check-msdefender 1.0.0__tar.gz → 1.1.1__tar.gz

{check_msdefender-1.0.0 → check_msdefender-1.1.1}/.claude/settings.local.json

@@ -10,7 +10,8 @@
       "Bash(python:*)",
       "Bash(find:*)",
       "Bash(echo \"Exit code: $?\")",
-      "Bash(mypy:*)"
+      "Bash(mypy:*)",
+      "Bash(black:*)"
     ],
     "deny": [],
     "ask": []

{check_msdefender-1.0.0 → check_msdefender-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: check-msdefender
-Version: 1.0.0
+Version: 1.1.1
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Author-email: ldvchosal <ldvchosal@github.com>
 License: MIT
@@ -46,7 +46,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -78,6 +78,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -92,6 +95,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -103,6 +107,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -145,6 +157,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -182,6 +195,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -208,6 +226,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -221,6 +246,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -236,6 +262,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -317,6 +344,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues

{check_msdefender-1.0.0 → check_msdefender-1.1.1}/README.md

@@ -9,7 +9,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -41,6 +41,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -55,6 +58,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -66,6 +70,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -108,6 +120,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -145,6 +158,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -171,6 +189,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -184,6 +209,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -199,6 +225,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -280,6 +307,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues

{check_msdefender-1.0.0 → check_msdefender-1.1.1}/check_msdefender/cli/commands/__init__.py

@@ -6,6 +6,7 @@ from .vulnerabilities import register_vulnerability_commands
 from .onboarding import register_onboarding_commands
 from .machines import register_machines_commands
 from .detail import register_detail_commands
+from .alerts import register_alerts_commands
 
 
 def register_all_commands(main_group: Any) -> None:
@@ -15,3 +16,4 @@ def register_all_commands(main_group: Any) -> None:
     register_onboarding_commands(main_group)
     register_machines_commands(main_group)
     register_detail_commands(main_group)
+    register_alerts_commands(main_group)

check_msdefender-1.1.1/check_msdefender/cli/commands/alerts.py

@@ -0,0 +1,61 @@
+"""Alerts commands for CLI."""
+
+import sys
+import click
+from typing import Optional, Any
+
+from check_msdefender.core.auth import get_authenticator
+from check_msdefender.core.config import load_config
+from check_msdefender.core.defender import DefenderClient
+from check_msdefender.core.nagios import NagiosPlugin
+from check_msdefender.services.alerts_service import AlertsService
+from ..decorators import common_options
+
+
+def register_alerts_commands(main_group: Any) -> None:
+    """Register alerts commands with the main CLI group."""
+
+    @main_group.command("alerts")
+    @common_options
+    def alerts_cmd(
+        config: str,
+        verbose: int,
+        machine_id: Optional[str],
+        dns_name: Optional[str],
+        warning: Optional[float],
+        critical: Optional[float],
+    ) -> None:
+        """Check alerts for Microsoft Defender."""
+        warning = warning if warning is not None else 1
+        critical = critical if critical is not None else 0
+
+        try:
+            # Load configuration
+            cfg = load_config(config)
+
+            # Get authenticator
+            authenticator = get_authenticator(cfg)
+
+            # Create Defender client
+            client = DefenderClient(authenticator, verbose_level=verbose)
+
+            # Create the alerts service
+            service = AlertsService(client, verbose_level=verbose)
+
+            # Create Nagios plugin
+            plugin = NagiosPlugin(service, "alerts")
+
+            # Execute check
+            result = plugin.check(
+                machine_id=machine_id,
+                dns_name=dns_name,
+                warning=warning,
+                critical=critical,
+                verbose=verbose,
+            )
+
+            sys.exit(result or 0)
+
+        except Exception as e:
+            print(f"UNKNOWN: {str(e)}")
+            sys.exit(3)

{check_msdefender-1.0.0 → check_msdefender-1.1.1}/check_msdefender/core/defender.py

