Microsoft 365 Defender

Examples for working with Microsoft 365 Defender via the Graph Security API — advanced hunting, incidents, alerts, and secure score.

---

Prerequisites

Requirement	Description	Reference
ThreatHunting.Read.All	Run advanced hunting KQL queries	Threat hunting permissions
Incidents.Read.All	List and read incidents	Incident permissions
Incidents.ReadWrite.All	Update incidents	Incident permissions
SecurityAlert.Read.All	List and read alerts (v2)	Security permissions
SecurityEvents.Read.All	Read Secure Score control profiles	Security permissions

Admin consent is required for all permissions above.

---

Examples

Scenario	File	Permission
List incidents	list_incidents.py	Incidents.Read.All
Get incident with alerts	get_incident_details.py	Incidents.Read.All
Update incident status	update_incident.py	Incidents.ReadWrite.All
List security alerts (v2)	list_alerts.py	SecurityAlert.Read.All
Run advanced hunting query	run_hunting_query.py	ThreatHunting.Read.All
Get Secure Score profiles	get_secure_score.py	SecurityEvents.Read.All

---

Quick start

from office365.graph_client import GraphClient

client = GraphClient(tenant="contoso.onmicrosoft.com").with_client_secret(
    "client_id", "client_secret"
)

incidents = client.security.incidents.get().execute_query()
for inc in incidents:
    print(f"[{inc.severity}] {inc.display_name}")

---

Official docs

• Microsoft 365 Defender overview
• Microsoft Graph Security API
• Microsoft Graph Security permissions