Namespace: microsoft.graph.security
Importante
As APIs na versão /beta no Microsoft Graph estão sujeitas a alterações. Não há suporte para o uso dessas APIs em aplicativos de produção. Para determinar se uma API está disponível na v1.0, use o seletor Versão.
Crie um alerta do Microsoft 365 Defender invocando uma ação vinculada na alerts_v2 coleção e retornando o recurso de alerta criado. A ação aceita um tipo complexo createAlertInput que combina metadados de alerta e opções específicas de criação em um objeto de solicitação.
Essa API está disponível nas seguintes implantações de nuvem nacional.
| Serviço global |
Governo dos EUA L4 |
US Government L5 (DOD) |
China operada pela 21Vianet |
| ✅ |
✅ |
✅ |
❌ |
Permissões
Escolha a(s) permissão(s) marcada(s) como menos privilegiada(s) para essa API. Use uma permissão ou permissões com privilégios mais altos somente se o aplicativo exigir. Para obter detalhes sobre permissões delegadas e de aplicativo, consulte Tipos de permissão. Para saber mais sobre essas permissões, consulte a referência de permissões.
| Tipo de permissão |
Permissões menos privilegiadas |
Permissões com privilégios mais elevados |
| Delegado (conta corporativa ou de estudante) |
SecurityAlert.Create.All |
SecurityAlert.ReadWrite.All |
| Delegado (conta pessoal da Microsoft) |
Sem suporte. |
Sem suporte. |
| Application |
SecurityAlert.Create.All |
SecurityAlert.ReadWrite.All |
Solicitação HTTP
POST /security/alerts_v2/createAlert
| Nome |
Descrição |
| Autorização |
{token} de portador. Obrigatório. Saiba mais sobre autenticação e autorização. |
| Content-Type |
application/json. Obrigatório. |
Corpo da solicitação
No corpo da solicitação, forneça uma representação JSON dos parâmetros.
A tabela a seguir lista os parâmetros necessários quando você chama essa ação.
| Parâmetro |
Tipo |
Descrição |
| createAlertInput |
microsoft.graph.security.createAlertInput |
Obrigatório. A entrada que contém propriedades de alerta, opções de vinculação de incidentes, roteamento de espaço de trabalho e definições de entidade embutidas. |
Resposta
Se for bem-sucedida, essa ação retornará um código de 201 Created resposta e um objeto de alerta no corpo da resposta.
Exemplos
Exemplo 1: Criar um alerta vinculado a um incidente existente
Solicitação
O exemplo a seguir mostra uma solicitação que cria um alerta e o vincula ao incidente 42.
POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json
{
"createAlertInput": {
"title": "Suspicious PowerShell activity",
"severity": "medium",
"description": "PowerShell script execution was identified during analyst triage.",
"category": "Execution",
"recommendedActions": "Review the script contents and isolate the affected device.",
"mitreTechniques": ["T1059.001"],
"linkToIncident": 42,
"isExcludedFromCorrelation": false,
"entityDefinitions": [
{
"entityType": "device",
"entityIdentifier": "deviceId",
"identifierValue": "d1234567-abcd-4f01-8abc-890123456789",
"role": "impacted"
}
]
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert;
using Microsoft.Graph.Beta.Models.Security;
var requestBody = new CreateAlertPostRequestBody
{
CreateAlertInput = new CreateAlertInput
{
Title = "Suspicious PowerShell activity",
Severity = AlertSeverity.Medium,
Description = "PowerShell script execution was identified during analyst triage.",
Category = "Execution",
RecommendedActions = "Review the script contents and isolate the affected device.",
MitreTechniques = new List<string>
{
"T1059.001",
},
LinkToIncident = 42L,
IsExcludedFromCorrelation = false,
EntityDefinitions = new List<EntityDefinition>
{
new EntityDefinition
{
EntityType = ManualAlertEntityType.Device,
EntityIdentifier = "deviceId",
IdentifierValue = "d1234567-abcd-4f01-8abc-890123456789",
Role = EntityDefinitionInputRole.Impacted,
},
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
//other-imports
)
requestBody := graphsecurity.NewCreateAlertPostRequestBody()
createAlertInput := graphmodelssecurity.NewCreateAlertInput()
title := "Suspicious PowerShell activity"
createAlertInput.SetTitle(&title)
severity := graphmodels.MEDIUM_ALERTSEVERITY
createAlertInput.SetSeverity(&severity)
description := "PowerShell script execution was identified during analyst triage."
createAlertInput.SetDescription(&description)
category := "Execution"
createAlertInput.SetCategory(&category)
recommendedActions := "Review the script contents and isolate the affected device."
createAlertInput.SetRecommendedActions(&recommendedActions)
mitreTechniques := []string {
"T1059.001",
}
createAlertInput.SetMitreTechniques(mitreTechniques)
linkToIncident := int64(42)
createAlertInput.SetLinkToIncident(&linkToIncident)
isExcludedFromCorrelation := false
createAlertInput.SetIsExcludedFromCorrelation(&isExcludedFromCorrelation)
entityDefinition := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.DEVICE_MANUALALERTENTITYTYPE
entityDefinition.SetEntityType(&entityType)
entityIdentifier := "deviceId"
entityDefinition.SetEntityIdentifier(&entityIdentifier)
identifierValue := "d1234567-abcd-4f01-8abc-890123456789"
entityDefinition.SetIdentifierValue(&identifierValue)
role := graphmodels.IMPACTED_ENTITYDEFINITIONINPUTROLE
entityDefinition.SetRole(&role)
entityDefinitions := []graphmodelssecurity.EntityDefinitionable {
entityDefinition,
}
createAlertInput.SetEntityDefinitions(entityDefinitions)
requestBody.SetCreateAlertInput(createAlertInput)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
microsoftGraphSecurityCreateAlert, err := graphClient.Security().Alerts_v2().MicrosoftGraphSecurityCreateAlert().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody createAlertPostRequestBody = new com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody();
com.microsoft.graph.beta.models.security.CreateAlertInput createAlertInput = new com.microsoft.graph.beta.models.security.CreateAlertInput();
createAlertInput.setTitle("Suspicious PowerShell activity");
createAlertInput.setSeverity(com.microsoft.graph.beta.models.security.AlertSeverity.Medium);
createAlertInput.setDescription("PowerShell script execution was identified during analyst triage.");
createAlertInput.setCategory("Execution");
createAlertInput.setRecommendedActions("Review the script contents and isolate the affected device.");
LinkedList<String> mitreTechniques = new LinkedList<String>();
mitreTechniques.add("T1059.001");
createAlertInput.setMitreTechniques(mitreTechniques);
createAlertInput.setLinkToIncident(42L);
createAlertInput.setIsExcludedFromCorrelation(false);
LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition> entityDefinitions = new LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition>();
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.Device);
entityDefinition.setEntityIdentifier("deviceId");
entityDefinition.setIdentifierValue("d1234567-abcd-4f01-8abc-890123456789");
entityDefinition.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Impacted);
entityDefinitions.add(entityDefinition);
createAlertInput.setEntityDefinitions(entityDefinitions);
createAlertPostRequestBody.setCreateAlertInput(createAlertInput);
var result = graphClient.security().alertsV2().microsoftGraphSecurityCreateAlert().post(createAlertPostRequestBody);
const options = {
authProvider,
};
const client = Client.init(options);
const alert = {
createAlertInput: {
title: 'Suspicious PowerShell activity',
severity: 'medium',
description: 'PowerShell script execution was identified during analyst triage.',
category: 'Execution',
recommendedActions: 'Review the script contents and isolate the affected device.',
mitreTechniques: ['T1059.001'],
linkToIncident: 42,
isExcludedFromCorrelation: false,
entityDefinitions: [
{
entityType: 'device',
