Get-DefenderAlertReport

<#
.SYNOPSIS
    Summarizes Microsoft Defender alerts over a given period.

.DESCRIPTION
    Pulls Defender alerts for the last N days and groups them by
    severity and category, so a spike in a particular alert type stands
    out instead of getting lost while scrolling the security portal.

.PARAMETER Days
    How many days back to look. Defaults to 7.

.EXAMPLE
    .\Get-DefenderAlertReport.ps1 -Days 14

.NOTES
    Requires Microsoft.Graph.Security with an active Connect-MgGraph
    session and SecurityAlert.Read.All scope.

.AUTHOR
    Shehryar Hassan
#>

param(
    [int]$Days = 7
)

$cutoff = (Get-Date).AddDays(-$Days).ToString("o")
$alerts = Get-MgSecurityAlert -Filter "createdDateTime ge $cutoff" -All

$alerts | Group-Object Severity | Sort-Object Count -Descending |
    Select-Object Name, Count | Format-Table -AutoSize

$alerts | Group-Object Category | Sort-Object Count -Descending |
    Select-Object -First 10 Name, Count | Format-Table -AutoSize

Write-Host "$($alerts.Count) alert(s) in the last $Days day(s)" -ForegroundColor Cyan