> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Graph Security

> Reference for the Tracecat Microsoft Graph Security integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Create alert comment

Action ID: `tools.microsoft_graph_security.create_alert_comment`

Create a comment for an existing alert based on the specified alert id property. Least privileged permission: SecurityAlert.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-alert-post-comments?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-alert-post-comments?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="alertId" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="comment" type="string" required>
  The comment to be added.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

## Create audit log query

Action ID: `tools.microsoft_graph_security.create_audit_log_query`

Create a new auditLogQuery object. Returns `201 Created` and the auditLogQuery, whose `status` moves from notStarted to succeeded before records can be read. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: AuditLogsQuery-Entra.Read.All for both delegated (work or school account) and application; higher privileged: AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-OneDrive.Read.All, AuditLogsQuery-SharePoint.Read.All or AuditLogsQuery.Read.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-auditcoreroot-post-auditlogqueries?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-auditcoreroot-post-auditlogqueries?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="administrativeUnitIdFilters" type="array[string] | null">
  Administrative units tagged to an audit log record.

  Default: `null`.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). This endpoint is only available in the global service.

  Default: `null`.
</ParamField>

<ParamField path="displayName" type="string | null">
  Display name for the saved audit log query.

  Default: `null`.
</ParamField>

<ParamField path="filterEndDateTime" type="string | null">
  End date of the date range in the query, as an ISO 8601 timestamp, for example "2024-10-08T00:00:00Z".

  Default: `null`.
</ParamField>

<ParamField path="filterStartDateTime" type="string | null">
  Start date of the date range in the query, as an ISO 8601 timestamp, for example "2024-10-01T00:00:00Z".

  Default: `null`.
</ParamField>

<ParamField path="ipAddressFilters" type="array[string] | null">
  The IP address of the device that was used when the activity was logged.

  Default: `null`.
</ParamField>

<ParamField path="keywordFilter" type="string | null">
  Free text field to search non-indexed properties of the audit log.

  Default: `null`.
</ParamField>

<ParamField path="objectIdFilters" type="array[string] | null">
  For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For Exchange admin audit logging, the name of the object that was modified by the cmdlet.

  Default: `null`.
</ParamField>

<ParamField path="operationFilters" type="array[string] | null">
  The name of the user or admin activity.

  Default: `null`.
</ParamField>

<ParamField path="recordTypeFilters" type="array[string] | null">
  The operation type or types indicated by the record, for example "azureActiveDirectory", "exchangeAdmin", "sharePointFileOperation" or "microsoftTeams". See the auditLogRecordType enumeration for the full list of members.

  Default: `null`.
</ParamField>

<ParamField path="serviceFilter" type="string | null">
  Refers to the workload property in the audit record. This is the Microsoft service where the activity occurred.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  Current status of the query. The possible values are notStarted, running, succeeded, failed, cancelled and unknownFutureValue.

  Default: `null`.
</ParamField>

<ParamField path="userPrincipalNameFilters" type="array[string] | null">
  The UPN (user principal name) of the user who performed the action (specified in the operation property) that resulted in the record being logged.

  Default: `null`.
</ParamField>

## Create incident comment

Action ID: `tools.microsoft_graph_security.create_incident_comment`

Create a comment for an existing incident based on the specified incident id property. Least privileged permission: SecurityIncident.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Microsoft does not document national cloud availability for this endpoint. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-incident-post-comments?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-incident-post-comments?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="comment" type="string" required>
  The comment to be added.
</ParamField>

<ParamField path="incidentId" type="string" required>
  The unique identifier of the incident.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

## Get alert

Action ID: `tools.microsoft_graph_security.get_alert`

Get the properties and relationships of an alert object. Least privileged permission: SecurityAlert.Read.All for both delegated (work or school account) and application; higher privileged: SecurityAlert.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-alert-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-alert-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="alertId" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

## Get audit log query

Action ID: `tools.microsoft_graph_security.get_audit_log_query`

Read the properties and relationships of an auditLogQuery object, including its `status`. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: ThreatIntelligence.Read.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-auditlogquery-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-auditlogquery-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="auditLogQueryId" type="string" required>
  The unique identifier of the auditLogQuery.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). This endpoint is only available in the global service.

