Warnung: CreateAlert

POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json

{
  "createAlertInput": {
    "title": "Suspicious PowerShell activity",
    "severity": "medium",
    "description": "PowerShell script execution was identified during analyst triage.",
    "category": "Execution",
    "recommendedActions": "Review the script contents and isolate the affected device.",
    "mitreTechniques": ["T1059.001"],
    "linkToIncident": 42,
    "isExcludedFromCorrelation": false,
    "entityDefinitions": [
      {
        "entityType": "device",
        "entityIdentifier": "deviceId",
        "identifierValue": "d1234567-abcd-4f01-8abc-890123456789",
        "role": "impacted"
      }
    ]
  }
}

// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Beta.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert;
using Microsoft.Graph.Beta.Models.Security;

var requestBody = new CreateAlertPostRequestBody
{
	CreateAlertInput = new CreateAlertInput
	{
		Title = "Suspicious PowerShell activity",
		Severity = AlertSeverity.Medium,
		Description = "PowerShell script execution was identified during analyst triage.",
		Category = "Execution",
		RecommendedActions = "Review the script contents and isolate the affected device.",
		MitreTechniques = new List<string>
		{
			"T1059.001",
		},
		LinkToIncident = 42L,
		IsExcludedFromCorrelation = false,
		EntityDefinitions = new List<EntityDefinition>
		{
			new EntityDefinition
			{
				EntityType = ManualAlertEntityType.Device,
				EntityIdentifier = "deviceId",
				IdentifierValue = "d1234567-abcd-4f01-8abc-890123456789",
				Role = EntityDefinitionInputRole.Impacted,
			},
		},
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert.PostAsync(requestBody);

// Code snippets are only available for the latest major version. Current major version is $v0.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
	  graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
	  graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
	  //other-imports
)

requestBody := graphsecurity.NewCreateAlertPostRequestBody()
createAlertInput := graphmodelssecurity.NewCreateAlertInput()
title := "Suspicious PowerShell activity"
createAlertInput.SetTitle(&title) 
severity := graphmodels.MEDIUM_ALERTSEVERITY 
createAlertInput.SetSeverity(&severity) 
description := "PowerShell script execution was identified during analyst triage."
createAlertInput.SetDescription(&description) 
category := "Execution"
createAlertInput.SetCategory(&category) 
recommendedActions := "Review the script contents and isolate the affected device."
createAlertInput.SetRecommendedActions(&recommendedActions) 
mitreTechniques := []string {
	"T1059.001",
}
createAlertInput.SetMitreTechniques(mitreTechniques)
linkToIncident := int64(42)
createAlertInput.SetLinkToIncident(&linkToIncident) 
isExcludedFromCorrelation := false
createAlertInput.SetIsExcludedFromCorrelation(&isExcludedFromCorrelation) 


entityDefinition := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.DEVICE_MANUALALERTENTITYTYPE 
entityDefinition.SetEntityType(&entityType) 
entityIdentifier := "deviceId"
entityDefinition.SetEntityIdentifier(&entityIdentifier) 
identifierValue := "d1234567-abcd-4f01-8abc-890123456789"
entityDefinition.SetIdentifierValue(&identifierValue) 
role := graphmodels.IMPACTED_ENTITYDEFINITIONINPUTROLE 
entityDefinition.SetRole(&role) 

entityDefinitions := []graphmodelssecurity.EntityDefinitionable {
	entityDefinition,
}
createAlertInput.SetEntityDefinitions(entityDefinitions)
requestBody.SetCreateAlertInput(createAlertInput)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
microsoftGraphSecurityCreateAlert, err := graphClient.Security().Alerts_v2().MicrosoftGraphSecurityCreateAlert().Post(context.Background(), requestBody, nil)

// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody createAlertPostRequestBody = new com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody();
com.microsoft.graph.beta.models.security.CreateAlertInput createAlertInput = new com.microsoft.graph.beta.models.security.CreateAlertInput();
createAlertInput.setTitle("Suspicious PowerShell activity");
createAlertInput.setSeverity(com.microsoft.graph.beta.models.security.AlertSeverity.Medium);
createAlertInput.setDescription("PowerShell script execution was identified during analyst triage.");
createAlertInput.setCategory("Execution");
createAlertInput.setRecommendedActions("Review the script contents and isolate the affected device.");
LinkedList<String> mitreTechniques = new LinkedList<String>();
mitreTechniques.add("T1059.001");
createAlertInput.setMitreTechniques(mitreTechniques);
createAlertInput.setLinkToIncident(42L);
createAlertInput.setIsExcludedFromCorrelation(false);
LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition> entityDefinitions = new LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition>();
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.Device);
entityDefinition.setEntityIdentifier("deviceId");
entityDefinition.setIdentifierValue("d1234567-abcd-4f01-8abc-890123456789");
entityDefinition.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Impacted);
entityDefinitions.add(entityDefinition);
createAlertInput.setEntityDefinitions(entityDefinitions);
createAlertPostRequestBody.setCreateAlertInput(createAlertInput);
var result = graphClient.security().alertsV2().microsoftGraphSecurityCreateAlert().post(createAlertPostRequestBody);

