Consolidated reference for collecting SIEM-related datapoints from the Microsoft Graph API. Based on the Devo Microsoft Graph collector.
This document provides a reference for collecting SIEM-related datapoints from Microsoft Graph API, including endpoints, permissions, and descriptions of each data source. It is suitable for ingestion into SIEM platforms such as ELK / ElasticSearch, Devo, or others.
The Microsoft Graph API exposes multiple security and audit datasets that can be ingested into SIEM platforms such as ELK / ElasticSearch, Devo, or others. These datasets include:
- Sign-in activity
- Security alerts
- Secure score metrics
- Directory and provisioning audit logs
| Data Source | Graph Resource | Description | Required Permissions | Endpoint (REST) | Documentation |
|---|---|---|---|---|---|
| Sign-ins | signIns |
Contains user authentication activity including login attempts, MFA usage, and conditional access results. Useful for detecting suspicious login behavior. | AuditLog.Read.All Directory.Read.All |
GET signIns | signIn resource |
| Sign-ins (v2 - beta) | signIns_v2 |
Enhanced version of sign-in logs with additional fields and improvements. Use for advanced detection but note it is in beta. | AuditLog.Read.All Directory.Read.All |
GET signIns (beta) | signIn resource (beta) |
| Legacy Alerts | alerts |
Older security alerts from Microsoft security products. Being phased out in favor of alerts_v2. | SecurityEvents.Read.All | GET alerts | alert resource |
| Alerts (v2) | alerts_v2 |
Unified security alerts from Microsoft Defender products. Includes incidents, severity, status, and evidence. Primary source for SOC monitoring. | SecurityAlert.Read.All | GET alerts_v2 | list alerts_v2 |
| Secure Scores | secureScores |
Provides tenant security posture score over time. Useful for compliance tracking and risk posture monitoring. | SecurityEvents.Read.All | GET secureScores | list secureScores |
| Secure Score Control Profiles | secureScoreControlProfiles |
Detailed breakdown of security controls contributing to secure score. Helps identify gaps and remediation actions. | SecurityEvents.Read.All | GET secureScoreControlProfiles | list secureScoreControlProfiles |
| Directory Audit Logs | directoryAudits |
Tracks changes in Azure AD such as user creation, role assignments, and policy changes. Critical for identity auditing. | AuditLog.Read.All Directory.Read.All |
GET directoryAudits | list directoryAudits |
| Provisioning Logs | provisioningObjectSummary |
Logs related to provisioning activities (e.g., user sync, SCIM, app provisioning). Useful for identity lifecycle monitoring. | AuditLog.Read.All Directory.Read.All |
GET provisioning logs | provisioningObjectSummary resource |
| Data Source | API Path | Description | Resource Type | Cursor Checkpoint |
|---|---|---|---|---|
| Audit logs - sign-ins | v1.0/auditLogs/signIns |
Standard sign-in activity logs | High-volume immutable events | createdDateTime + id |
| Audit logs - sign-ins (v2) | beta/auditLogs/signIns |
Enhanced sign-in logs (beta) | High-volume immutable events | createdDateTime + id |
| Legacy Alerts | v1.0/security/alerts |
Deprecated alert format | Deprecated | Deprecated |
| Alerts (v2) | v1.0/security/alerts_v2 |
Modern unified alerting system | Mutable operational objects | lastUpdateDateTime + id |
| Secure Scores | v1.0/security/secureScores |
Tenant security scoring | Periodic snapshot | createdDateTime + id |
| Secure Score Control Profiles | v1.0/security/secureScoreControlProfiles |
Security control details | Small reference/configuration objects | None (no cursor state) |
| Directory Audit Logs | v1.0/auditLogs/directoryAudits |
Azure AD audit trail | High-volume immutable events | activityDateTime + id |
| Provisioning Logs | v1.0/auditLogs/provisioning |
Identity provisioning events | High-volume immutable events | activityDateTime + id |
| Microsoft Graph Endpoint | Data Type | Update Characteristics | Recommended CEL Poll Interval | Reason |
|---|---|---|---|---|
Sign-In Logs (/auditLogs/signIns) |
High-volume events | Near real-time | 1 minute | Authentication events occur continuously. Microsoft Defender and SIEMs typically poll every 1–5 minutes. |
Sign-In Logs (v2) (/beta/auditLogs/signIns) |
High-volume events | Near real-time | 1 minute | Authentication events occur continuously. Microsoft Defender and SIEMs typically poll every 1–5 minutes. |
Security Alerts (/security/alerts_v2) |
Mutable security objects | Frequent updates | 2–5 minutes | Alert status, severity, assignment, and investigation state can change repeatedly. |
Secure Score (/security/secureScores) |
Daily snapshot | Once per day | 24 hours | Microsoft publishes a daily Secure Score. Polling more frequently usually returns the same snapshot. |
Secure Score Control Profiles (/security/secureScoreControlProfiles) |
Configuration/reference objects | Infrequent | 12–24 hours | Control definitions change infrequently. A daily synchronization is generally sufficient. |
Directory Audit (/auditLogs/directoryAudits) |
Audit events | Near real-time | 1 minute | Administrative changes should be ingested quickly for auditing and detections. |
Provisioning Logs (/auditLogs/provisioning) |
Provisioning events | Medium frequency | 5 minutes | Provisioning jobs are asynchronous and do not require minute-level polling in most environments. |
- Prefer alerts_v2 over legacy alerts for modern deployments.
- Use signIns (v1) for production stability; use v2 (beta) only if needed.
- Use lastUpdateDateTime filtering when polling to avoid duplicate ingestion.
- Ensure pagination handling using
@odata.nextLink. - Consider using TCP over UDP when forwarding logs (for reliability).
- Normalize timestamps to
@timestampfor Elasticsearch compatibility.
| Use Case | Recommended Data Source |
|---|---|
| Suspicious login detection | signIns |
| Incident monitoring | alerts_v2 |
| Compliance reporting | directoryAudits |
| Identity lifecycle tracking | provisioning logs |
| Security posture monitoring | secureScores |
- Microsoft Graph API
- Microsoft Graph API Beta
- Devo Microsoft Graph Collector Docs
- Devo: Endpoints accessed by the Microsoft Graph collector
- ElasticSearch Python client
Some endpoints (e.g., beta APIs) may change and are not guaranteed for production use. Always validate against Microsoft’s latest documentation.