Espacio de nombres: microsoft.graph.security
Importante
Las API de la versión /beta de Microsoft Graph están sujetas a cambios. No se admite el uso de estas API en aplicaciones de producción. Para determinar si una API está disponible en la versión 1.0, use el selector de Versión.
Cree una alerta de Microsoft 365 Defender invocando una acción enlazada en la alerts_v2 colección y devolviendo el recurso de alerta creado. La acción acepta un tipo complejo createAlertInput que combina metadatos de alerta y opciones específicas de creación en un objeto de solicitud.
Esta API está disponible en las siguientes implementaciones en la nube nacional.
| Servicio global |
Administración pública de EE. UU. |
Gobierno de EE. UU. L5 (DOD) |
China operado por 21Vianet |
| ✅ |
✅ |
✅ |
❌ |
Permissions
Elija el permiso o los permisos marcados como con privilegios mínimos para esta API. Use uno o varios permisos con privilegios más altos solo si la aplicación lo requiere. Para obtener más información sobre los permisos delegados y de aplicación, consulte Tipos de permisos. Para obtener más información sobre estos permisos, consulte la referencia de permisos.
| Tipo de permiso |
Permisos con privilegios mínimos |
Permisos con privilegios más altos |
| Delegado (cuenta profesional o educativa) |
SecurityAlert.Create.All |
SecurityAlert.ReadWrite.All |
| Delegado (cuenta personal de Microsoft) |
No admitida. |
No admitida. |
| Aplicación |
SecurityAlert.Create.All |
SecurityAlert.ReadWrite.All |
Solicitud HTTP
POST /security/alerts_v2/createAlert
| Nombre |
Descripción |
| Authorization |
{token} de portador. Obligatorio. Obtenga más información sobre autenticación y autorización. |
| Content-Type |
application/json. Obligatorio. |
Cuerpo de la solicitud
En el cuerpo de la solicitud, proporcione una representación JSON de los parámetros.
En la tabla siguiente se enumeran los parámetros necesarios al llamar a esta acción.
| Parámetro |
Tipo |
Description |
| createAlertInput |
microsoft.graph.security.createAlertInput |
Obligatorio. La entrada que contiene las propiedades de alerta, las opciones de vinculación de incidentes, el enrutamiento del área de trabajo y las definiciones de entidades insertadas. |
Respuesta
Si se realiza correctamente, esta acción devuelve un 201 Created código de respuesta y un objeto de alerta en el cuerpo de la respuesta.
Ejemplos
Ejemplo 1: Crear una alerta vinculada a un incidente existente
Solicitud
En el ejemplo siguiente se muestra una solicitud que crea una alerta y la vincula al incidente 42.
POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json
{
"createAlertInput": {
"title": "Suspicious PowerShell activity",
"severity": "medium",
"description": "PowerShell script execution was identified during analyst triage.",
"category": "Execution",
"recommendedActions": "Review the script contents and isolate the affected device.",
"mitreTechniques": ["T1059.001"],
"linkToIncident": 42,
"isExcludedFromCorrelation": false,
"entityDefinitions": [
{
"entityType": "device",
"entityIdentifier": "deviceId",
"identifierValue": "d1234567-abcd-4f01-8abc-890123456789",
"role": "impacted"
}
]
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert;
using Microsoft.Graph.Beta.Models.Security;
var requestBody = new CreateAlertPostRequestBody
{
CreateAlertInput = new CreateAlertInput
{
Title = "Suspicious PowerShell activity",
Severity = AlertSeverity.Medium,
Description = "PowerShell script execution was identified during analyst triage.",
Category = "Execution",
RecommendedActions = "Review the script contents and isolate the affected device.",
MitreTechniques = new List<string>
{
"T1059.001",
},
LinkToIncident = 42L,
IsExcludedFromCorrelation = false,
EntityDefinitions = new List<EntityDefinition>
{
new EntityDefinition
{
EntityType = ManualAlertEntityType.Device,
EntityIdentifier = "deviceId",
IdentifierValue = "d1234567-abcd-4f01-8abc-890123456789",
Role = EntityDefinitionInputRole.Impacted,
},
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
//other-imports
)
requestBody := graphsecurity.NewCreateAlertPostRequestBody()
createAlertInput := graphmodelssecurity.NewCreateAlertInput()
title := "Suspicious PowerShell activity"
createAlertInput.SetTitle(&title)
severity := graphmodels.MEDIUM_ALERTSEVERITY
createAlertInput.SetSeverity(&severity)
description := "PowerShell script execution was identified during analyst triage."
