Microsoft Defender XDR icon

Microsoft Defender XDR

Interact with the Microsoft Defender XDR API

Actions3

Incident → Get Many

AI-generated

Summary

Retrieve multiple incidents from Microsoft Defender XDR using optional OData operators to filter, limit, and skip results.

Inputs

  • OData Operators — Use OData expressions to filter (by ID, name, description, cvssV3, publishedOn, severity, updatedOn), limit, or paginate the incidents returned. This includes 'Filter' (string), 'Top' (number of results, default 10), and 'Skip' (number of results to omit, default 0).
  • Request Options — Configure request-level settings such as batching (split input into batches with customizable size and interval), ignoring SSL certificate issues, using an HTTP proxy, and request timeout in milliseconds.

Output shape

a list of incident objects from Microsoft Defender XDR matching the specified OData query parameters.

The query supports OData operators sent as query parameters. Pagination can be controlled via 'Top' and 'Skip'. The output is the collection of incidents from the GET /api/incidents endpoint.

Examples

Example 1: Fetch up to 5 active incidents with severity high updated after a specific date

Set the 'Filter' to severity eq 'High' and updatedOn gt 2024-01-01, 'Top' to 5, and 'Skip' to 0.

Links

Discussion