CmdID

CmdID / PowerShell / Cmdlets / New

New-MgSecurityAlert

Create new navigation property to alerts for security Microsoft Graph PowerShell reference

From the Microsoft Graph PowerShell reference 52 parameters Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

52 in the Microsoft Graph PowerShell reference
Show its 52 parameters
-ActivityGroupNameName or alias of the activity group (attacker) this alert is attributed to.
-AdditionalPropertiesAdditional Parameters
-AlertDetectionsTo construct, see NOTES section for ALERTDETECTIONS properties and create a hash table.
-AssignedToName of the analyst the alert is assigned to for triage, investigation, or remediation (supports update).
-AzureSubscriptionIdAzure subscription ID, present if this alert is related to an Azure resource.
-AzureTenantIdMicrosoft Entra tenant ID.
-BodyParameteralert To construct, see NOTES section for BODYPARAMETER properties and create a hash table.
-BreakWait for .NET debugger to attach
-CategoryCategory of the alert (for example, credentialTheft, ransomware).
-ClosedDateTimeTime at which the alert was closed.
-CloudAppStatesSecurity-related stateful information generated by the provider about the cloud application/s related to this alert.
-CommentsCustomer-provided comments on alert (for customer alert management) (supports update).
-ConfidenceConfidence of the detection logic (percentage between 1-100).
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-CreatedDateTimeTime at which the alert was created by the alert provider.
-DescriptionAlert description.
-DetectionIdsSet of alerts related to this alert entity (each alert is pushed to the SIEM as a separate record).
-EventDateTimeTime at which the event or events that served as the trigger to generate the alert occurred.
-FeedbackalertFeedback
-FileStatesSecurity-related stateful information generated by the provider about the files related to this alert.
-HeadersOptional headers that will be added to the request.
-HistoryStatesTo construct, see NOTES section for HISTORYSTATES properties and create a hash table.
-HostStatesSecurity-related stateful information generated by the provider about the hosts related to this alert.
-HttpPipelineAppendSendAsync Pipeline Steps to be appended to the front of the pipeline
-HttpPipelinePrependSendAsync Pipeline Steps to be prepended to the front of the pipeline
-IdThe unique identifier for an entity.
-IncidentIdsIDs of incidents related to current alert.
-InvestigationSecurityStatesTo construct, see NOTES section for INVESTIGATIONSECURITYSTATES properties and create a hash table.
-LastEventDateTime
-LastModifiedDateTimeTime at which the alert entity was last modified.
-MalwareStatesThreat Intelligence pertaining to malware related to this alert.
-MessageSecurityStatesTo construct, see NOTES section for MESSAGESECURITYSTATES properties and create a hash table.
-NetworkConnectionsSecurity-related stateful information generated by the provider about the network connections related to this alert.
-ProcessesSecurity-related stateful information generated by the provider about the process or processes related to this alert.
-ProxyThe URI for the proxy server to use
-ProxyCredentialCredentials for a proxy server to use for the remote call
-ProxyUseDefaultCredentialsUse the default credentials for the proxy
-RecommendedActionsVendor/provider recommended actions to take as a result of the alert (for example, isolate machine, enforce2FA, reimage host).
-RegistryKeyStatesSecurity-related stateful information generated by the provider about the registry keys related to this alert.
-ResponseHeadersVariable, -RHVOptional Response Headers Variable.
-SecurityResourcesResources related to current alert.
-SeverityalertSeverity
-SourceMaterialsHyperlinks (URIs) to the source material related to the alert, for example, provider's user interface for alerts or log search.
-StatusalertStatus
-TagsUser-definable labels that can be applied to an alert and can serve as filter conditions (for example, 'HVA', 'SAW') (supports update).
-TitleAlert title.
-TriggersSecurity-related information about the specific properties that triggered the alert (properties appearing in the alert).
-UriClickSecurityStatesTo construct, see NOTES section for URICLICKSECURITYSTATES properties and create a hash table.
-UserStatesSecurity-related stateful information generated by the provider about the user accounts related to this alert.
-VendorInformationsecurityVendorInformation To construct, see NOTES section for VENDORINFORMATION properties and create a hash table.
-VulnerabilityStatesThreat intelligence pertaining to one or more vulnerabilities related to this alert.
-WhatIf, -wiRuns the command in a mode that only reports what would happen without performing the actions.