api

Microsoft Graph Security API

The Microsoft Graph Security API is the unified Microsoft Graph surface for security alerts, incidents, actions, threat submissions, identity security data, and related security operations workflows across supported Microsoft security providers.

apisCurrent

Related KQL

Detect file modification bursts by process

Summarize high-volume file create/modify activity by device, account, and initiating process as a ransomware-style triage signal.

detection candidate

advancedendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceFileEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let minimumEvents = {minimum_events};
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| summarize FileEvents=count(), Extensions=make_set(tolower(extract(@"\.([^.\\]+)$", 1, FolderPath)), 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileEvents >= minimumEvents
| order by FileEvents desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from ransomware TTP themes into a generic file-burst query for modeled MDE tables.

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template

advancedthreat-intelligenceendpoint

Run surface: Sentinel Logs
Required tables: ThreatIntelIndicators DeviceNetworkEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.

Pivot from suspicious email to URL clicks

Find delivered inbound messages from a suspicious sender domain, join URL metadata, then pivot into user click activity.

template

intermediatephishinguser-compromise

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents EmailUrlInfo UrlClickEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

let lookback = {lookback};
let senderDomain = "{sender_domain}";
let suspiciousMessages = EmailEvents
| where Timestamp > ago(lookback)
| where EmailDirection == "Inbound"
| where SenderFromDomain =~ senderDomain
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes;
suspiciousMessages
| join kind=leftouter (
    EmailUrlInfo
    | project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| join kind=leftouter (
    UrlClickEvents
    | where Timestamp > ago(lookback)
    | project ClickTimestamp=Timestamp, NetworkMessageId, AccountUpn, Url, ActionType, IsClickedThrough, ThreatTypes
) on NetworkMessageId, Url
| order by Timestamp desc, ClickTimestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing investigation themes with tenant-specific placeholders and current MDO table names.

Review suspicious PowerShell process launches

Find PowerShell process executions with common download, encoded-command, hidden-window, or bypass indicators.

detection candidate

intermediateendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceProcessEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let suspiciousTerms = dynamic(["-enc", "encodedcommand", "downloadstring", "invoke-webrequest", "iex", "-w hidden", "bypass"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousTerms)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountUpn, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from endpoint and ransomware hunting themes with common PowerShell indicators.

Summarize inbound email authentication failures

Parse EmailEvents authentication details to summarize SPF, DKIM, DMARC, and composite authentication outcomes by sender domain.

template

intermediatephishing

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

EmailEvents
| where Timestamp > ago({lookback})
| where EmailDirection == "Inbound"
| extend Auth = parse_json(AuthenticationDetails)
| extend SPF=tostring(Auth.SPF), DKIM=tostring(Auth.DKIM), DMARC=tostring(Auth.DMARC), CompAuth=tostring(Auth.CompAuth)
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 5) by SenderFromDomain, SPF, DKIM, DMARC, CompAuth, DeliveryAction
| order by Messages desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing and Microsoft 365 compromise themes; converted to a generalized authentication summary.

Example Request

http

GET https://graph.microsoft.com/v1.0/security/incidents
Authorization: Bearer <token>

API Access

Permission resource: Microsoft Graph
Portal search: Microsoft Graph
Lifecycle: current
Legacy names: Microsoft Graph Security tiIndicators API
Tracked application permissions: SecurityActions.ReadWrite.All, SecurityAlert.Create.All, SecurityAlert.Read.All, SecurityAlert.ReadWrite.All, SecurityAnalyzedMessage.Read.All, SecurityAnalyzedMessage.ReadWrite.All, SecurityEvents.Read.All, SecurityEvents.ReadWrite.All, SecurityIdentitiesAccount.Read.All, SecurityIdentitiesActions.ReadWrite.All, SecurityIdentitiesHealth.Read.All, SecurityIdentitiesHealth.ReadWrite.All, SecurityIdentitiesSensors.ReadWrite.All, SecurityIdentitiesUserActions.Read.All, SecurityIdentitiesUserActions.ReadWrite.All, SecurityIncident.Read.All, SecurityIncident.ReadWrite.All, ThreatHunting.Read.All, ThreatIndicators.Read.All, ThreatIndicators.ReadWrite.OwnedBy, ThreatIntelligence.Read.All, ThreatSubmission.Read.All, ThreatSubmission.ReadWrite.All, ThreatSubmissionPolicy.ReadWrite.All
Tracked delegated permissions: SecurityActions.ReadWrite.All, SecurityAlert.Create.All, SecurityAlert.Read.All, SecurityAlert.ReadWrite.All, SecurityAnalyzedMessage.Read.All, SecurityAnalyzedMessage.ReadWrite.All, SecurityEvents.Read.All, SecurityEvents.ReadWrite.All, SecurityIdentitiesAccount.Read.All, SecurityIdentitiesActions.ReadWrite.All, SecurityIdentitiesHealth.Read.All, SecurityIdentitiesHealth.ReadWrite.All, SecurityIdentitiesSensors.ReadWrite.All, SecurityIdentitiesUserActions.Read.All, SecurityIdentitiesUserActions.ReadWrite.All, SecurityIncident.Read.All, SecurityIncident.ReadWrite.All, ThreatHunting.Read.All, ThreatIndicators.Read.All, ThreatIndicators.ReadWrite.OwnedBy, ThreatIntelligence.Read.All, ThreatSubmission.Read, ThreatSubmission.Read.All, ThreatSubmission.ReadWrite, ThreatSubmission.ReadWrite.All, ThreatSubmissionPolicy.ReadWrite.All

Reference

Stable ID: microsoft-graph-security-api
Path: /entities/apis/microsoft-graph-security-api/
Last verified: 2026-08-11

Official Sources

Use the Microsoft Graph security APIOpen List incidentsOpen Threat intelligence in Microsoft SentinelOpen

Relationships

Related KQL

Detect file modification bursts by process

Join active threat indicators to endpoint network events

Pivot from suspicious email to URL clicks

Review suspicious PowerShell process launches

Summarize inbound email authentication failures

Example Request