CmdID

CmdID / PowerShell / Cmdlets / Update

Update-MgSecurityAlertV2

Update the properties of an alert object in an organization based on the specified alert id property. Microsoft Graph PowerShell reference

From the Microsoft Graph PowerShell reference 50 parameters Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

50 in the Microsoft Graph PowerShell reference
Show its 50 parameters
-ActorDisplayNameThe adversary or activity group that is associated with this alert.
-AdditionalDatadictionary
-AdditionalPropertiesAdditional Parameters
-AlertIdThe unique identifier of alert
-AlertPolicyIdThe ID of the policy that generated the alert, and populated when there is a specific policy that generated the alert, whether configured by a customer or a built-in policy.
-AlertWebUrlURL for the Microsoft 365 Defender portal alert page.
-AssignedToOwner of the alert, or null if no owner is assigned.
-BodyParameteralert To construct, see NOTES section for BODYPARAMETER properties and create a hash table.
-BreakWait for .NET debugger to attach
-CategoriesThe attack kill-chain categories that the alert belongs to.
-CategoryThe attack kill-chain category that the alert belongs to.
-ClassificationalertClassification
-CommentsArray of comments created by the Security Operations (SecOps) team during the alert management process.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-CreatedDateTimeTime when Microsoft 365 Defender created the alert.
-CustomDetailsdictionary
-DescriptionString value describing each alert.
-DetectionSourcedetectionSource
-DetectorIdThe ID of the detector that triggered the alert.
-DeterminationalertDetermination
-EvidenceCollection of evidence related to the alert.
-FirstActivityDateTimeThe earliest activity associated with the alert.
-HeadersOptional headers that will be added to the request.
-HttpPipelineAppendSendAsync Pipeline Steps to be appended to the front of the pipeline
-HttpPipelinePrependSendAsync Pipeline Steps to be prepended to the front of the pipeline
-IdThe unique identifier for an entity.
-IncidentIdUnique identifier to represent the incident this alert resource is associated with.
-IncidentWebUrlURL for the incident page in the Microsoft 365 Defender portal.
-InputObjectIdentity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.
-InvestigationStateinvestigationState
-LastActivityDateTimeThe oldest activity associated with the alert.
-LastUpdateDateTimeTime when the alert was last updated at Microsoft 365 Defender.
-MitreTechniquesThe attack techniques, as aligned with the MITRE ATT&CK framework.
-ProductNameThe name of the product which published this alert.
-ProviderAlertIdThe ID of the alert as it appears in the security provider product that generated the alert.
-ProxyThe URI for the proxy server to use
-ProxyCredentialCredentials for a proxy server to use for the remote call
-ProxyUseDefaultCredentialsUse the default credentials for the proxy
-RecommendedActionsRecommended response and remediation actions to take in the event this alert was generated.
-ResolvedDateTimeTime when the alert was resolved.
-ResponseHeadersVariable, -RHVOptional Response Headers Variable.
-ServiceSourceserviceSource
-SeverityalertSeverity
-StatusalertStatus
-SystemTagsThe system tags associated with the alert.
-TenantIdThe Microsoft Entra tenant the alert was created in.
-ThreatDisplayNameThe threat associated with this alert.
-ThreatFamilyNameThreat family associated with this alert.
-TitleBrief identifying string value describing the alert.
-WhatIf, -wiRuns the command in a mode that only reports what would happen without performing the actions.