Azure Defender for Cloud

az security alert list

Lists Microsoft Defender for Cloud security alerts, reviewing detections for the Azure subscription.

Run it when you need Defender for Cloud alerts: az security alert list returns the subscription's alerts — the detections from the plans (servers, databases, storage, identity) — with severity, status, and affected resource. It's the review of Azure's managed alerts from the CLI: high-severity alerts (a compromised resource, unusual activity) are the incident's starting point. In an Azure SOC, Defender for Cloud is the managed detection layer: alerts are triaged by severity, investigated with detail, and statuses are managed.

Don't use it as complete detection: Defender for Cloud alerts cover enabled plans — without the servers plan (Defender for Servers), host detections don't exist; coverage depends on configuration and plan cost. Alert volume (low and medium severity) requires triage: severity, status, and context decide. And watch out: the alert points, investigation and response are the team's — correlation with the Activity Log (attacker activity) and with Sentinel completes the flow. For alert details, use az security alert show with the ID.