  Default: `null`.
</ParamField>

## Get incident

Action ID: `tools.microsoft_graph_security.get_incident`

Retrieve the properties and relationships of an incident object. Least privileged permission: SecurityIncident.Read.All for both delegated (work or school account) and application; higher privileged: SecurityIncident.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-incident-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-incident-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="incidentId" type="string" required>
  The unique identifier of the incident.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

## Get secure score

Action ID: `tools.microsoft_graph_security.get_secure_score`

Retrieve the properties and relationships of a secureScore object. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. If a status code other than 2xx or 404 is returned from a provider, or if a provider times out, Microsoft Graph responds `206 Partial Content` with the provider's response in a warning header. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/securescore-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/securescore-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="secureScoreId" type="string" required>
  The `id` of the secureScore, for example "00000001-0001-0001-0001-000000000001c\_2019-03-19".
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

## Get secure score control profile

Action ID: `tools.microsoft_graph_security.get_secure_score_control_profile`

Retrieve the properties and relationships of a secureScoreControlProfile object. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. If a status code other than 2xx or 404 is returned from a provider, or if a provider times out, Microsoft Graph responds `206 Partial Content` with the provider's response in a warning header. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/securescorecontrolprofile-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/securescorecontrolprofile-get?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="secureScoreControlProfileId" type="string" required>
  The `id` of the secureScoreControlProfile, for example "DLPEnabled".
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

## List alerts

Action ID: `tools.microsoft_graph_security.list_alerts`

Get a list of alert resources created to track suspicious activities in an organization. Returns the single Microsoft Graph page, including `@odata.nextLink`. Least privileged permission: SecurityAlert.Read.All for both delegated (work or school account) and application; higher privileged: SecurityAlert.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-list-alerts\_v2?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-list-alerts_v2?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

<ParamField path="count" type="boolean | null">
  OData `$count`. Include a count of the matching resources.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  OData `$filter`. The following properties support `$filter`: assignedTo, classification, determination, createdDateTime, lastUpdateDateTime, severity, serviceSource and status.

  Default: `null`.
</ParamField>

<ParamField path="skip" type="integer | null">
  OData `$skip`. Number of alerts to skip.

  Default: `null`.
</ParamField>

<ParamField path="top" type="integer | null">
  OData `$top`. Number of alerts to return.

  Default: `null`.
</ParamField>

## List audit log queries

Action ID: `tools.microsoft_graph_security.list_audit_log_queries`

List auditLogQuery objects. Returns the single Microsoft Graph page, including `@odata.nextLink`. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: AuditLogsQuery-Entra.Read.All for both delegated (work or school account) and application; higher privileged: AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-OneDrive.Read.All, AuditLogsQuery-SharePoint.Read.All or AuditLogsQuery.Read.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft says this method supports unnamed OData query parameters, so this action exposes none. For other parameters, use `tools.microsoft_graph_sdk.call_method` with `oauth_provider` set to `microsoft_graph_security`. No separate licensing requirement is documented.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-auditcoreroot-list-auditlogqueries?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-auditcoreroot-list-auditlogqueries?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). This endpoint is only available in the global service.

  Default: `null`.
</ParamField>

## List audit log records

Action ID: `tools.microsoft_graph_security.list_audit_log_records`

List auditLogRecord objects for a completed audit log query. Returns the single Microsoft Graph page, including `@odata.nextLink`. Auditing data is accessed through the Microsoft Purview Audit Search API. Least privileged permission: AuditLogsQuery-Entra.Read.All for both delegated (work or school account) and application; higher privileged: AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-OneDrive.Read.All, AuditLogsQuery-SharePoint.Read.All or AuditLogsQuery.Read.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service only; not available in US Government L4, US Government L5 (DOD) or China operated by 21Vianet. Microsoft says this method supports unnamed OData query parameters, so this action exposes none. For other parameters, use `tools.microsoft_graph_sdk.call_method` with `oauth_provider` set to `microsoft_graph_security`. No separate licensing requirement is documented.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-auditlogquery-list-records?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-auditlogquery-list-records?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="auditLogQueryId" type="string" required>
  The unique identifier of the auditLogQuery.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). This endpoint is only available in the global service.

