`client.incidents`¶

List incidents and look up a single incident by ID.

Property¶

client.incidents

Methods¶

get_all() -> IncidentResults: list all incidents in the tenant.
get(id: str) -> IncidentResults: fetch one incident by ID.

Notes¶

Both methods return lazy BaseResults subclasses; call to_dicts(), to_arrow(), or to_polars() to materialize.
get() sets single=True so the result wraps a single record.
Defender docs: Get incidents, Get incident by ID.

API¶

IncidentResults ¶

IncidentResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results from the /api/incidents endpoint.

IncidentsEndpoint ¶

IncidentsEndpoint(http: Client, auth: MSALAuth)

Endpoint for /api/incidents.

get_all ¶

get_all() -> IncidentResults

Get all incidents.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-incidents

get ¶

get(id: str) -> IncidentResults

Get a single incident by ID.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-incident-by-id

client.incidents¶