Get-PurviewInsiderRiskAlertReport

<#
.SYNOPSIS
    Summarizes open Insider Risk Management alerts.

.DESCRIPTION
    Pulls open insider risk alerts and groups them by risk level and
    triggering policy, giving a quick read on whether insider risk
    signals are trending up without opening individual case files one
    by one.

.EXAMPLE
    .\Get-PurviewInsiderRiskAlertReport.ps1

.NOTES
    Requires the ExchangeOnlineManagement module connected to Security &
    Compliance PowerShell (Connect-IPPSSession) with Insider Risk
    Management permissions.

.AUTHOR
    Shehryar Hassan
#>

$alerts = Get-InsiderRiskAlert -Status Active -ErrorAction SilentlyContinue

if (-not $alerts) {
    Write-Host "No active insider risk alerts, or Insider Risk Management is not licensed for this tenant." -ForegroundColor Green
    return
}

$alerts | Group-Object RiskLevel | Sort-Object Count -Descending |
    Select-Object Name, Count | Format-Table -AutoSize

$alerts | Group-Object PolicyName | Sort-Object Count -Descending |
    Select-Object Name, Count | Format-Table -AutoSize