Integration

Microsoft Graph Security integration

Microsoft Defender XDR security operations through Microsoft Graph v1.0: list and read alerts and incidents, triage them (status, classification, determination, owner, severity, tags), comment on them, read the tenant's daily Microsoft Secure Score and its controls, and read Microsoft Threat Intelligence articles, threat actor and tool profiles and CVE details. Every write acts for real in the Microsoft Defender portal. To protect personal data, responses never include alert evidence (devices, users, IP addresses, mailboxes, files), the open custom and additional detail dictionaries, owners (assignedTo), lastModifiedBy or comment authors. Not exposed: moving alerts between incidents and merging incidents, advanced hunting queries (rows of arbitrary tenant data), legacy alerts (deprecated), attack simulation, eDiscovery, audit log queries, analyzed emails, Defender for Identity sensors, threat intelligence hosts, indicators, WHOIS and passive DNS, records management and the Secure Score control update (its documented body is vendor information only). Limits: 150 requests per minute per app per tenant on alerts and Secure Score, and 10,000 requests per 10 minutes with 4 concurrent requests on Secure Score. Threat intelligence needs a Microsoft Defender XDR or Microsoft Sentinel license. Authentication: OAuth 2.0 with the Microsoft identity platform (work or school accounts), delegated scopes SecurityAlert.ReadWrite.All, SecurityIncident.ReadWrite.All, SecurityEvents.Read.All and ThreatIntelligence.Read.All, which need a tenant administrator's consent; the signed-in user also needs a Defender role that allows the action.

Connect Microsoft Graph Security How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Microsoft Graph Security.Built from the 17 Microsoft Graph Security tools below, on the connection you add once.

What you can do with Microsoft Graph Security

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Alert, 3 operations

get_alertGet alertGETGets one alert: title, description, recommended actions, severity, status, classification, determination, detection source, MITRE techniques, comments and timestamps.
list_alertsList alertsGETLists Microsoft 365 Defender alerts (newest first) with severity, status, classification, MITRE techniques and the incident they belong to.
update_alertUpdate alertPATCHChanges an alert for real in Microsoft Defender: status, classification, determination or owner. Only the fields sent change. Returns the updated alert.

Incident, 3 operations

get_incidentGet incidentGETGets one incident: name, description, summary, severity, status, classification, determination, priority score, tags and comments.
list_incidentsList incidentsGETLists Microsoft 365 Defender incidents (groups of correlated alerts) with severity, status, classification, priority score and tags.
update_incidentUpdate incidentPATCHChanges an incident for real in Microsoft Defender: status, classification, determination, severity, owner, name, tags or resolving comment. Only the fields sent change.

Secure score, 2 operations

get_secure_scoreGet secure scoreGETGets one daily Microsoft Secure Score report: current and maximum score, enabled services, per-control scores and comparative averages.
list_secure_scoresList secure scoresGETLists the tenant's daily Microsoft Secure Score reports: current and maximum score, per-control scores and comparative averages.

Secure score control profile, 2 operations

get_secure_score_control_profileGet secure score control profileGETGets one Secure Score control: title, category, maximum score, rank, tier, cost, user impact, threats mitigated, remediation and its state.
list_secure_score_control_profilesList secure score control profilesGETLists the Secure Score controls (recommended security actions) with category, maximum score, rank, cost, user impact and remediation text.

Threat intelligence article, 2 operations

get_threat_intelligence_articleGet threat intelligence articleGETGets one threat intelligence article with its full formatted body, summary, tags and dates.
list_threat_intelligence_articlesList threat intelligence articlesGETLists Microsoft Defender Threat Intelligence articles (threat reports) with title, summary, tags and dates. Needs a Defender XDR or Sentinel license.

Threat intelligence intel profile, 2 operations

get_threat_intelligence_intel_profileGet threat intelligence intel profileGETGets one intel profile (threat actor or tool): aliases, countries of origin, targets, description, summary and tradecraft.
list_threat_intelligence_intel_profilesList threat intelligence intel profilesGETLists threat intelligence intel profiles (threat actors and tools) with aliases, targets, summary and first activity date.

Alert comment, 1 operation

add_alert_commentAdd alert commentPOSTAdds a comment to an alert for real (visible to all analysts in Microsoft Defender). Returns every comment of the alert.

Incident comment, 1 operation

add_incident_commentAdd incident commentPOSTAdds a comment to an incident for real (visible to all analysts in Microsoft Defender). Returns every comment of the incident.

Threat intelligence vulnerability, 1 operation

get_threat_intelligence_vulnerabilityGet threat intelligence vulnerabilityGETGets a vulnerability (CVE) from threat intelligence: severity, CVSS v2 and v3 summaries, priority score, exploit flags, references and remediation.

Use Microsoft Graph Security from Claude Code, Cursor or Codex

Connect Microsoft Graph Security in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Microsoft Graph Security operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Microsoft Graph Security

Create your workspace
Sign up free. Nothing to install.
Connect Microsoft Graph Security once
Add your Microsoft Graph Security connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.