  Default: `null`.
</ParamField>

## List incidents

Action ID: `tools.microsoft_graph_security.list_incidents`

Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Returns the single Microsoft Graph page, including `@odata.nextLink`. Least privileged permission: SecurityIncident.Read.All for both delegated (work or school account) and application; higher privileged: SecurityIncident.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Reader, Global Reader, Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-list-incidents?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-list-incidents?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

<ParamField path="count" type="boolean | null">
  OData `$count`. Include a count of the matching resources.

  Default: `null`.
</ParamField>

<ParamField path="expand" type="string | null">
  OData `$expand`. The `alerts` relationship supports `$expand`.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  OData `$filter`. The following properties support `$filter`: assignedTo, classification, createdDateTime, determination, lastUpdateDateTime, severity and status.

  Default: `null`.
</ParamField>

<ParamField path="skip" type="integer | null">
  OData `$skip`. Number of incidents to skip.

  Default: `null`.
</ParamField>

<ParamField path="top" type="integer | null">
  OData `$top`. Number of incidents to return.

  Default: `null`.
</ParamField>

## List secure score control profiles

Action ID: `tools.microsoft_graph_security.list_secure_score_control_profiles`

Retrieve the properties and relationships of a secureScoreControlProfiles object. Returns the single Microsoft Graph page, including `@odata.nextLink`. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-list-securescorecontrolprofiles?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-list-securescorecontrolprofiles?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

<ParamField path="count" type="boolean | null">
  OData `$count`. Include a count of the matching resources.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  OData `$filter`, for example "controlCategory eq 'Identity'".

  Default: `null`.
</ParamField>

<ParamField path="skip" type="integer | null">
  OData `$skip`. Number of control profiles to skip.

  Default: `null`.
</ParamField>

<ParamField path="top" type="integer | null">
  OData `$top`. Returns the aggregated top results from each security API provider.

  Default: `null`.
</ParamField>

## List secure scores

Action ID: `tools.microsoft_graph_security.list_secure_scores`

Retrieve a list of secureScore objects. Returns the single Microsoft Graph page, including `@odata.nextLink`. Least privileged permission: SecurityEvents.Read.All for both delegated (work or school account) and application; higher privileged: SecurityEvents.ReadWrite.All. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-list-securescores?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-list-securescores?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

<ParamField path="count" type="boolean | null">
  OData `$count`. Include a count of the matching resources.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  OData `$filter`, for example "createdDateTime eq '2024-01-01'".

  Default: `null`.
</ParamField>

<ParamField path="skip" type="integer | null">
  OData `$skip`. Number of secure scores to skip.

  Default: `null`.
</ParamField>

<ParamField path="top" type="integer | null">
  OData `$top`. Returns the aggregated top results from each security API provider. Secure score data is sorted by createdDateTime from latest to earliest, and 90 days of data is held by default, so `$top=n` returns the most recent n days.

  Default: `null`.
</ParamField>

## Merge incidents

Action ID: `tools.microsoft_graph_security.merge_incidents`

Merge multiple incident resources into a single incident. Least privileged permission: SecurityData.Manage.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator (least privileged for this operation) or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-incident-mergeincidents?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-incident-mergeincidents?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="incidentIds" type="array[string]" required>
  The IDs of the incidents to merge.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

<ParamField path="incidentComment" type="string | null">
  A comment to add to the merged incident.

  Default: `null`.
</ParamField>

<ParamField path="mergeReasons" type="string | null">
  The correlation reasons for merging the incidents. This object is a flags enum that allows multiple values to be specified, for example "sameCampaign, sameActor".

  Default: `null`.
</ParamField>

## Move alerts

Action ID: `tools.microsoft_graph_security.move_alerts`

Move one or more alert resources to a new or existing incident. Least privileged permission: SecurityData.Manage.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator (least privileged for this operation) or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-alert-movealerts?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-alert-movealerts?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="alertIds" type="array[string]" required>
  The IDs of the alerts to move.
</ParamField>

<ParamField path="alertComment" type="string | null">
  A comment to add when moving the alerts.