@@ -167,6 +167,44 @@ class DefenderClient:
                 self.logger.debug(f"Response: {str(e.response.content)}")
             raise DefenderAPIError(f"Failed to query MS Defender API: {str(e)}")
 
+    def get_alerts(self) -> Dict[str, Any]:
+        """Get alerts from Microsoft Defender."""
+        self.logger.method_entry("get_alerts")
+
+        token = self._get_token()
+
+        url = f"{self.base_url}/api/alerts"
+        headers = {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": DefenderClient.application_json,
+        }
+
+        params = {
+            "$top": "100",
+            "$expand": "evidence",
+            "$orderby": "alertCreationTime desc",
+            "$select": "status,title,machineId,computerDnsName,alertCreationTime,firstEventTime,lastEventTime,lastUpdateTime,severity",
+        }
+
+        try:
+            start_time = time.time()
+            self.logger.info("Querying alerts")
+            response = requests.get(url, headers=headers, params=params, timeout=self.timeout)
+            elapsed = time.time() - start_time
+
+            self.logger.api_call("GET", url, response.status_code, elapsed)
+            response.raise_for_status()
+
+            result = cast(Dict[str, Any], response.json())
+            self.logger.json_response(str(result))
+            self.logger.method_exit("get_alerts", result)
+            return result
+        except requests.RequestException as e:
+            self.logger.debug(f"API request failed: {str(e)}")
+            if hasattr(e, "response") and e.response is not None:
+                self.logger.debug(f"Response: {str(e.response.content)}")
+            raise DefenderAPIError(f"Failed to query MS Defender API: {str(e)}")
+
     def _get_token(self) -> str:
         """Get access token from authenticator."""
         self.logger.trace("Getting access token from authenticator")

check_msdefender-1.1.1/check_msdefender/services/alerts_service.py

@@ -0,0 +1,98 @@
+"""Alerts service implementation."""
+
+from datetime import datetime
+from typing import Dict, Optional, Any, List
+from check_msdefender.core.exceptions import ValidationError
+from check_msdefender.core.logging_config import get_verbose_logger
+
+
+class AlertsService:
+    """Service for checking machine alerts."""
+
+    def __init__(self, defender_client: Any, verbose_level: int = 0) -> None:
+        """Initialize with Defender client."""
+        self.defender = defender_client
+        self.logger = get_verbose_logger(__name__, verbose_level)
+
+    def get_result(
+        self, machine_id: Optional[str] = None, dns_name: Optional[str] = None
+    ) -> Dict[str, Any]:
+        """Get alerts result with value and details for a machine."""
+        self.logger.method_entry("get_result", machine_id=machine_id, dns_name=dns_name)
+
+        if not machine_id and not dns_name:
+            raise ValidationError("Either machine_id or dns_name must be provided")
+
+        # Get machine information
+        target_dns_name = dns_name
+        target_machine_id = machine_id
+
+        if machine_id:
+            # Get DNS name from machine_id
+            machine_details = self.defender.get_machine_by_id(machine_id)
+            target_dns_name = machine_details.get("computerDnsName", "Unknown")
+        elif dns_name:
+            # Get machine_id from dns_name
+            dns_response = self.defender.get_machine_by_dns_name(dns_name)
+            machines = dns_response.get("value", [])
+            if not machines:
+                raise ValidationError(f"Machine not found with DNS name: {dns_name}")
+            target_machine_id = machines[0].get("id")
+            target_dns_name = dns_name
+
+        # Get all alerts
+        self.logger.info("Fetching alerts from Microsoft Defender")
+        alerts_data = self.defender.get_alerts()
+        all_alerts = alerts_data.get("value", [])
+
+        # Filter alerts for the specific machine
+        machine_alerts = [
+            alert
+            for alert in all_alerts
+            if alert.get("machineId") == target_machine_id
+            or alert.get("computerDnsName") == target_dns_name
+        ]
+
+        self.logger.info(f"Found {len(machine_alerts)} alerts for machine {target_dns_name}")
+
+        # Categorize alerts by status and severity
+        unresolved_alerts = [alert for alert in machine_alerts if alert.get("status") != "Resolved"]
+        informational_alerts = [
+            alert for alert in unresolved_alerts if alert.get("severity") == "Informational"
+        ]
+        critical_warning_alerts = [
+            alert
+            for alert in unresolved_alerts
+            if alert.get("severity") in ["High", "Medium", "Low"]
+        ]
+
+        # Create details for output
+        details = []
+        if unresolved_alerts:
+            summary_line = f"Unresolved alerts for {target_dns_name}"
+            if informational_alerts and not critical_warning_alerts:
+                summary_line = f"Unresolved informational alerts for {target_dns_name}"
+            elif critical_warning_alerts:
+                summary_line = f"Unresolved alerts for {target_dns_name}"
+            details.append(summary_line)
+
+            # Add individual alerts (limit to 10)
+            for alert in unresolved_alerts[:10]:
+                creation_time = alert.get("alertCreationTime", "Unknown")
+                title = alert.get("title", "Unknown alert")
+                status = alert.get("status", "Unknown")
+                severity = alert.get("severity", "Unknown")
+                details.append(f"{creation_time} - {title} ({status} {severity.lower()})")
+
+        # Return the number of unresolved alerts as the value
+        # This will be used by Nagios plugin for determining status based on thresholds
+        value = len(unresolved_alerts)
+
+        result = {
+            "value": value,
+            "details": details,
+        }
+
+        self.logger.info(f"Alert analysis complete: {len(unresolved_alerts)} unresolved alerts")
+        self.logger.method_exit("get_result", result)
+        return result

