Skip to content

security-list-incidenttasks.md

Latest commit

 

History

History
165 lines (130 loc) · 5.44 KB

security-list-incidenttasks.md

File metadata and controls

165 lines (130 loc) · 5.44 KB
title List incidentTasks
description Get incident tasks that Microsoft Defender Experts for XDR identified for remediation.
author BenAlfasi
ms.date 05/07/2025
ms.localizationpriority medium
ms.subservice security
doc_type apiPageType

List incidentTasks

Namespace: microsoft.graph.security

[!INCLUDE beta-disclaimer]

Get incident tasks that Microsoft Defender Experts for XDR identified for remediation.

[!INCLUDE national-cloud-support]

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

[!INCLUDE permissions-table]

[!INCLUDE rbac-security-alerts-apis-read]

HTTP request

GET /security/incidentTasks

Optional query parameters

This method supports these OData query parameters to customize the response. For general information, see OData query parameters.

Parameter Type Description
$filter string Filter results by property values. Supported properties: incidentId (eq), status (eq), type (eq), lastUpdateDateTime (eq), createdDateTime (eq), actionType (eq).
$orderby string Sort results by property values. Supported property: lastUpdateDateTime.
$top integer Set the page size of results. The default page size is 500 results and the maximum is 500 results.
$select string Choose specific properties to include in results.

Request headers

Name Description
Authorization Bearer {token}. Required.

Request body

Don't supply a request body for this method.

Response

If successful, this method returns a 200 OK response code and a collection of security-incidentTask objects in the response body.

Examples

Request

HTTP

GET https://graph.microsoft.com/beta/security/incidentTasks

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

HTTP/1.1 200 OK
Content-Type: application/json

{
  "@odata.type": "collection(#microsoft.graph.security.incidentTask)",
  "value": [
    {
      "@odata.type": "#microsoft.graph.security.incidentTask",
      "id": "213213",
      "incident": {
        "@odata.type": "#microsoft.graph.security.incident",
        "id": "123"
      },
      "status": "open",
      "source": "defenderExpertsXDR",
      "displayName": "Isolate device testmachine20",
      "description": "This action will isolate device testmachine20 from the network.",
      "createdDateTime": "2023-06-26T19:07:39.7433333Z",
      "createdByDisplayName": "Defender Experts",
      "lastModifiedDateTime": "2023-06-27T10:49:33.98Z",
      "lastModifiedByDisplayName": "bealfasi",
      "actionType": "isolateDevice",
      "actionStatus": "notStarted",
      "responseAction": {
        "@odata.type": "#microsoft.graph.security.isolateDeviceResponseAction",
        "isolationType": "full",
        "identifierValue": "02851525-dc00-438b-83f5-3b2947bf4a48"
      }
    }
  ]
}