How to export incidents and alerts in Microsoft Defender

Before you start

Use an account with 1 of the roles Microsoft lists for reading incidents: Security Reader, Global Reader, Security Operator or Security Administrator. The PowerShell example requests SecurityIncident.Read.All and SecurityAlert.Read.All; your organisation may require administrator consent.

The lists are read live, within the time your Defender data is kept. The examples read and export; they don't change an incident's status, owner or classification.

Option 1

Export incidents and alerts with PowerShell

Install the modules once, then connect and export the incidents and alerts that aren't resolved. The filter runs in Microsoft Graph, so only those come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Security -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'SecurityIncident.Read.All', 'SecurityAlert.Read.All' -NoWelcome
try {
    $filter = "status ne 'resolved'"
    $incidents = @(Get-MgSecurityIncident -All -Filter $filter |
        Select-Object Id, DisplayName, Severity, Status, AssignedTo, Classification,
            CreatedDateTime, LastUpdateDateTime, IncidentWebUrl)
    $alerts = @(Get-MgSecurityAlertV2 -All -Filter $filter |
        Select-Object Id, Title, Severity, Status, ServiceSource, IncidentId, AssignedTo,
            CreatedDateTime, AlertWebUrl)
    if ($incidents.Count -eq 0 -and $alerts.Count -eq 0) {
        Write-Output 'No incidents or alerts are open.'
    } else {
        $incidents | Sort-Object CreatedDateTime |
            Export-Csv -Path './open-incidents.csv' -NoTypeInformation -Encoding utf8
        $alerts | Sort-Object CreatedDateTime |
            Export-Csv -Path './open-alerts.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($incidents.Count) open incidents and $($alerts.Count) open alerts."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

Both files list the oldest first, and each row keeps the link that opens it in the Defender portal. IncidentId on an alert ties it to its incident. Dates are in UTC. To include incidents resolved lately, filter on lastUpdateDateTime instead, such as lastUpdateDateTime ge 2026-10-01T00:00:00Z; Microsoft lists it among the properties that support $filter, with severity, status and assignedTo.

Option 2

Export incidents in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Incidents & alerts > Incidents.
3. Choose the time range above the queue: it shows the last week until you choose another, up to Six months.
4. Check the filters. By default the queue shows New and In progress incidents of High, Medium or Low severity; add or remove filters to change that.
5. Select Export to save the filtered queue as a CSV file, up to 10,000 incidents.
6. For the alerts, go to Incidents & alerts > Alerts, which also shows the new and in progress alerts of the last 7 days by default.

This suits the day's triage. The export follows whatever filters are on screen, so 2 people exporting can get different files; for the same list every time, use PowerShell or Altivane.

Common questions

Why does the portal show fewer incidents than the export?

The incident queue starts on the last week, with New and In progress incidents of High, Medium and Low severity. Informational incidents and older ones are there, but hidden until you change the time range and the filters. The PowerShell export keeps every incident that isn't resolved, whatever its age or severity.

Why does the script return an access error?

Check the role and the consent. The signed-in account needs 1 of the roles above, and the session needs consent for both permissions. A delegated call fails if the account has the permission but not the role.

How do I see the tenant's overall security position?

Incidents show what has happened; Secure Score shows how well the tenant is set up to stop it. See how to check Secure Score in Microsoft Defender.