const options = {
	authProvider,
};

const client = Client.init(options);

const alert = {
  createAlertInput: {
    title: 'Suspicious PowerShell activity',
    severity: 'medium',
    description: 'PowerShell script execution was identified during analyst triage.',
    category: 'Execution',
    recommendedActions: 'Review the script contents and isolate the affected device.',
    mitreTechniques: ['T1059.001'],
    linkToIncident: 42,
    isExcludedFromCorrelation: false,
    entityDefinitions: [
      {
        entityType: 'device',
        entityIdentifier: 'deviceId',
        identifierValue: 'd1234567-abcd-4f01-8abc-890123456789',
        role: 'impacted'
      }
    ]
  }
};

await client.api('/security/alerts_v2/createAlert')
	.version('beta')
	.post(alert);

<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Alerts_v2\MicrosoftGraphSecurityCreateAlert\CreateAlertPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\CreateAlertInput;
use Microsoft\Graph\Beta\Generated\Models\Security\AlertSeverity;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinition;
use Microsoft\Graph\Beta\Generated\Models\Security\ManualAlertEntityType;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinitionInputRole;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new CreateAlertPostRequestBody();
$createAlertInput = new CreateAlertInput();
$createAlertInput->setTitle('Suspicious PowerShell activity');
$createAlertInput->setSeverity(new AlertSeverity('medium'));
$createAlertInput->setDescription('PowerShell script execution was identified during analyst triage.');
$createAlertInput->setCategory('Execution');
$createAlertInput->setRecommendedActions('Review the script contents and isolate the affected device.');
$createAlertInput->setMitreTechniques(['T1059.001', 	]);
$createAlertInput->setLinkToIncident(42);
$createAlertInput->setIsExcludedFromCorrelation(false);
$entityDefinitionsEntityDefinition1 = new EntityDefinition();
$entityDefinitionsEntityDefinition1->setEntityType(new ManualAlertEntityType('device'));
$entityDefinitionsEntityDefinition1->setEntityIdentifier('deviceId');
$entityDefinitionsEntityDefinition1->setIdentifierValue('d1234567-abcd-4f01-8abc-890123456789');
$entityDefinitionsEntityDefinition1->setRole(new EntityDefinitionInputRole('impacted'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition1;
$createAlertInput->setEntityDefinitions($entityDefinitionsArray);

$requestBody->setCreateAlertInput($createAlertInput);

$result = $graphServiceClient->security()->alerts_v2()->microsoftGraphSecurityCreateAlert()->post($requestBody)->wait();

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.alerts_v2.microsoft_graph_security_create_alert.create_alert_post_request_body import CreateAlertPostRequestBody
from msgraph_beta.generated.models.security.create_alert_input import CreateAlertInput
from msgraph_beta.generated.models.alert_severity import AlertSeverity
from msgraph_beta.generated.models.security.entity_definition import EntityDefinition
from msgraph_beta.generated.models.manual_alert_entity_type import ManualAlertEntityType
from msgraph_beta.generated.models.entity_definition_input_role import EntityDefinitionInputRole
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CreateAlertPostRequestBody(
	create_alert_input = CreateAlertInput(
		title = "Suspicious PowerShell activity",
		severity = AlertSeverity.Medium,
		description = "PowerShell script execution was identified during analyst triage.",
		category = "Execution",
		recommended_actions = "Review the script contents and isolate the affected device.",
		mitre_techniques = [
			"T1059.001",
		],
		link_to_incident = 42,
		is_excluded_from_correlation = False,
		entity_definitions = [
			EntityDefinition(
				entity_type = ManualAlertEntityType.Device,
				entity_identifier = "deviceId",
				identifier_value = "d1234567-abcd-4f01-8abc-890123456789",
				role = EntityDefinitionInputRole.Impacted,
			),
		],
	),
)

result = await graph_client.security.alerts_v2.microsoft_graph_security_create_alert.post(request_body)

POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json

{
  "createAlertInput": {
    "title": "Unauthorized access attempt",
    "severity": "high",
    "description": "Multiple failed login attempts from an unusual location.",
    "category": "InitialAccess",
    "mitreTechniques": ["T1078"],
    "isExcludedFromCorrelation": false,
    "entityDefinitions": [
      {
        "entityType": "user",
        "entityIdentifier": "userPrincipalName",
        "identifierValue": "admin@contoso.com",
        "role": "impacted"
      },
      {
        "entityType": "ip",
        "entityIdentifier": "address",
        "identifierValue": "198.51.100.42",
        "role": "related"
      }
    ]
  }
}

// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Beta.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert;
using Microsoft.Graph.Beta.Models.Security;

var requestBody = new CreateAlertPostRequestBody
{
	CreateAlertInput = new CreateAlertInput
	{
		Title = "Unauthorized access attempt",
		Severity = AlertSeverity.High,
		Description = "Multiple failed login attempts from an unusual location.",
		Category = "InitialAccess",
		MitreTechniques = new List<string>
		{
			"T1078",
		},
		IsExcludedFromCorrelation = false,
		EntityDefinitions = new List<EntityDefinition>
		{
			new EntityDefinition
			{
				EntityType = ManualAlertEntityType.User,
				EntityIdentifier = "userPrincipalName",
				IdentifierValue = "admin@contoso.com",
				Role = EntityDefinitionInputRole.Impacted,
			},
			new EntityDefinition
			{
				EntityType = ManualAlertEntityType.Ip,
				EntityIdentifier = "address",
				IdentifierValue = "198.51.100.42",
				Role = EntityDefinitionInputRole.Related,
			},
		},
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert.PostAsync(requestBody);

// Code snippets are only available for the latest major version. Current major version is $v0.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
	  graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
	  graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
	  //other-imports
)

requestBody := graphsecurity.NewCreateAlertPostRequestBody()
createAlertInput := graphmodelssecurity.NewCreateAlertInput()
title := "Unauthorized access attempt"
createAlertInput.SetTitle(&title) 
severity := graphmodels.HIGH_ALERTSEVERITY 
createAlertInput.SetSeverity(&severity) 
description := "Multiple failed login attempts from an unusual location."
createAlertInput.SetDescription(&description) 
category := "InitialAccess"
createAlertInput.SetCategory(&category) 
mitreTechniques := []string {
	"T1078",
}
createAlertInput.SetMitreTechniques(mitreTechniques)
isExcludedFromCorrelation := false
createAlertInput.SetIsExcludedFromCorrelation(&isExcludedFromCorrelation) 


entityDefinition := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.USER_MANUALALERTENTITYTYPE 
entityDefinition.SetEntityType(&entityType) 
entityIdentifier := "userPrincipalName"
entityDefinition.SetEntityIdentifier(&entityIdentifier) 
identifierValue := "admin@contoso.com"
entityDefinition.SetIdentifierValue(&identifierValue) 
role := graphmodels.IMPACTED_ENTITYDEFINITIONINPUTROLE 
entityDefinition.SetRole(&role) 
entityDefinition1 := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.IP_MANUALALERTENTITYTYPE 
entityDefinition1.SetEntityType(&entityType) 
entityIdentifier := "address"
entityDefinition1.SetEntityIdentifier(&entityIdentifier) 
identifierValue := "198.51.100.42"
entityDefinition1.SetIdentifierValue(&identifierValue) 
role := graphmodels.RELATED_ENTITYDEFINITIONINPUTROLE 
entityDefinition1.SetRole(&role) 

entityDefinitions := []graphmodelssecurity.EntityDefinitionable {
	entityDefinition,
	entityDefinition1,
}
createAlertInput.SetEntityDefinitions(entityDefinitions)
requestBody.SetCreateAlertInput(createAlertInput)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
microsoftGraphSecurityCreateAlert, err := graphClient.Security().Alerts_v2().MicrosoftGraphSecurityCreateAlert().Post(context.Background(), requestBody, nil)

// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody createAlertPostRequestBody = new com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody();
com.microsoft.graph.beta.models.security.CreateAlertInput createAlertInput = new com.microsoft.graph.beta.models.security.CreateAlertInput();
createAlertInput.setTitle("Unauthorized access attempt");
createAlertInput.setSeverity(com.microsoft.graph.beta.models.security.AlertSeverity.High);
createAlertInput.setDescription("Multiple failed login attempts from an unusual location.");
createAlertInput.setCategory("InitialAccess");
LinkedList<String> mitreTechniques = new LinkedList<String>();
mitreTechniques.add("T1078");
createAlertInput.setMitreTechniques(mitreTechniques);
createAlertInput.setIsExcludedFromCorrelation(false);
LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition> entityDefinitions = new LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition>();
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.User);
entityDefinition.setEntityIdentifier("userPrincipalName");
entityDefinition.setIdentifierValue("admin@contoso.com");
entityDefinition.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Impacted);
entityDefinitions.add(entityDefinition);
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition1 = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition1.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.Ip);
entityDefinition1.setEntityIdentifier("address");
entityDefinition1.setIdentifierValue("198.51.100.42");
entityDefinition1.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Related);
entityDefinitions.add(entityDefinition1);
createAlertInput.setEntityDefinitions(entityDefinitions);
createAlertPostRequestBody.setCreateAlertInput(createAlertInput);
var result = graphClient.security().alertsV2().microsoftGraphSecurityCreateAlert().post(createAlertPostRequestBody);

