Governance 442

Get-DefenderIncidentReport

Summarizes open Microsoft Defender XDR incidents by severity and assigned owner, so leadership gets a clean weekly snapshot without pulling raw alert data.

Get-DefenderIncidentReport.ps1

<#
.SYNOPSIS
    Summarizes open Defender XDR incidents.

.DESCRIPTION
    Lists currently open security incidents grouped by severity and
    assigned owner, formatted as a clean summary suitable for a weekly
    leadership update without exposing raw alert level detail.

.EXAMPLE
    .\Get-DefenderIncidentReport.ps1

.NOTES
    Requires Microsoft.Graph.Security with an active Connect-MgGraph
    session and SecurityIncident.Read.All scope.

.AUTHOR
    Shehryar Hassan
#>

$incidents = Get-MgSecurityIncident -Filter "status eq 'active'" -All

$incidents | Group-Object Severity | Sort-Object Count -Descending |
    Select-Object Name, Count | Format-Table -AutoSize

$incidents | Select-Object DisplayName, Severity, AssignedTo, CreatedDateTime |
    Sort-Object CreatedDateTime | Format-Table -AutoSize

Read it before you run it, and test in a safe tenant first.