Reporting on Incidents in security portal

[SocInABox]

Hi there,

Is there a way to query the Incidents and alerts in the security.microsoft.com portal?

I've been exporting the alerts, which works, but using kql would be preferred.

I don't see a good way to export Incidents or to run kql against it.

Is the only way to pull it over to Sentinel and do it from the log analytics workspace?

Same for MCAS portal (defender for cloud apps)

Thank you.

[#2 · Accepted solution]

Hello,

Just saw this question while browsing. You can easily query alerts via the security API. Here's a basic example of using PowerShell to get the alerts via API: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-...

David

[#3]

Hi David, yes this will work.
I grant thee a like :D.