Skip to content

security-alert-update.md

Latest commit

 

History

History
163 lines (133 loc) · 7.54 KB

security-alert-update.md

File metadata and controls

163 lines (133 loc) · 7.54 KB
title Update alert
description Update the properties of an alert object.
ms.date 11/11/2022
author BenAlfasi
ms.localizationpriority medium
ms.subservice security
doc_type apiPageType

Update alert

Namespace: microsoft.graph

Update the properties of an alert object in an organization based on the specified alert id property.

[!INCLUDE national-cloud-support]

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

[!INCLUDE permissions-table]

[!INCLUDE rbac-security-alerts-apis-write]

HTTP request

PATCH /security/alerts_v2/{alertId}

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type application/json. Required.

Request body

[!INCLUDE table-intro]

Property Type Description
status microsoft.graph.security.alertStatus The status of the alert. The possible values are: new, inProgress, resolved, unknownFutureValue.
classification microsoft.graph.security.alertClassification Specifies the classification of the alert. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
customDetails microsoft.graph.security.dictionary User defined custom fields with string values.
determination microsoft.graph.security.alertDetermination Specifies the determination of the alert. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
assignedTo String Owner of the incident, or null if no owner is assigned.

Response

If successful, this method returns a 200 OK response code and an updated alert object in the response body.

Examples

Request

The following example shows a request.

HTTP

PATCH https://graph.microsoft.com/v1.0/security/alerts_v2/da637551227677560813_-961444813
Content-Type: application/json
Content-length: 2450

{
    "assignedTo": "secAdmin@contoso.com",
    "classification": "truePositive",
    "determination": "malware",
    "status": "inProgress"
}

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-type: application/json

{
    "@odata.type": "#microsoft.graph.security.alert",
    "id": "da637551227677560813_-961444813",
    "providerAlertId": "da637551227677560813_-961444813",
    "incidentId": "28282",
    "status": "inProgress",
    "severity": "low",
    "classification": "truePositive",
    "determination": "malware",
    "serviceSource": "microsoftDefenderForEndpoint",
    "detectionSource": "antivirus",
    "detectorId": "e0da400f-affd-43ef-b1d5-afc2eb6f2756",
    "tenantId": "b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c",
    "title": "Suspicious execution of hidden file",
    "description": "A hidden file has been launched. This activity could indicate a compromised host. Attackers often hide files associated with malicious tools to evade file system inspection and defenses.",
    "recommendedActions": "Collect artifacts and determine scope\n�\tReview the machine timeline for suspicious activities that may have occurred before and after the time of the alert, and record additional related artifacts (files, IPs/URLs) \n�\tLook for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.\n�\tSubmit relevant files for deep analysis and review resulting detailed behavioral information.\n�\tSubmit undetected files to the MMPC malware portal\n\nInitiate containment & mitigation \n�\tContact the user to verify intent and initiate local remediation actions as needed.\n�\tUpdate AV signatures and run a full scan. The scan might reveal and remove previously-undetected malware components.\n�\tEnsure that the machine has the latest security updates. In particular, ensure that you have installed the latest software, web browser, and Operating System versions.\n�\tIf credential theft is suspected, reset all relevant users passwords.\n�\tBlock communication with relevant URLs or IPs at the organization�s perimeter.",
    "category": "DefenseEvasion",
    "assignedTo": "secAdmin@contoso.com",
    "alertWebUrl": "https://security.microsoft.com/alerts/da637551227677560813_-961444813?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c",
    "incidentWebUrl": "https://security.microsoft.com/incidents/28282?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c",
    "actorDisplayName": null,
    "threatDisplayName": null,
    "threatFamilyName": null,
    "mitreTechniques": [
        "T1564.001"
    ],
    "createdDateTime": "2021-04-27T12:19:27.7211305Z",
    "lastUpdateDateTime": "2021-05-02T14:19:01.3266667Z",
    "resolvedDateTime": null,
    "firstActivityDateTime": "2021-04-26T07:45:50.116Z",
    "lastActivityDateTime": "2021-05-02T07:56:58.222Z",
    "comments": [],
    "evidence": [],
    "systemTags" : []
}