createAlertInput.SetDescription(&description)
category := "Execution"
createAlertInput.SetCategory(&category)
recommendedActions := "Review the script contents and isolate the affected device."
createAlertInput.SetRecommendedActions(&recommendedActions)
mitreTechniques := []string {
"T1059.001",
}
createAlertInput.SetMitreTechniques(mitreTechniques)
linkToIncident := int64(42)
createAlertInput.SetLinkToIncident(&linkToIncident)
isExcludedFromCorrelation := false
createAlertInput.SetIsExcludedFromCorrelation(&isExcludedFromCorrelation)
entityDefinition := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.DEVICE_MANUALALERTENTITYTYPE
entityDefinition.SetEntityType(&entityType)
entityIdentifier := "deviceId"
entityDefinition.SetEntityIdentifier(&entityIdentifier)
identifierValue := "d1234567-abcd-4f01-8abc-890123456789"
entityDefinition.SetIdentifierValue(&identifierValue)
role := graphmodels.IMPACTED_ENTITYDEFINITIONINPUTROLE
entityDefinition.SetRole(&role)
entityDefinitions := []graphmodelssecurity.EntityDefinitionable {
entityDefinition,
}
createAlertInput.SetEntityDefinitions(entityDefinitions)
requestBody.SetCreateAlertInput(createAlertInput)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
microsoftGraphSecurityCreateAlert, err := graphClient.Security().Alerts_v2().MicrosoftGraphSecurityCreateAlert().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody createAlertPostRequestBody = new com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody();
com.microsoft.graph.beta.models.security.CreateAlertInput createAlertInput = new com.microsoft.graph.beta.models.security.CreateAlertInput();
createAlertInput.setTitle("Suspicious PowerShell activity");
createAlertInput.setSeverity(com.microsoft.graph.beta.models.security.AlertSeverity.Medium);
createAlertInput.setDescription("PowerShell script execution was identified during analyst triage.");
createAlertInput.setCategory("Execution");
createAlertInput.setRecommendedActions("Review the script contents and isolate the affected device.");
LinkedList<String> mitreTechniques = new LinkedList<String>();
mitreTechniques.add("T1059.001");
createAlertInput.setMitreTechniques(mitreTechniques);
createAlertInput.setLinkToIncident(42L);
createAlertInput.setIsExcludedFromCorrelation(false);
LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition> entityDefinitions = new LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition>();
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.Device);
entityDefinition.setEntityIdentifier("deviceId");
entityDefinition.setIdentifierValue("d1234567-abcd-4f01-8abc-890123456789");
entityDefinition.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Impacted);
entityDefinitions.add(entityDefinition);
createAlertInput.setEntityDefinitions(entityDefinitions);
createAlertPostRequestBody.setCreateAlertInput(createAlertInput);
var result = graphClient.security().alertsV2().microsoftGraphSecurityCreateAlert().post(createAlertPostRequestBody);
const options = {
authProvider,
};
const client = Client.init(options);
const alert = {
createAlertInput: {
title: 'Suspicious PowerShell activity',
severity: 'medium',
description: 'PowerShell script execution was identified during analyst triage.',
category: 'Execution',
recommendedActions: 'Review the script contents and isolate the affected device.',
mitreTechniques: ['T1059.001'],
linkToIncident: 42,
isExcludedFromCorrelation: false,
entityDefinitions: [
{
entityType: 'device',
entityIdentifier: 'deviceId',
identifierValue: 'd1234567-abcd-4f01-8abc-890123456789',
role: 'impacted'
}
]
}
};
await client.api('/security/alerts_v2/createAlert')
.version('beta')
.post(alert);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Alerts_v2\MicrosoftGraphSecurityCreateAlert\CreateAlertPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\CreateAlertInput;
use Microsoft\Graph\Beta\Generated\Models\Security\AlertSeverity;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinition;
