Forum Discussion
How to Ensure No Missed Alerts Using alertReportedTime in Microsoft Defender for Endpoint?
I am developing an application that continuously searches for the latest alerts in Microsoft Defender for Endpoint by querying alerts from 2 minutes ago to 1 minute ago.
My goal is to ensure that no alerts are missed, even if a device was offline and only reported the alert after coming back online.
My question is: If I use `alertCreationTime` for my search, will it ensure that I do not miss any alerts, including those that were generated while the device was offline and reported later when the device came back online?
Any insights or best practices on this approach would be greatly appreciated.
Thank you!
Hi tomokon!
Probably in your case I would use "alertReportedTime" instead of "alertCreationTime" as it is the key to ensuring no missed alerts. The "alertReportedTime" reflects when the alert was actually reported, which is more reliable for detecting alerts from devices that were offline and came back online later. "alertCreationTime" only reflects when the alert was initially created, which might not capture alerts that were generated while the device was offline. By querying based on "alertReportedTime", you can be sure you catch all alerts, even those reported after the device reconnects.
Regards!
Thank you luchete , for your response.
However, I noticed that the `alertReportedTime` property does not exist in the Microsoft Defender for Endpoint API. Instead, there are `alertCreationTime` and `firstEventTime`.
Could you please clarify if using `alertCreationTime` will ensure that no alerts are missed, including those generated while the device was offline and reported later when the device came back online? Or is there another recommended approach to ensure all alerts are captured?
Thank you again for your assistance!
Hi tomokon,
You're right that alertReportedTime doesn't exist in the Microsoft Defender for Endpoint API, and I appreciate you pointing that out as i took a wrong approach.
In this case, alertCreationTime may not fully address your need to capture alerts generated while a device was offline. Instead, I recommend using firstEventTime. This property reflects when the first event in an alert occurred, which is more likely to capture events from when the device was offline and later reported upon reconnecting.
You can still reference alertCreationTime, but using firstEventTime should help ensure you capture all relevant alerts.
