Microsoft Defender APIInstall

Summary

Update a Microsoft Defender security alert's details such as assigned user, classification, comment, determination, and status using the alert's unique Alert ID.

Inputs

• Authentication (required) — Select OAuth2 authentication as required by this operation.
• Alert ID (required) — The unique identifier of the alert to update.
• Update Fields — Optional fields to update within the alert, including Assigned To (email), Classification (False Positive, True Positive, Benign Positive), Comment, Determination (conditioned on classification), and Status (New, In Progress, Resolved).

Output shape

a single updated alert record as returned by the PATCH API call

The operation sends a PATCH request to /api/alerts/{{ alertId }} with specified update fields in the body; the response contains the updated alert data. Only fields provided in Update Fields are modified; others remain unchanged.

Examples

Example 1: Update an alert's status to Resolved and assign it to a user

Set Alert ID to the alert's ID, Update Fields to include Status as Resolved and Assigned To as the user's email address.

Links

• n8n community nodes installation guide