entityIdentifier: 'deviceId',
identifierValue: 'd1234567-abcd-4f01-8abc-890123456789',
role: 'impacted'
}
]
}
};
await client.api('/security/alerts_v2/createAlert')
.version('beta')
.post(alert);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Alerts_v2\MicrosoftGraphSecurityCreateAlert\CreateAlertPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\CreateAlertInput;
use Microsoft\Graph\Beta\Generated\Models\Security\AlertSeverity;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinition;
use Microsoft\Graph\Beta\Generated\Models\Security\ManualAlertEntityType;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinitionInputRole;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new CreateAlertPostRequestBody();
$createAlertInput = new CreateAlertInput();
$createAlertInput->setTitle('Suspicious PowerShell activity');
$createAlertInput->setSeverity(new AlertSeverity('medium'));
$createAlertInput->setDescription('PowerShell script execution was identified during analyst triage.');
$createAlertInput->setCategory('Execution');
$createAlertInput->setRecommendedActions('Review the script contents and isolate the affected device.');
$createAlertInput->setMitreTechniques(['T1059.001', ]);
$createAlertInput->setLinkToIncident(42);
$createAlertInput->setIsExcludedFromCorrelation(false);
$entityDefinitionsEntityDefinition1 = new EntityDefinition();
$entityDefinitionsEntityDefinition1->setEntityType(new ManualAlertEntityType('device'));
$entityDefinitionsEntityDefinition1->setEntityIdentifier('deviceId');
$entityDefinitionsEntityDefinition1->setIdentifierValue('d1234567-abcd-4f01-8abc-890123456789');
$entityDefinitionsEntityDefinition1->setRole(new EntityDefinitionInputRole('impacted'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition1;
$createAlertInput->setEntityDefinitions($entityDefinitionsArray);
$requestBody->setCreateAlertInput($createAlertInput);
$result = $graphServiceClient->security()->alerts_v2()->microsoftGraphSecurityCreateAlert()->post($requestBody)->wait();
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.alerts_v2.microsoft_graph_security_create_alert.create_alert_post_request_body import CreateAlertPostRequestBody
from msgraph_beta.generated.models.security.create_alert_input import CreateAlertInput
from msgraph_beta.generated.models.alert_severity import AlertSeverity
from msgraph_beta.generated.models.security.entity_definition import EntityDefinition
from msgraph_beta.generated.models.manual_alert_entity_type import ManualAlertEntityType
from msgraph_beta.generated.models.entity_definition_input_role import EntityDefinitionInputRole
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CreateAlertPostRequestBody(
create_alert_input = CreateAlertInput(
title = "Suspicious PowerShell activity",
severity = AlertSeverity.Medium,
description = "PowerShell script execution was identified during analyst triage.",
category = "Execution",
recommended_actions = "Review the script contents and isolate the affected device.",
mitre_techniques = [
"T1059.001",
],
link_to_incident = 42,
is_excluded_from_correlation = False,
entity_definitions = [
EntityDefinition(
entity_type = ManualAlertEntityType.Device,
entity_identifier = "deviceId",
identifier_value = "d1234567-abcd-4f01-8abc-890123456789",
role = EntityDefinitionInputRole.Impacted,
),
],
),
)
result = await graph_client.security.alerts_v2.microsoft_graph_security_create_alert.post(request_body)
Resposta
O exemplo a seguir mostra a resposta.
