Actions619
- Alert Actions
- Application Actions
- Add Chocolatey App
- Add MSP App
- Add Multi-Tenant App
- Add Office App
- Add Store App
- Add Win32 Script App
- Add WinGet App
- Assign
- Create App Template
- Delete App Approval Template
- Exclude Licenses
- Get App Approval
- Get Many
- Get Queue
- List App Approval Templates
- List App Repository
- List Apps Repository
- List Detected App Devices
- List Detected Apps
- List Excluded Licenses
- List Potential Apps
- Patch Application
- Remove
- Remove From Queue
- Sync VPP
- Trigger App Upload
- Autopilot Actions
- Backup Actions
- CIPP Admin Actions
- Create SAM App
- Get Extension Cache Data
- Get Extension Mapping
- Get Extensions Config
- Get NinjaOne Queue
- List Extension Alerts
- List Extension Sync
- List Pending Webhooks
- Manage Partner Webhook
- Refresh CPV (All Tenants)
- Refresh CPV Permissions
- Run Combined Setup
- Run SAM Setup
- Set Backup Retention
- Set Branding
- Set DNS Config
- Set Extensions Config
- Set JIT Admin Settings
- Set Log Retention
- Set Notification Config
- Set Password Config
- Set Time Settings
- Sync Extension
- Test Extension
- CIPP Core Actions
- CIPP v10.5 Actions
- Add Assignment Filter Template
- Add DLP Compliance Policy
- Add Enrollment
- Add Group Team
- Add Retention Compliance Policy
- Add Sensitive Info Type
- Add Sensitivity Label
- Add User Bulk
- Assign Policy
- Edit Assignment Filter
- Edit DLP Compliance Policy
- Edit Retention Compliance Policy
- Edit Sensitive Info Type
- Edit Sensitivity Label
- Execute Assignment Filter Delete
- Execute Mailbox Restore
- Execute MCP
- Execute SharePoint Version Cleanup
- List ActiveSync Devices
- List Android Enrollment Profiles
- List Apple Enrollment Profiles
- List Assignment Filter Templates
- List CSP SKU
- List DLP Compliance Policy
- List HVE Accounts
- List Licenses Report
- List Mailbox Restores
- List Retention Compliance Policy
- List Sensitive Info Type
- List Sensitivity Label
- List Snoozed Alerts
- Patch User
- Remove Admin Role
- Remove Assignment Filter Template
- Remove DLP Compliance Policy
- Remove Enrollment Profile
- Remove Retention Compliance Policy
- Remove Sensitive Info Type
- Remove Sensitivity Label
- Remove Snooze
- Set CAS Mailbox
- Set Package Tag
- Snooze Alert
- CIPP v10.6 Actions
- Add Intune Policy Clone
- Execute Add CVE Exception
- Execute Backup Replication Config
- Execute Bulk Remove Sharing Links
- Execute Copilot Settings
- Execute GDAP Repair Role Mappings
- Execute Remove CVE Exception
- Execute Remove SharePoint External User
- Execute Remove Sharing Link
- Execute Remove Site User
- Execute Restore Deleted Site
- Execute Restore Recycle Bin Items
- Execute SAM Certificate
- Execute Set Library Permission
- Execute Set Site Properties
- Execute Shadow AI Sanction
- List Active Alert Results
- List Agent 365 Packages
- List Audit Log Coverage
- List Copilot Settings
- List Copilot Usage
- List CVE Management
- List Deleted Sites
- List Sensitive Info Type Rule Package
- List Shadow AI
- List SharePoint External Users
- List SharePoint Sharing
- List SharePoint Version Cleanup
- List Site Libraries
- List Site Properties
- List Site Recycle Bin
- Conditional Access Actions
- Contact Actions
- Device Actions
- Email Security Actions
- Add Connection Filter
- Add Exchange Connector
- Add Spam Filter
- Add Tenant Allow/Block List
- Add Transport Rule
- Edit Anti-Phishing Filter
- Edit Exchange Connector
- Edit Malware Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Connection Filters
- List Exchange Connectors
- List Malware Filters
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- List Tenant Allow/Block List
- List Transport Rules
- Remove Exchange Connector
- Remove Spam Filter
- Remove Tenant Allow/Block List
- Remove Transport Rule
- Exchange Resource Actions
- GDAP Actions
- Group Actions
- Identity Actions
- Intune Actions
- Mailbox Actions
- Add Shared Mailbox
- Convert
- Copy for Sent
- Create High Volume Email
- Edit Calendar Permissions
- Edit Mailbox Permissions
- Enable Archive
- Enable Auto-Expand Archive
- Enable Auto-Expanding Archive
- Hide From GAL
- High Volume Email
- List Calendar Permissions
- List Contact Permissions
- List Global Address List
- List Mailbox CAS Settings
- List Mailbox Details
- List Mailbox Forwarding
- List Mailbox Mobile Devices
- List Mailbox Permissions
- List Mailbox Restores
- List Mailbox Rules
- List Mailboxes
- List Message Trace
- List Mobile Devices
- List Out of Office
- List Restricted Users
- List Shared Mailbox Account Enabled
- List Shared Mailbox Statistics
- Manage Mobile Device
- Manage Mobile Devices
- Manage Retention Policies
- Manage Retention Tags
- Modify Contact Permissions
- Remove Mailbox Rule
- Remove Restricted User
- Repair Exchange Role
- Restore Mailbox
- Run Exchange Request
- Schedule Mailbox Vacation
- Schedule OOO Vacation
- Send Org Message
- Set Calendar Processing
- Set Default Calendar Permissions
- Set Default Contact Permissions
- Set Default Mailbox Permissions
- Set Email Forwarding
- Set Email Size
- Set Litigation Hold
- Set Locale
- Set Mailbox Email Size
- Set Mailbox Locale
- Set Mailbox Quota
- Set Mailbox Retention Policy
- Set Mailbox Rule
- Set Out of Office
- Set Recipient Limits
- Set Retention Hold
- Start Managed Folder Assistant
- OneDrive Actions
- Policy Actions
- Add
- Add Assignment Filter
- Add Assignment Filter Template
- Add Defender Deployment
- Add Intune Template
- Add Reusable Setting
- Add Reusable Setting Template
- Assign
- Delete Assignment Filter
- Edit Assignment Filter
- Edit Intune Policy
- Edit Intune Script
- Edit Policy
- Exec Device Passcode Action
- Get Many
- List App Protection Policies
- List Assignment Filter Templates
- List Assignment Filters
- List Compliance Policies
- List Defender State
- List Defender TVM
- List Intune Intents
- List Intune Scripts
- List Intune Templates
- List Reusable Setting Templates
- List Reusable Settings
- Remove
- Remove Assignment Filter Template
- Remove Intune Script
- Remove Intune Template
- Remove Reusable Setting
- Remove Reusable Setting Template
- Quarantine Actions
- Safe Link Actions
- Scheduled Item Actions
- SharePoint Actions
- Spam Filter Actions
- Add Quarantine Policy
- Add Spam Filter
- Add Spam Filter Template
- Add Tenant Allow/Block List Entry
- Edit Anti-Phishing Filter
- Edit Malware Filter
- Edit Quarantine Policy
- Edit Safe Attachments Filter
- Edit Spam Filter
- List Anti-Phishing Filters
- List Malware Filters
- List Quarantine Policies
- List Safe Attachments Filters
- List Spam Filter Templates
- List Spam Filters
- Remove Quarantine Policy
- Remove Spam Filter
- Remove Spam Filter Template
- Standard Actions
- Add BPA Template
- Add Standard Template
- Add Standards Deploy
- Add Standards Template
- Clone Drift
- Compare Standards
- Convert Standards
- Deploy Standards
- Exec BPA
- Exec Domain Analyser
- Exec Drift Clone
- Get Domain Health
- List BPA
- List BPA Reports
- List BPA Results
- List BPA Templates
- List Domain Analyser
- List Domain Health
- List Standard Templates
- List Standards
- List Tenant Alignment
- List Tenant Drift
- Remove BPA Template
- Remove Standard
