Security Alerts & Incidents

The question it answers: Which Microsoft Defender incidents of the last 30 days are still open, how severe are they, and which has nobody picked up?

What Microsoft Defender flagged in the last 30 days, what is still open, and what nobody has picked up. Every row links to the incident or alert in the Defender portal.

Note

Last 30 days.

At a glance

Where in the app	Tenant › Security Alerts & Incidents
Workload	Security
Kind	Table · dashboard tile
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	A Microsoft Defender product (Defender for Endpoint / Office 365 / Identity / Cloud Apps, Microsoft 365 E5 or Business Premium). Without one there is nothing to report.
Report id (API and MCP)	tenant.security.incidents
Tabs on its page	Defender Alerts

Columns

Column	Key	Type
Incident	DisplayName	Link
Severity	SeverityLevel	Status
Status	Status	Text
Assigned to	AssignedTo	Text
Classification	Classification	Text
Created	CreatedDateTime	DateTime
Last update	LastUpdateDateTime	DateTime

Filters

Filter	Key (API)	On when the page opens
Open only	open	Yes

What it needs

Licence: A Microsoft Defender product (Defender for Endpoint / Office 365 / Identity / Cloud Apps, Microsoft 365 E5 or Business Premium). Without one there is nothing to report.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
SecurityIncident.Read.All	Microsoft Graph	Read all security incidents

Data sources it reads

• GET /v1.0/security/incidents

Through the API and MCP

GET /ir-api/v1/reports/tenant.security.incidents?size=100
GET /ir-api/v1/reports/tenant.security.incidents?filter=open

An AI assistant reads it with the MCP tool get_report and the id tenant.security.incidents. The client needs the Read grant for Security. See Using the API.