Get-SecurityAlertsSummary

<#
.SYNOPSIS
    Combines Defender alerts, risky sign ins and DLP incidents into one summary.

.DESCRIPTION
    Pulls counts from three separate security surfaces (Defender alerts,
    Entra ID risky sign ins, and Purview DLP incidents) for the last 24
    hours into a single summary table, so a daily standup check does not
    require visiting three separate portals.

.EXAMPLE
    .\Get-SecurityAlertsSummary.ps1

.NOTES
    Requires Microsoft.Graph.Security and Microsoft.Graph.Identity.SignIns
    with an active Connect-MgGraph session.

.AUTHOR
    Shehryar Hassan
#>

$since = (Get-Date).AddHours(-24).ToString("o")

$alertCount = (Get-MgSecurityAlert -Filter "createdDateTime ge $since" -All).Count
$riskyUserCount = (Get-MgRiskyUser -Filter "riskLastUpdatedDateTime ge $since" -All).Count
$incidentCount = (Get-MgSecurityIncident -Filter "createdDateTime ge $since" -All).Count

[pscustomobject]@{
    "Defender Alerts (24h)"    = $alertCount
    "Newly Risky Users (24h)"  = $riskyUserCount
    "New Incidents (24h)"      = $incidentCount
} | Format-List