b2947bf4a48"
    }
}

Related content