Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not able to query alerts generated from custom detection methods #2954

Open
tazthetyrant opened this issue Jan 11, 2024 · 0 comments
Open

Not able to query alerts generated from custom detection methods #2954

tazthetyrant opened this issue Jan 11, 2024 · 0 comments
Labels

Comments

@tazthetyrant
Copy link

Describe the bug
We have a custom detection method that creates alerts when emails from a specific domain are blocked. The category the alerts fall under is 'Collection' when querying these alerts via graph explorer or the graph security connector in power automate, the results are blank.

To Reproduce
Steps to reproduce the behavior:

  1. Create a custom detection method in security.microsoft.com

##########Detection Query##############
EmailEvents
| where SenderFromDomain in ("emaildomain.com")
| where Timestamp >= ago(1d)
| where not(DeliveryLocation has "Inbox" or DeliveryLocation has "Forwarded" or DeliveryLocation has "Deleted" or DeliveryLocation has "On-premises")
| summarize Count = count(), Timestamp = max(Timestamp), ReportId = max(ReportId) by Subject, DeliveryLocation, RecipientEmailAddress
| project Subject, DeliveryLocation, Count, Timestamp, RecipientEmailAddress, ReportId
| sort by Count desc
####################################

Custom detection method settings:

image

image

  1. run the detection method to generate alerts

image

  1. run this query in graph explorer
    -https://graph.microsoft.com/v1.0/security/alerts?$filter=category eq 'Collection'
  2. sigh

Expected behavior
Alerts created from custom detection methods or alerts with the category Collection can be queried from the Graph API

Screenshots
image
image

Desktop (please complete the following information):

  • OS: Windows 10
  • Browser: Chrome, Edge, Teams (workflows)
  • Version: current as of 1/10/24

Additional Context
I have tried querying the alerts through other means (title, severity, etc.), the API does not return any info on these alerts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant