Actions129
- Calendar Permission Actions
- CIPP Administration Actions
- Execute API Client (GET)
- Execute Auto Backup
- Execute Extension Mapping (GET)
- Execute Extension Mapping (POST)
- Execute Extension Sync
- Execute Extensions Config
- Execute Password Config (POST)
- Execute Restore Backup
- Execute Run Backup
- List Custom Roles
- List Extension Sync
- List Logs
- List Scheduled Items
- Remove Scheduled Item
- Execute API Client (POST)
- Execute Extension Test
- Execute Password Config (GET)
- List Backups
- List Function Parameters
- Group Actions
- Intune Actions
- Add MSP App
- Add Office App
- Add Policy
- Add Store App
- Assign App
- Assign Autopilot Device
- Device Action
- Get Recovery Key
- List Applications
- List Application Queue
- List Autopilot Config
- List Devices
- List Intune Scripts
- List Intune Templates
- Remove Autopilot Device
- Remove Policy
- Remove Queued App
- Add Choco App
- Add WinGet App
- Assign Policy
- Get Local Admin Password
- List Autopilot Devices
- List Intune Policies
- Remove App
- Remove Intune Script
- Sync Autopilot Devices
- License Actions
- Security & Compliance Actions
- Teams & SharePoint Actions
- Tenant Actions
- Add Alert
- Clear Tenant Cache
- Execute CA Exclusion
- Execute Named Location
- Get Tenant
- List Alerts Queue
- List Azure AD Connect Status
- List Conditional Access Policies
- List Named Locations
- List Shared Mailbox Statistics
- List Standards
- List Tenants
- Remove Standard Template
- Add Named Location
- Edit Tenant
- Execute Standards Run
- List Audit Logs
- List CSP Licenses
- List Roles
- List Standard Templates
- Tool Actions
- User Actions
- Add User
- Exec Restore Deleted User
- List User
- List User Conditional Access Policies
- List User Groups
- Clear Immutable ID
- Create Temporary Access Password
- Delete User Device
- Dismiss Risky User
- List Deleted Items
- List Inactive Accounts
- List Sign-Ins
- Remove User
- Reset MFA
- Restore Deleted Item
- Revoke Sessions
- Set Email Forward
- Set Per-User MFA
- List All Users
- List User Counts
- List User Devices
- Convert Mailbox
- Disable User
- Enable Archive
- List MFA Users
- Offboard User
- Reset Password
- Send MFA Push
- Set Out of Office
Overview
This node interacts with the CIPP API to list security alerts related to a specified tenant in a Security & Compliance context. It is useful for monitoring and managing security alerts within an organization's tenant, helping security teams stay informed about potential issues or threats. For example, it can be used to fetch alerts for a tenant identified by its ID or domain name, enabling automated workflows for alert handling or reporting.
Use Case Examples
- Fetch all security alerts for a tenant by specifying the tenant ID or domain name.
- Automate alert monitoring by periodically listing alerts and triggering notifications or remediation workflows.
Properties
| Name | Meaning |
|---|---|
| Tenant Filter | The tenant ID or domain name used to filter the alerts for a specific tenant. |
| Request Options | Settings to control request behavior such as batching, SSL certificate validation, proxy usage, and request timeout. |
Output
JSON
alerts- Array of security alerts retrieved for the specified tenant.
Dependencies
- Requires an API key credential for authenticating with the CIPP API.
Troubleshooting
- Ensure the tenant ID or domain name is correctly specified; incorrect values may result in no alerts being returned.
- If SSL certificate validation fails and 'Ignore SSL Issues' is not enabled, requests may be blocked; enable this option cautiously if needed.
- Proxy settings must be correctly configured if used; incorrect proxy details can cause request failures.
- Timeout settings should be adjusted based on network conditions to avoid premature request termination.