Security Reports
Comprehensive security reporting across your Microsoft 365 environment. Monitor threats, track incidents, analyze vulnerabilities, and measure security posture improvement over time across all managed tenants.
Report Categories
Threat Reports
Active threats, malware detections, phishing attempts, and compromised accounts across all tenants.
- • Malware detection summary
- • Phishing campaign analysis
- • Compromised user accounts
- • Threat actor activity
Incident Reports
Security incidents from Microsoft Defender, their status, severity, and resolution timeline.
- • Active incidents by severity
- • Mean time to resolve (MTTR)
- • Incident trends over time
- • Cross-tenant incident correlation
Vulnerability Reports
Software vulnerabilities discovered across managed devices, with CVE details and remediation status.
- • Critical vulnerabilities
- • Exposed devices by CVE
- • Patch compliance status
- • Vulnerability age analysis
Secure Score Reports
Security posture tracking with score history, improvement trends, and benchmark comparisons.
- • Score trends over time
- • Category breakdown
- • Tenant comparisons
- • Industry benchmarks
Threat Summary
47
Active Threats
Last 24 hours
156
Blocked Attacks
Last 7 days
12
Open Incidents
Requiring action
94%
Threats Contained
Auto-remediated
| Threat Type | Count | Blocked | Tenants Affected |
|---|---|---|---|
| Malware | 234 | 229 (98%) | 18 |
| Phishing | 1,456 | 1,423 (98%) | 45 |
| Ransomware | 3 | 3 (100%) | 2 |
| Credential Theft | 89 | 76 (85%) | 12 |
Incident Analysis
Incidents by Severity
3
Critical
Immediate action
12
High
Action required
28
Medium
Review needed
156
Low/Info
Monitored
Resolution Metrics
Mean Time to Detect
4.2 min
↓ 15% from last month
Mean Time to Respond
18 min
↓ 22% from last month
Mean Time to Resolve
2.4 hrs
↓ 8% from last month
Vulnerability Overview
By Severity
Top Vulnerable Software
Secure Score Trends
Score Distribution
Category Scores (Average)
Report Filters
- Date Range — Last 24 hours, 7 days, 30 days, 90 days, or custom
- Tenant — All tenants, specific tenant, or tenant groups
- Severity — Critical, High, Medium, Low, Informational
- Category — Threats, Incidents, Vulnerabilities, Score
- Status — Active, Resolved, Investigating, False Positive
Data Sources
GET /security/alerts — Security alerts
GET /security/incidents — Security incidents
GET /security/secureScores — Secure Score data
GET /security/tiIndicators — Threat indicators
GET /deviceManagement/windowsMalwareInformation — Malware detections
API Reference
GET /api/reports/security/threatsGet threat summary across tenants
GET /api/reports/security/incidentsGet incident analysis report
GET /api/reports/security/vulnerabilitiesGet vulnerability overview
GET /api/reports/security/secure-scoreGet Secure Score trends
POST /api/reports/security/exportExport security report