Observação: o objeto de resposta mostrado aqui pode ser encurtado para legibilidade.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.type": "#microsoft.graph.security.alert",
"id": "ea2c5e5341-c60a-42fc-953f-3da427c85e2d_aml",
"providerAlertId": "manual_ea2c5e5341-c60a-42fc-953f-3da427c85e2d",
"incidentId": "42",
"title": "Suspicious PowerShell activity",
"description": "PowerShell script execution was identified during analyst triage.",
"severity": "medium",
"status": "new",
"classification": "unknown",
"determination": "unknown",
"category": "Execution",
"serviceSource": "microsoft365Defender",
"detectionSource": "manual",
"createdDateTime": "2026-07-27T11:00:00Z",
"lastUpdateDateTime": "2026-07-27T11:00:00Z",
"recommendedActions": "Review the script contents and isolate the affected device.",
"mitreTechniques": ["T1059.001"],
"alertWebUrl": "https://security.microsoft.com/alerts/ea2c5e5341-c60a-42fc-953f-3da427c85e2d_aml"
}
Exemplo 2: Criar um alerta com um novo incidente
Solicitação
O exemplo a seguir mostra uma solicitação que cria um alerta sem especificar um incidente, fazendo com que o back-end crie um novo incidente.
POST https://graph.microsoft.com/beta/security/alerts_v2/createAlert
Content-Type: application/json
{
"createAlertInput": {
"title": "Unauthorized access attempt",
"severity": "high",
"description": "Multiple failed login attempts from an unusual location.",
"category": "InitialAccess",
"mitreTechniques": ["T1078"],
"isExcludedFromCorrelation": false,
"entityDefinitions": [
{
"entityType": "user",
"entityIdentifier": "userPrincipalName",
"identifierValue": "admin@contoso.com",
"role": "impacted"
},
{
"entityType": "ip",
"entityIdentifier": "address",
"identifierValue": "198.51.100.42",
"role": "related"
}
]
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert;
using Microsoft.Graph.Beta.Models.Security;
var requestBody = new CreateAlertPostRequestBody
{
CreateAlertInput = new CreateAlertInput
{
Title = "Unauthorized access attempt",
Severity = AlertSeverity.High,
Description = "Multiple failed login attempts from an unusual location.",
Category = "InitialAccess",
MitreTechniques = new List<string>
{
"T1078",
},
IsExcludedFromCorrelation = false,
EntityDefinitions = new List<EntityDefinition>
{
new EntityDefinition
{
EntityType = ManualAlertEntityType.User,
EntityIdentifier = "userPrincipalName",
IdentifierValue = "admin@contoso.com",
Role = EntityDefinitionInputRole.Impacted,
},
new EntityDefinition
{
EntityType = ManualAlertEntityType.Ip,
EntityIdentifier = "address",
IdentifierValue = "198.51.100.42",
Role = EntityDefinitionInputRole.Related,
},
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts_v2.MicrosoftGraphSecurityCreateAlert.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
//other-imports
)
requestBody := graphsecurity.NewCreateAlertPostRequestBody()
createAlertInput := graphmodelssecurity.NewCreateAlertInput()
title := "Unauthorized access attempt"
createAlertInput.SetTitle(&title)
severity := graphmodels.HIGH_ALERTSEVERITY
createAlertInput.SetSeverity(&severity)
description := "Multiple failed login attempts from an unusual location."
