Forum Discussion
esanya2280
May 04, 2026Copper Contributor
Microsoft Defender Incident – Handling incident severity change.
I am polling incidents via Microsoft Graph API every 5 minutes, initially filtering out Low/Informational incidents.
Later, some low severity incidents are updated to High/Medium severity.
Is there any built-in mechanism in Defender for tracking severity transitions?
No RepliesBe the first to reply