Defender Alerts

The question it answers: Which alerts did Microsoft Defender raise in the last 30 days, from which source, and which are still open?

Alerts from every Defender product in the last 30 days, with source, category and MITRE techniques.

Note

Last 30 days. Uses the alerts_v2 endpoint; the legacy /security/alerts API is being retired.

At a glance

Where in the app	Tenant › Security Alerts & Incidents
Shown as	a tab of Security Alerts & Incidents
Workload	Security
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	A Microsoft Defender product (Defender for Endpoint / Office 365 / Identity / Cloud Apps, Microsoft 365 E5 or Business Premium). Without one there is nothing to report.
Report id (API and MCP)	tenant.security.alerts

Columns

Column	Key	Type
Alert	Title	Link
Severity	SeverityLevel	Status
Status	Status	Text
Source	ServiceSourceDisplay	Text
Category	Category	Text
MITRE	MitreTechniquesString	Text
Incident	IncidentId	Text
Created	CreatedDateTime	DateTime

Filters

Filter	Key (API)	On when the page opens
Open only	open	Yes

What it needs

Licence: A Microsoft Defender product (Defender for Endpoint / Office 365 / Identity / Cloud Apps, Microsoft 365 E5 or Business Premium). Without one there is nothing to report.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
SecurityAlert.Read.All	Microsoft Graph	Read all security alerts

Data sources it reads

• GET /v1.0/security/alerts_v2

Through the API and MCP

GET /ir-api/v1/reports/tenant.security.alerts?size=100
GET /ir-api/v1/reports/tenant.security.alerts?filter=open

An AI assistant reads it with the MCP tool get_report and the id tenant.security.alerts. The client needs the Read grant for Security. See Using the API.