use Microsoft\Graph\Beta\Generated\Models\Security\ManualAlertEntityType;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinitionInputRole;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new CreateAlertPostRequestBody();
$createAlertInput = new CreateAlertInput();
$createAlertInput->setTitle('Suspicious PowerShell activity');
$createAlertInput->setSeverity(new AlertSeverity('medium'));
$createAlertInput->setDescription('PowerShell script execution was identified during analyst triage.');
$createAlertInput->setCategory('Execution');
$createAlertInput->setRecommendedActions('Review the script contents and isolate the affected device.');
$createAlertInput->setMitreTechniques(['T1059.001', ]);
$createAlertInput->setLinkToIncident(42);
$createAlertInput->setIsExcludedFromCorrelation(false);
$entityDefinitionsEntityDefinition1 = new EntityDefinition();
$entityDefinitionsEntityDefinition1->setEntityType(new ManualAlertEntityType('device'));
$entityDefinitionsEntityDefinition1->setEntityIdentifier('deviceId');
$entityDefinitionsEntityDefinition1->setIdentifierValue('d1234567-abcd-4f01-8abc-890123456789');
$entityDefinitionsEntityDefinition1->setRole(new EntityDefinitionInputRole('impacted'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition1;
$createAlertInput->setEntityDefinitions($entityDefinitionsArray);
$requestBody->setCreateAlertInput($createAlertInput);
$result = $graphServiceClient->security()->alerts_v2()->microsoftGraphSecurityCreateAlert()->post($requestBody)->wait();
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.alerts_v2.microsoft_graph_security_create_alert.create_alert_post_request_body import CreateAlertPostRequestBody
from msgraph_beta.generated.models.security.create_alert_input import CreateAlertInput
from msgraph_beta.generated.models.alert_severity import AlertSeverity
from msgraph_beta.generated.models.security.entity_definition import EntityDefinition
from msgraph_beta.generated.models.manual_alert_entity_type import ManualAlertEntityType
from msgraph_beta.generated.models.entity_definition_input_role import EntityDefinitionInputRole
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CreateAlertPostRequestBody(
create_alert_input = CreateAlertInput(
title = "Suspicious PowerShell activity",
severity = AlertSeverity.Medium,
description = "PowerShell script execution was identified during analyst triage.",
category = "Execution",
recommended_actions = "Review the script contents and isolate the affected device.",
mitre_techniques = [
"T1059.001",
],
link_to_incident = 42,
is_excluded_from_correlation = False,
entity_definitions = [
EntityDefinition(
entity_type = ManualAlertEntityType.Device,
entity_identifier = "deviceId",
identifier_value = "d1234567-abcd-4f01-8abc-890123456789",
role = EntityDefinitionInputRole.Impacted,
),
],
),
)
result = await graph_client.security.alerts_v2.microsoft_graph_security_create_alert.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.type": "#microsoft.graph.security.alert",
"id": "ea2c5e5341-c60a-42fc-953f-3da427c85e2d_aml",
"providerAlertId": "manual_ea2c5e5341-c60a-42fc-953f-3da427c85e2d",
"incidentId": "42",
"title": "Suspicious PowerShell activity",
"description": "PowerShell script execution was identified during analyst triage.",
"severity": "medium",
"status": "new",
"classification": "unknown",
"determination": "unknown",
"category": "Execution",
"serviceSource": "microsoft365Defender",
"detectionSource": "manual",
"createdDateTime": "2026-07-27T11:00:00Z",
"lastUpdateDateTime": "2026-07-27T11:00:00Z",
"recommendedActions": "Review the script contents and isolate the affected device.",
"mitreTechniques": ["T1059.001"],
"alertWebUrl": "https://security.microsoft.com/alerts/ea2c5e5341-c60a-42fc-953f-3da427c85e2d_aml"
}
Ejemplo 2: Crear una alerta con un incidente nuevo
Solicitud
En el ejemplo siguiente se muestra una solicitud que crea una alerta sin especificar un incidente, lo que provoca que el back-end cree un nuevo incidente.
POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json
{
"createAlertInput": {
"title": "Unauthorized access attempt",
"severity": "high",
"description": "Multiple failed login attempts from an unusual location.",
"category": "InitialAccess",
"mitreTechniques": ["T1078"],
"isExcludedFromCorrelation": false,
"entityDefinitions": [
{
"entityType": "user",
"entityIdentifier": "userPrincipalName",
"identifierValue": "admin@contoso.com",
"role": "impacted"
},
{
"entityType": "ip",
"entityIdentifier": "address",
"identifierValue": "198.51.100.42",
"role": "related"
}
]
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert;
using Microsoft.Graph.Beta.Models.Security;
var requestBody = new CreateAlertPostRequestBody
{
CreateAlertInput = new CreateAlertInput
{
Title = "Unauthorized access attempt",
Severity = AlertSeverity.High,
Description = "Multiple failed login attempts from an unusual location.",
Category = "InitialAccess",
MitreTechniques = new List<string>
{
"T1078",
},
IsExcludedFromCorrelation = false,
EntityDefinitions = new List<EntityDefinition>
{
new EntityDefinition
{
EntityType = ManualAlertEntityType.User,
EntityIdentifier = "userPrincipalName",
IdentifierValue = "admin@contoso.com",
Role = EntityDefinitionInputRole.Impacted,
},
new EntityDefinition
{
EntityType = ManualAlertEntityType.Ip,
EntityIdentifier = "address",
IdentifierValue = "198.51.100.42",
Role = EntityDefinitionInputRole.Related,
},
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
//other-imports
)
requestBody := graphsecurity.NewCreateAlertPostRequestBody()
createAlertInput := graphmodelssecurity.NewCreateAlertInput()
title := "Unauthorized access attempt"
createAlertInput.SetTitle(&title)
severity := graphmodels.HIGH_ALERTSEVERITY
createAlertInput.SetSeverity(&severity)
description := "Multiple failed login attempts from an unusual location."
createAlertInput.SetDescription(&description)
category := "InitialAccess"
createAlertInput.SetCategory(&category)
mitreTechniques := []string {
"T1078",
}
createAlertInput.SetMitreTechniques(mitreTechniques)
isExcludedFromCorrelation := false
createAlertInput.SetIsExcludedFromCorrelation(&isExcludedFromCorrelation)
entityDefinition := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.USER_MANUALALERTENTITYTYPE
entityDefinition.SetEntityType(&entityType)
entityIdentifier := "userPrincipalName"
entityDefinition.SetEntityIdentifier(&entityIdentifier)
identifierValue := "admin@contoso.com"
entityDefinition.SetIdentifierValue(&identifierValue)
role := graphmodels.IMPACTED_ENTITYDEFINITIONINPUTROLE
entityDefinition.SetRole(&role)
entityDefinition1 := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.IP_MANUALALERTENTITYTYPE
entityDefinition1.SetEntityType(&entityType)
entityIdentifier := "address"
entityDefinition1.SetEntityIdentifier(&entityIdentifier)
identifierValue := "198.51.100.42"
entityDefinition1.SetIdentifierValue(&identifierValue)
role := graphmodels.RELATED_ENTITYDEFINITIONINPUTROLE
entityDefinition1.SetRole(&role)
entityDefinitions := []graphmodelssecurity.EntityDefinitionable {
entityDefinition,
entityDefinition1,
}
createAlertInput.SetEntityDefinitions(entityDefinitions)
requestBody.SetCreateAlertInput(createAlertInput)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
microsoftGraphSecurityCreateAlert, err := graphClient.Security().Alerts_v2().MicrosoftGraphSecurityCreateAlert().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody createAlertPostRequestBody = new com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody();
com.microsoft.graph.beta.models.security.CreateAlertInput createAlertInput = new com.microsoft.graph.beta.models.security.CreateAlertInput();
createAlertInput.setTitle("Unauthorized access attempt");
createAlertInput.setSeverity(com.microsoft.graph.beta.models.security.AlertSeverity.High);
createAlertInput.setDescription("Multiple failed login attempts from an unusual location.");
createAlertInput.setCategory("InitialAccess");
LinkedList<String> mitreTechniques = new LinkedList<String>();
mitreTechniques.add("T1078");
createAlertInput.setMitreTechniques(mitreTechniques);
createAlertInput.setIsExcludedFromCorrelation(false);
LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition> entityDefinitions = new LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition>();
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.User);
entityDefinition.setEntityIdentifier("userPrincipalName");
entityDefinition.setIdentifierValue("admin@contoso.com");
entityDefinition.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Impacted);
entityDefinitions.add(entityDefinition);
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition1 = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition1.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.Ip);
entityDefinition1.setEntityIdentifier("address");
entityDefinition1.setIdentifierValue("198.51.100.42");
entityDefinition1.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Related);
entityDefinitions.add(entityDefinition1);
