Get-MgSecurityIncident

What is Get-MgSecurityIncident?

Get-MgSecurityIncident is a Microsoft Graph PowerShell cmdlet used to retrieve security incidents from Microsoft 365 Defender and related security workloads.

A security incident is a collection of correlated alerts grouped together to represent a potential attack or threat. This cmdlet allows administrators and security teams to programmatically access incident details from their tenant.

Why Use Get-MgSecurityIncident?

Get-MgSecurityIncident is useful for:

• Monitoring active and resolved security incidents
• Automating security reporting
• Investigating threats across workloads (Exchange, Teams, Endpoint, Identity, etc.)
• Exporting incident data for compliance or auditing
• Integrating incident monitoring into SOC workflows

Instead of manually reviewing incidents in the Microsoft Defender portal, administrators can use this cmdlet to retrieve, filter, and export incident data using PowerShell.

Prerequisites

Before running this cmdlet:

                                            
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "SecurityIncident.Read.All"
                                            
                                        

You must have appropriate security roles such as Security Reader or Security Administrator.

How to use Get-MgSecurityIncident?

Basic syntax:

Get-MgSecurityIncident

You can run the cmdlet directly to retrieve incidents or use parameters like -ExpandProperty to include related objects such as alerts.

Get-MgSecurityIncident Examples

Example 1: List Security Incidents

Get-MgSecurityIncident

Use this command to retrieve all available security incidents from your tenant. This is useful when you want a quick overview of incidents generated by Defender and related security products.

Example 2: List All Incidents with Their Alerts

Get-MgSecurityIncident -ExpandProperty "alerts"

This command retrieves incidents and expands the alerts relationship. This is helpful when you want to see which alerts are tied to each incident, without running separate queries.

Example 3: Export All Security Incidents

Get-MgSecurityIncident | export-csv "d:/securityincidents.csv"

This exports all incidents into a CSV file for reporting, auditing, or sharing with your security team. After export, open the CSV in Excel and filter by severity, status, or assigned analyst (depending on available properties in your tenant).

Summary

Key Point	Details
Cmdlet Name	Get-MgSecurityIncident
Purpose	Retrieves Microsoft 365 security incidents
Required Scope	SecurityIncident.Read.All
Primary Use	Security monitoring and investigation
Automation Benefit	Enables programmatic incident reporting and export
Use Case	SOC reporting, compliance audits, threat tracking