createAlertInput.SetDescription(&description)
category := "InitialAccess"
createAlertInput.SetCategory(&category)
mitreTechniques := []string {
"T1078",
}
createAlertInput.SetMitreTechniques(mitreTechniques)
isExcludedFromCorrelation := false
createAlertInput.SetIsExcludedFromCorrelation(&isExcludedFromCorrelation)
entityDefinition := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.USER_MANUALALERTENTITYTYPE
entityDefinition.SetEntityType(&entityType)
entityIdentifier := "userPrincipalName"
entityDefinition.SetEntityIdentifier(&entityIdentifier)
identifierValue := "admin@contoso.com"
entityDefinition.SetIdentifierValue(&identifierValue)
role := graphmodels.IMPACTED_ENTITYDEFINITIONINPUTROLE
entityDefinition.SetRole(&role)
entityDefinition1 := graphmodelssecurity.NewEntityDefinition()
entityType := graphmodels.IP_MANUALALERTENTITYTYPE
entityDefinition1.SetEntityType(&entityType)
entityIdentifier := "address"
entityDefinition1.SetEntityIdentifier(&entityIdentifier)
identifierValue := "198.51.100.42"
entityDefinition1.SetIdentifierValue(&identifierValue)
role := graphmodels.RELATED_ENTITYDEFINITIONINPUTROLE
entityDefinition1.SetRole(&role)
entityDefinitions := []graphmodelssecurity.EntityDefinitionable {
entityDefinition,
entityDefinition1,
}
createAlertInput.SetEntityDefinitions(entityDefinitions)
requestBody.SetCreateAlertInput(createAlertInput)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
microsoftGraphSecurityCreateAlert, err := graphClient.Security().Alerts_v2().MicrosoftGraphSecurityCreateAlert().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody createAlertPostRequestBody = new com.microsoft.graph.beta.security.alerts_v2.microsoftgraphsecuritycreatealert.CreateAlertPostRequestBody();
com.microsoft.graph.beta.models.security.CreateAlertInput createAlertInput = new com.microsoft.graph.beta.models.security.CreateAlertInput();
createAlertInput.setTitle("Unauthorized access attempt");
createAlertInput.setSeverity(com.microsoft.graph.beta.models.security.AlertSeverity.High);
createAlertInput.setDescription("Multiple failed login attempts from an unusual location.");
createAlertInput.setCategory("InitialAccess");
LinkedList<String> mitreTechniques = new LinkedList<String>();
mitreTechniques.add("T1078");
createAlertInput.setMitreTechniques(mitreTechniques);
createAlertInput.setIsExcludedFromCorrelation(false);
LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition> entityDefinitions = new LinkedList<com.microsoft.graph.beta.models.security.EntityDefinition>();
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.User);
entityDefinition.setEntityIdentifier("userPrincipalName");
entityDefinition.setIdentifierValue("admin@contoso.com");
entityDefinition.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Impacted);
entityDefinitions.add(entityDefinition);
com.microsoft.graph.beta.models.security.EntityDefinition entityDefinition1 = new com.microsoft.graph.beta.models.security.EntityDefinition();
entityDefinition1.setEntityType(com.microsoft.graph.beta.models.security.ManualAlertEntityType.Ip);
entityDefinition1.setEntityIdentifier("address");
entityDefinition1.setIdentifierValue("198.51.100.42");
entityDefinition1.setRole(com.microsoft.graph.beta.models.security.EntityDefinitionInputRole.Related);
entityDefinitions.add(entityDefinition1);
createAlertInput.setEntityDefinitions(entityDefinitions);
createAlertPostRequestBody.setCreateAlertInput(createAlertInput);
var result = graphClient.security().alertsV2().microsoftGraphSecurityCreateAlert().post(createAlertPostRequestBody);
const options = {
authProvider,
};
const client = Client.init(options);
const alert = {
createAlertInput: {
title: 'Unauthorized access attempt',
severity: 'high',
description: 'Multiple failed login attempts from an unusual location.',
category: 'InitialAccess',
mitreTechniques: ['T1078'],
isExcludedFromCorrelation: false,
entityDefinitions: [
{
entityType: 'user',
entityIdentifier: 'userPrincipalName',
identifierValue: 'admin@contoso.com',
role: 'impacted'
},
{
entityType: 'ip',
entityIdentifier: 'address',
identifierValue: '198.51.100.42',
role: 'related'
}
]
}
};
await client.api('/security/alerts_v2/createAlert')
.version('beta')
.post(alert);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Alerts_v2\MicrosoftGraphSecurityCreateAlert\CreateAlertPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\CreateAlertInput;
use Microsoft\Graph\Beta\Generated\Models\Security\AlertSeverity;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinition;
use Microsoft\Graph\Beta\Generated\Models\Security\ManualAlertEntityType;
use Microsoft\Graph\Beta\Generated\Models\Security\EntityDefinitionInputRole;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new CreateAlertPostRequestBody();
$createAlertInput = new CreateAlertInput();
$createAlertInput->setTitle('Unauthorized access attempt');
$createAlertInput->setSeverity(new AlertSeverity('high'));
$createAlertInput->setDescription('Multiple failed login attempts from an unusual location.');
$createAlertInput->setCategory('InitialAccess');
$createAlertInput->setMitreTechniques(['T1078', ]);
$createAlertInput->setIsExcludedFromCorrelation(false);
$entityDefinitionsEntityDefinition1 = new EntityDefinition();
$entityDefinitionsEntityDefinition1->setEntityType(new ManualAlertEntityType('user'));
$entityDefinitionsEntityDefinition1->setEntityIdentifier('userPrincipalName');
$entityDefinitionsEntityDefinition1->setIdentifierValue('admin@contoso.com');
$entityDefinitionsEntityDefinition1->setRole(new EntityDefinitionInputRole('impacted'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition1;
$entityDefinitionsEntityDefinition2 = new EntityDefinition();
$entityDefinitionsEntityDefinition2->setEntityType(new ManualAlertEntityType('ip'));
$entityDefinitionsEntityDefinition2->setEntityIdentifier('address');
$entityDefinitionsEntityDefinition2->setIdentifierValue('198.51.100.42');
$entityDefinitionsEntityDefinition2->setRole(new EntityDefinitionInputRole('related'));
$entityDefinitionsArray []= $entityDefinitionsEntityDefinition2;
$createAlertInput->setEntityDefinitions($entityDefinitionsArray);
$requestBody->setCreateAlertInput($createAlertInput);
$result = $graphServiceClient->security()->alerts_v2()->microsoftGraphSecurityCreateAlert()->post($requestBody)->wait();
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.alerts_v2.microsoft_graph_security_create_alert.create_alert_post_request_body import CreateAlertPostRequestBody
from msgraph_beta.generated.models.security.create_alert_input import CreateAlertInput
from msgraph_beta.generated.models.alert_severity import AlertSeverity
from msgraph_beta.generated.models.security.entity_definition import EntityDefinition
from msgraph_beta.generated.models.manual_alert_entity_type import ManualAlertEntityType
from msgraph_beta.generated.models.entity_definition_input_role import EntityDefinitionInputRole
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CreateAlertPostRequestBody(
create_alert_input = CreateAlertInput(
title = "Unauthorized access attempt",
severity = AlertSeverity.High,
description = "Multiple failed login attempts from an unusual location.",
category = "InitialAccess",
mitre_techniques = [
"T1078",
],
is_excluded_from_correlation = False,
entity_definitions = [
EntityDefinition(
entity_type = ManualAlertEntityType.User,
entity_identifier = "userPrincipalName",
identifier_value = "admin@contoso.com",
role = EntityDefinitionInputRole.Impacted,
),
EntityDefinition(
entity_type = ManualAlertEntityType.Ip,
entity_identifier = "address",
identifier_value = "198.51.100.42",
role = EntityDefinitionInputRole.Related,
),
],
),
)
result = await graph_client.security.alerts_v2.microsoft_graph_security_create_alert.post(request_body)
Resposta
O exemplo a seguir mostra a resposta.
Observação: o objeto de resposta mostrado aqui pode ser encurtado para legibilidade.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.type": "#microsoft.graph.security.alert",
"id": "bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f_aml",
"providerAlertId": "manual_bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f",
"incidentId": "128",
"title": "Unauthorized access attempt",
"severity": "high",
"status": "new",
"category": "InitialAccess",
"serviceSource": "microsoft365Defender",
"detectionSource": "manual",
"createdDateTime": "2026-07-27T12:30:00Z",
"lastUpdateDateTime": "2026-07-27T12:30:00Z",
"alertWebUrl": "https://security.microsoft.com/alerts/bf3c9e7812-a45b-44dc-8e2f-1a2b3c4d5e6f_aml"
}