Microsoft Defender

• New Microsoft Defender incidentRuns when Microsoft Defender opens a new incident (a group of alerts about one attack).
• Microsoft Defender incident updatedRuns when a Microsoft Defender incident changes: a new alert, a new owner, status, classification or comment.
• Microsoft Defender incident status changedRuns when a Microsoft Defender incident's status changes, such as when it is resolved.
• New high-severity Microsoft Defender alertRuns when Microsoft Defender raises a high-severity alert.

• List incidentsList Microsoft Defender incidents, newest first, by status, severity, classification, owner or date. An incident groups the alerts of one attack.
• Get incidentGet one Microsoft Defender incident with its comments and, if you choose, its alerts and what they involve.
• Update incidentChange a Microsoft Defender incident's status, owner, classification or determination, and add a comment. Resolving an incident resolves its alerts too. Only the fields you fill in change.
• Add comment to incidentAdd a comment to a Microsoft Defender incident's history. Comments can't be edited or removed.
• List alertsList Microsoft Defender alerts, newest first, by status, severity, classification, product, owner, date or title.
• Get alertGet one Microsoft Defender alert: what it detected, what it involves (devices, users, files), what Microsoft recommends, and its comments.
• Update alertChange a Microsoft Defender alert's status, owner, classification or determination, and add a comment. Only the fields you fill in change.
• Add comment to alertAdd a comment to a Microsoft Defender alert's history. Comments can't be edited or removed.
• Run advanced hunting querySearch your organization's Microsoft Defender data (device, email, identity and app activity) with an advanced hunting query written in Kusto Query Language (KQL), and return the rows it finds. A query can only read data; it can't change anything. Defender keeps about 30 days of this data.
• Get Secure ScoreGet your organization's latest Microsoft Secure Score: the score, the highest possible, averages to compare with, and the score on each recommendation.
• List Secure Score historyList your organization's Microsoft Secure Score for each recent day, newest first.
• List Secure Score recommendationsList the recommendations that make up the Microsoft Secure Score, most important first, with what each is worth and protects against.
• Get Secure Score recommendationGet one Microsoft Secure Score recommendation: what to do, how, what it is worth and the changes your organization made to it.

No actions match that.