createAlertInput.setEntityDefinitions(entityDefinitions);
createAlertPostRequestBody.setCreateAlertInput(createAlertInput);
var result = graphClient.security().alertsV2().microsoftGraphSecurityCreateAlert().post(createAlertPostRequestBody);
const options = {
authProvider,
};
const client = Client.init(options);
const alert = {
createAlertInput: {
title: 'Unauthorized access attempt',
severity: 'high',
description: 'Multiple failed login attempts from an unusual location.',
category: 'InitialAccess',
mitreTechniques: ['T1078'],
isExcludedFromCorrelation: false,
entityDefinitions: [
{
entityType: 'user',
entityIdentifier: 'userPrincipalName',
identifierValue: 'admin@contoso.com',
role: 'impacted'
},
{
entityType: 'ip',
entityIdentifier: 'address',
identifierValue: '198.51.100.42',
role: 'related'
}
]
}
};
await client.api('/security/alerts_v2/createAlert')
.version('beta')
.post(alert);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Alerts_v2\MicrosoftGraphSecurityCreateAlert\CreateAlertPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\CreateAlertInput;
use Microsoft\Graph\Beta\Generated\Models\Security\AlertSeverity;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinition;
use Microsoft\Graph\Beta\Generated\Models\Security\ManualAlertEntityType;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinitionInputRole;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new CreateAlertPostRequestBody();
$createAlertInput = new CreateAlertInput();
$createAlertInput->setTitle('Unauthorized access attempt');
$createAlertInput->setSeverity(new AlertSeverity('high'));
$createAlertInput->setDescription('Multiple failed login attempts from an unusual location.');
$createAlertInput->setCategory('InitialAccess');
$createAlertInput->setMitreTechniques(['T1078', ]);
$createAlertInput->setIsExcludedFromCorrelation(false);
$entityDefinitionsEntityDefinition1 = new EntityDefinition();
$entityDefinitionsEntityDefinition1->setEntityType(new ManualAlertEntityType('user'));
$entityDefinitionsEntityDefinition1->setEntityIdentifier('userPrincipalName');
$entityDefinitionsEntityDefinition1->setIdentifierValue('admin@contoso.com');
$entityDefinitionsEntityDefinition1->setRole(new EntityDefinitionInputRole('impacted'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition1;
$entityDefinitionsEntityDefinition2 = new EntityDefinition();
$entityDefinitionsEntityDefinition2->setEntityType(new ManualAlertEntityType('ip'));
$entityDefinitionsEntityDefinition2->setEntityIdentifier('address');
$entityDefinitionsEntityDefinition2->setIdentifierValue('198.51.100.42');
$entityDefinitionsEntityDefinition2->setRole(new EntityDefinitionInputRole('related'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition2;
$createAlertInput->setEntityDefinitions($entityDefinitionsArray);
$requestBody->setCreateAlertInput($createAlertInput);
$result = $graphServiceClient->security()->alerts_v2()->microsoftGraphSecurityCreateAlert()->post($requestBody)->wait();
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.alerts_v2.microsoft_graph_security_create_alert.create_alert_post_request_body import CreateAlertPostRequestBody
from msgraph_beta.generated.models.security.create_alert_input import CreateAlertInput
from msgraph_beta.generated.models.alert_severity import AlertSeverity
from msgraph_beta.generated.models.security.entity_definition import EntityDefinition
from msgraph_beta.generated.models.manual_alert_entity_type import ManualAlertEntityType
from msgraph_beta.generated.models.entity_definition_input_role import EntityDefinitionInputRole
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CreateAlertPostRequestBody(
create_alert_input = CreateAlertInput(
title = "Unauthorized access attempt",
severity = AlertSeverity.High,
description = "Multiple failed login attempts from an unusual location.",
category = "InitialAccess",
mitre_techniques = [
"T1078",
],
is_excluded_from_correlation = False,
entity_definitions = [
EntityDefinition(
entity_type = ManualAlertEntityType.User,
entity_identifier = "userPrincipalName",
identifier_value = "admin@contoso.com",
role = EntityDefinitionInputRole.Impacted,
),
EntityDefinition(
entity_type = ManualAlertEntityType.Ip,
entity_identifier = "address",
identifier_value = "198.51.100.42",
role = EntityDefinitionInputRole.Related,
),
],
),
)
result = await graph_client.security.alerts_v2.microsoft_graph_security_create_alert.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.type": "#microsoft.graph.security.alert",
"id": "bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f_aml",
"providerAlertId": "manual_bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f",
"incidentId": "128",
"title": "Unauthorized access attempt",
"severity": "high",
"status": "new",
"category": "InitialAccess",
"serviceSource": "microsoft365Defender",
"detectionSource": "manual",
"createdDateTime": "2026-07-27T12:30:00Z",
"lastUpdateDateTime": "2026-07-27T12:30:00Z",
"alertWebUrl": "https://security.microsoft.com/alerts/bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f_aml"
}