- Remove Standard Template
- Run All Standards
- Run BPA
- Run Domain Analyser
- Run Standards
- Update Drift Deviation
- Team Actions
- Teams Shift Actions
- List Shifts
- Create Shift
- Update Shift
- Delete Shift
- List Open Shifts
- Create Open Shift
- Update Open Shift
- Delete Open Shift
- List Scheduling Groups
- Create Scheduling Group
- Update Scheduling Group
- Delete Scheduling Group
- List Time Off Reasons
- Create Time Off Reason
- Update Time Off Reason
- Delete Time Off Reason
- List Time Off Requests
- Create Time Off Request
- Approve Time Off Request
- Decline Time Off Request
- List Swap Shift Requests
- Create Swap Shift Request
- Approve Swap Shift Request
- Decline Swap Shift Request
- List Offer Shift Requests
- Create Offer Shift Request
- Approve Offer Shift Request
- Decline Offer Shift Request
- Tenant Actions
- Add
- Add Domain
- Add SPN
- Add Tenant (by Token)
- Clear Cache
- CSP License Action
- Delete Tenant Group
- Edit
- Edit Offboarding Defaults
- Exclude Tenant
- Get CSP Licenses
- Get Details
- Get Licenses
- Get Many
- Get Offboarding Job
- Get Secure Score
- List App Consent Requests
- List CSP SKUs
- List Defender State
- List Domains
- List OAuth Apps
- List Service Health
- List Service Principals
- List Tenant Allow/Block List
- List Tenant Groups
- List Tenant Onboarding
- Offboard
- Onboard
- Remove Allow/Block Entry
- Remove Capabilities Cache
- Remove Domain
- Remove Tenant
- Run Access Checks
- Run Tenant Group Rule
- Set Auth Method
- Update Secure Score
- Testing Actions
- Tool Actions
- Transport Actions
- Add Connection Filter
- Add Connection Filter Template
- Add Connector
- Add Connector Template
- Add or Edit Rule
- Add Rule
- Add Rule Template
- Edit Connector
- Edit Rule
- List Connection Filter Templates
- List Connection Filters
- List Connector Templates
- List Connectors
- List Rule Templates
- List Rules
- Remove Connection Filter Template
- Remove Connector
- Remove Connector Template
- Remove Rule
- Remove Rule Template
- User Actions
- Add
- Add Guest
- Add JIT Template
- Add User Defaults
- Add Users (Bulk)
- BEC Check
- BEC Remediate
- Clear Immutable ID
- Create TAP
- Disable
- Dismiss Risky User
- Edit
- Edit JIT Template
- Edit User Aliases
- Enable
- Execute JIT Admin
- Get Many
- List Inactive Accounts
- List JIT Admin
- List JIT Templates
- List MFA Users
- List New User Defaults
- List Per-User MFA
- List Sign-Ins
- List Trusted/Blocked Senders
- List User CA Policies
- List User Counts
- List User Devices
- List User Groups
- List User Mailbox Details
- List User Mailbox Rules
- List User Photo
- List User Settings
- List User Sign-In Logs
- List Users
- List Users and Groups
- Offboard
- Patch User
- Remove
- Remove JIT Template
- Remove Trusted/Blocked Sender
- Remove User Default Template
- Reprocess Licenses
- Reset MFA
- Reset Password
- Revoke Sessions
- Send MFA Push
- Set Password Never Expires
- Set Per-User MFA
- Set User Photo
- Trigger Bulk License
- Voice Actions
- Workflow Actions
Alert → Get Security Incidents
AI-generatedSummary
Retrieves security incidents for the selected tenant from CIPP, returning all results or a limited number.
Inputs
- Tenant (required) — Select a tenant from the list or enter its domain.
- Return All — When enabled, returns all matching incidents; defaults to false.
- Limit — Maximum incidents to return when Return All is disabled; defaults to 50 and accepts values from 1 to 500.
Output shape
A list of security incident records.
The response is limited to 50 incidents by default; enable Return All to request all results, or adjust Limit.