const options = {
	authProvider,
};

const client = Client.init(options);

const alert = {
  createAlertInput: {
    title: 'Unauthorized access attempt',
    severity: 'high',
    description: 'Multiple failed login attempts from an unusual location.',
    category: 'InitialAccess',
    mitreTechniques: ['T1078'],
    isExcludedFromCorrelation: false,
    entityDefinitions: [
      {
        entityType: 'user',
        entityIdentifier: 'userPrincipalName',
        identifierValue: 'admin@contoso.com',
        role: 'impacted'
      },
      {
        entityType: 'ip',
        entityIdentifier: 'address',
        identifierValue: '198.51.100.42',
        role: 'related'
      }
    ]
  }
};

await client.api('/security/alerts_v2/createAlert')
	.version('beta')
	.post(alert);

<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Alerts_v2\MicrosoftGraphSecurityCreateAlert\CreateAlertPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\CreateAlertInput;
use Microsoft\Graph\Beta\Generated\Models\Security\AlertSeverity;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinition;
use Microsoft\Graph\Beta\Generated\Models\Security\ManualAlertEntityType;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinitionInputRole;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new CreateAlertPostRequestBody();
$createAlertInput = new CreateAlertInput();
$createAlertInput->setTitle('Unauthorized access attempt');
$createAlertInput->setSeverity(new AlertSeverity('high'));
$createAlertInput->setDescription('Multiple failed login attempts from an unusual location.');
$createAlertInput->setCategory('InitialAccess');
$createAlertInput->setMitreTechniques(['T1078', 	]);
$createAlertInput->setIsExcludedFromCorrelation(false);
$entityDefinitionsEntityDefinition1 = new EntityDefinition();
$entityDefinitionsEntityDefinition1->setEntityType(new ManualAlertEntityType('user'));
$entityDefinitionsEntityDefinition1->setEntityIdentifier('userPrincipalName');
$entityDefinitionsEntityDefinition1->setIdentifierValue('admin@contoso.com');
$entityDefinitionsEntityDefinition1->setRole(new EntityDefinitionInputRole('impacted'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition1;
$entityDefinitionsEntityDefinition2 = new EntityDefinition();
$entityDefinitionsEntityDefinition2->setEntityType(new ManualAlertEntityType('ip'));
$entityDefinitionsEntityDefinition2->setEntityIdentifier('address');
$entityDefinitionsEntityDefinition2->setIdentifierValue('198.51.100.42');
$entityDefinitionsEntityDefinition2->setRole(new EntityDefinitionInputRole('related'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition2;
$createAlertInput->setEntityDefinitions($entityDefinitionsArray);

$requestBody->setCreateAlertInput($createAlertInput);

$result = $graphServiceClient->security()->alerts_v2()->microsoftGraphSecurityCreateAlert()->post($requestBody)->wait();

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.alerts_v2.microsoft_graph_security_create_alert.create_alert_post_request_body import CreateAlertPostRequestBody
from msgraph_beta.generated.models.security.create_alert_input import CreateAlertInput
from msgraph_beta.generated.models.alert_severity import AlertSeverity
from msgraph_beta.generated.models.security.entity_definition import EntityDefinition
from msgraph_beta.generated.models.manual_alert_entity_type import ManualAlertEntityType
from msgraph_beta.generated.models.entity_definition_input_role import EntityDefinitionInputRole
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CreateAlertPostRequestBody(
	create_alert_input = CreateAlertInput(
		title = "Unauthorized access attempt",
		severity = AlertSeverity.High,
		description = "Multiple failed login attempts from an unusual location.",
		category = "InitialAccess",
		mitre_techniques = [
			"T1078",
		],
		is_excluded_from_correlation = False,
		entity_definitions = [
			EntityDefinition(
				entity_type = ManualAlertEntityType.User,
				entity_identifier = "userPrincipalName",
				identifier_value = "admin@contoso.com",
				role = EntityDefinitionInputRole.Impacted,
			),
			EntityDefinition(
				entity_type = ManualAlertEntityType.Ip,
				entity_identifier = "address",
				identifier_value = "198.51.100.42",
				role = EntityDefinitionInputRole.Related,
			),
		],
	),
)

result = await graph_client.security.alerts_v2.microsoft_graph_security_create_alert.post(request_body)