Get service alerts (Graph)

Connect-MgGraph -Scopes SecurityEvents.Read.All -NoWelcome

Connect-MgGraph -Scopes SecurityEvents.Read.All -NoWelcome
 
[array]$Alerts = Get-MgSecurityAlert -All -PageSize 999
If (!$Alerts) {
    Write-Host "No security found"
    Break
}
 
$Report = [System.Collections.Generic.List[Object]]::new()
 
ForEach ($Alert in $Alerts) {
    $ExtraInfo = $Null
    Switch ($Alert.Title) {
        "Email messages containing phish URLs removed after delivery" {
             $User = $Alert.UserStates.UserPrincipalName[1]
        }
        "User restricted from sending email" {
            $User = $Alert.UserStates.UserPrincipalName
        }
        "Data Governance Activity Policy" {
            $User = "N/A"
        }
        "Admin Submission Result Completed" {
            $User = $Alert.UserStates.UserPrincipalName[0]
            $ExtraInfo = "Email from " + $Alert.UserStates.UserPrincipalName[1] + " reported for " + $Alert.UserStates.UserPrincipalName[2]
        }
        Default {
            $User = $Alert.UserStates.userPrincipalName
        }
    } # End Switch
 
    If ([string]::IsNullOrEmpty($Alert.Description)) {
        $AlertDescription = "Office 365 alert"
    } Else {
        $AlertDescription = $Alert.Description
    }
 
    # Unpack comments
    [String]$AlertComments = $Null; $i = 0
    ForEach ($Comment in $Alert.Comments) {
        If ($i -eq 0) {
            $AlertComments = $Comment; $i++
        } Else {
            $AlertComments = $AlertComments + "; " + $Comment
        }
    }
 
    Switch ($Alert.Status) {
        "newAlert"   { $Color = "ff0000"  }
        "inProgress" { $Color = "ffff00"  }
        "Default"    { $Color = "00cc00"  }
    }
 
    $ReportLine = [PSCustomObject][Ordered]@{
        Title       = $Alert.Title
        Category    = $Alert.Category
        User        = $User
        Description = $AlertDescription
        Date        = Get-Date($Alert.EventDateTime) -format g
        Status      = $Alert.Status
        Severity    = $Alert.Severity
        ViewAlert   = $Alert.SourceMaterials[0]
        Comments    = $AlertComments
        ExtraInfo   = $ExtraInfo
        Color       = $Color
    }
    $Report.Add($ReportLine)
 
} # End ForEach
 
$Report | Out-GridView -Title "Office 365 Security Alerts" -PassThru