  Default: `null`.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

<ParamField path="incidentId" type="string | null">
  The ID of the target incident. A request with `null` creates a new incident.

  Default: `null`.
</ParamField>

<ParamField path="newCorrelationReasons" type="string | null">
  The correlation reasons to associate with the move operation. This object is a flags enum that allows multiple values to be specified, for example "sameAsset, temporalProximity".

  Default: `null`.
</ParamField>

## Run hunting query

Action ID: `tools.microsoft_graph_security.run_hunting_query`

Queries a specified set of event, activity, or entity data supported by Microsoft 365 Defender to proactively look for specific threats in your environment. Least privileged permission: ThreatHunting.Read.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-security-runhuntingquery?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-security-runhuntingquery?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="Query" type="string" required>
  The hunting query in Kusto Query Language (KQL).
</ParamField>

<ParamField path="Timespan" type="string | null">
  The interval of time over which to query data, in ISO 8601 format. The default value is 30 days, meaning if no startTime is specified, the query looks back 30 days from now. If a time filter is specified in both the query and the startTime parameter, the shorter time span is applied.

  Default: `null`.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

<ParamField path="workspaceId" type="string | null">
  The GUID of a specific Log Analytics workspace to target. If omitted, the service uses the caller's primary workspace. If the workspace isn't found or not accessible, the service falls back to the caller's primary workspace.

  Default: `null`.
</ParamField>

## Update alert

Action ID: `tools.microsoft_graph_security.update_alert`

Update the properties of an alert object in an organization based on the specified alert id property. Least privileged permission: SecurityAlert.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-alert-update?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-alert-update?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="alertId" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Supply only the values for properties to update. Updatable properties for PATCH /security/alerts\_v2/\{alertId}: status (new, inProgress, resolved, unknownFutureValue), classification (unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue), customDetails (user defined custom fields with string values), determination (unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue) and assignedTo (owner of the incident, or null if no owner is assigned).
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>

## Update incident

Action ID: `tools.microsoft_graph_security.update_incident`

Update the properties of an incident object. Least privileged permission: SecurityIncident.ReadWrite.All for both delegated (work or school account) and application; no higher privileged permission is available. Delegated access is not supported for personal Microsoft accounts. Delegated callers must hold a supported Microsoft Entra role: Security Operator or Security Administrator. Available in the global service, US Government L4 and US Government L5 (DOD); not available in China operated by 21Vianet. Microsoft's endpoint reference does not state a separate licensing requirement.

Reference: [https://learn.microsoft.com/en-us/graph/api/security-incident-update?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-incident-update?view=graph-rest-1.0)

### Secrets

Optional secrets:

* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.

### Input fields

<ParamField path="incidentId" type="string" required>
  The unique identifier of the incident.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Supply only the values for properties to update. Updatable properties for PATCH /security/incidents/\{incidentId}: assignedTo (owner of the incident, or null if no owner is assigned), classification (unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue), customTags, description, determination (unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue), displayName, severity (unknown, informational, low, medium, high, unknownFutureValue), resolvingComment, status (active, resolved, redirected, unknownFutureValue) and summary.
</ParamField>

<ParamField path="auth_mode" type="string">
  Credential to use. `application` requires MICROSOFT\_GRAPH\_SECURITY\_SERVICE\_TOKEN, then MICROSOFT\_GRAPH\_SERVICE\_TOKEN; `delegated` requires MICROSOFT\_GRAPH\_SECURITY\_USER\_TOKEN, then MICROSOFT\_GRAPH\_USER\_TOKEN; `auto` tries all four in that order.

  Default: `"application"`.

  Allowed values: `application`, `delegated`, `auto`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. If omitted, uses the workspace variable `microsoft_graph_security.base_url`, then `microsoft_graph.base_url`, then [https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0). National clouds: [https://graph.microsoft.us/v1.0](https://graph.microsoft.us/v1.0) (US Government L4) and [https://dod-graph.microsoft.us/v1.0](https://dod-graph.microsoft.us/v1.0) (US Government L5 DOD).

  Default: `null`.
</ParamField>