| title | security resource type |
|---|---|
| description | Connects Microsoft security products, services, and partners to streamline security operations and improve threat protection, detection, and response capabilities. |
| author | angelgolfer-ms |
| ms.localizationpriority | medium |
| ms.subservice | security |
| doc_type | resourcePageType |
| ms.date | 11/03/2025 |
Namespace: microsoft.graph
[!INCLUDE beta-disclaimer]
Connects Microsoft security products, services, and partners to streamline security operations and improve threat protection, detection, and response capabilities.
| Method | Return type | Description |
|---|---|---|
| Run hunting query | microsoft.graph.security.huntingQueryResults | Queries a specified set of event, activity, or entity data supported by Microsoft 365 Defender to proactively look for specific threats in your environment. |
None.
| Relationship | Type | Description |
|---|---|---|
| alerts | alert collection | Notifications for suspicious or potential security issues in a customer's tenant. |
| alerts_v2 | microsoft.graph.security.alert collection | A collection of alerts in Microsoft 365 Defender. |
| auditLog | microsoft.graph.security.auditCoreRoot | The entry point for Microsoft Purview audit log queries and operations. |
| attackSimulation | attackSimulationRoot | Provides tenants capability to launch a simulated and realistic phishing attack and learn from it. |
| collaboration | microsoft.graph.security.collaborationRoot | Enables read and other actions on collaborative entities in Microsoft Defender. |
| identities | microsoft.graph.security.identityContainer | A container for security identities APIs. |
| incidentTasks | microsoft.graph.security.incidentTask collection | A collection of tasks associated with security incidents. |
| incidents | microsoft.graph.security.incident collection | A collection of incidents in Microsoft 365 Defender, each of which is a set of correlated alerts and associated metadata that reflects the story of an attack. |
| partner | microsoft.graph.partner.security.partnerSecurity | A container that safeguards the Microsoft Azure resources of Microsoft Cloud Solution Provider (CSP) partners' customers, including alerts, scores, and all aspects of security. |
| secureScores | secureScore collection | Measurements of tenants' security posture to help protect them from threats. |
| securityCopilot | securityCopilot collection | Represents the resources related to Microsoft Security Copilot. |
| securityactions | securityAction collection | Actions that respond to alerts to block malicious activities. |
| threatSubmission | security.threatSubmission | A threat submission sent to Microsoft; for example, a suspicious email threat, URL threat, or file threat. |
| zones | microsoft.graph.security.zone collection | A collection of cloud zones in Microsoft Defender for Cloud that group and manage cloud environments across multiple cloud providers. |
| tiIndicators (deprecated) | tiIndicator collection | Deprecated. The tiIndicator entity is deprecated and will be removed by April 2026. |
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security"
}