Get-MgSecurityIncidentAlert

What is Get-MgSecurityIncidentAlert?

Get-MgSecurityIncidentAlert is a Microsoft Graph PowerShell cmdlet that retrieves security incident alert information from Microsoft 365 Defender and the Microsoft Security portal.

It helps administrators view alert records that are linked to security incidents, such as suspicious sign-ins, malware detection, phishing attempts, or endpoint threats.

Why Use Get-MgSecurityIncidentAlert?

This cmdlet is especially useful for security teams and Microsoft 365 administrators because it enables:

• Automated retrieval of security alert data
• Faster investigation of incidents across the tenant
• Exporting alert details for compliance and auditing
• Integrating alert monitoring into PowerShell-based SOC workflows
• Reviewing security activity without manually opening the Defender portal

Prerequisites

Before running this cmdlet, ensure:

• Microsoft Graph PowerShell module is installed
• You are connected with the correct security permissions

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "SecurityEvents.Read.All"
                                        

Security alert access typically requires Defender or Security Administrator roles.

How to use Get-MgSecurityIncidentAlert?

Basic syntax:

Get-MgSecurityIncidentAlert

You can run the cmdlet directly to list available incident alerts, or pipe the output into reporting tools such as CSV exports.

Get-MgSecurityIncidentAlert Examples

Example 1: List Security Incident Alert

Get-MgSecurityIncidentAlert

This command lists security incident alert details available in your tenant. It’s useful when you want to quickly review alert records and investigate security activity.

Example 2: Export Security Incident Alert Details

Get-MgSecurityIncidentAlert | Export-CSV "d:/securityincident.csv"

This exports the security incident alert output into a CSV file for reporting, analysis, and auditing.

Note (Important)

To fetch security incident alert details for a specific incident, you need the IncidentId.
You can get the IncidentId by running:

Get-MgSecurityIncident

Once you have the IncidentId, you can narrow your investigation to alerts tied to that incident.

Summary

Key Point	Details
Cmdlet Name	Get-MgSecurityIncidentAlert
Purpose	Retrieves alert details linked to Microsoft 365 security incidents
Required Scope	SecurityEvents.Read.All
Primary Use	Security incident investigation and alert monitoring
Automation Benefit	Enables programmatic alert auditing and reporting
Use Case	SOC workflows, compliance reporting, threat response