{check_msdefender-1.0.0 → check_msdefender-1.1.1}/check_msdefender.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: check-msdefender
-Version: 1.0.0
+Version: 1.1.1
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Author-email: ldvchosal <ldvchosal@github.com>
 License: MIT
@@ -46,7 +46,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -78,6 +78,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -92,6 +95,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -103,6 +107,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -145,6 +157,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -182,6 +195,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -208,6 +226,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -221,6 +246,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -236,6 +262,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -317,6 +344,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues

{check_msdefender-1.0.0 → check_msdefender-1.1.1}/check_msdefender.egg-info/SOURCES.txt

@@ -34,6 +34,7 @@ check_msdefender/cli/__main__.py
 check_msdefender/cli/decorators.py
 check_msdefender/cli/handlers.py
 check_msdefender/cli/commands/__init__.py
+check_msdefender/cli/commands/alerts.py
 check_msdefender/cli/commands/detail.py
 check_msdefender/cli/commands/lastseen.py
 check_msdefender/cli/commands/machines.py
@@ -47,6 +48,7 @@ check_msdefender/core/exceptions.py
 check_msdefender/core/logging_config.py
 check_msdefender/core/nagios.py
 check_msdefender/services/__init__.py
+check_msdefender/services/alerts_service.py
 check_msdefender/services/detail_service.py
 check_msdefender/services/lastseen_service.py
 check_msdefender/services/machines_service.py
@@ -58,6 +60,7 @@ doc/Feat-Click-Groups.md
 doc/Feat-Enhance-MsDefender-Vulnerabilities-Output.md
 doc/Feat-Fixture-Tests.md
 doc/Feat-Integration-Tests.md
+doc/Feat-MsDefender-Alerts.md
 doc/Feat-MsDefender-DetailMachine.md
 doc/Feat-MsDefender-ListMachines.md
 doc/Feat-MsDefender.md
@@ -68,8 +71,10 @@ doc/Feat-Pypi-Package.md
 doc/Feat-Verbose.md
 tests/__init__.py
 tests/fixtures/__init__.py
+tests/fixtures/alerts_data.json
 tests/fixtures/machine_data.json
 tests/fixtures/mock_defender_client.py
+tests/fixtures/test_alerts_service.py
 tests/fixtures/test_detail_service.py
 tests/fixtures/test_lastseen_service.py
 tests/fixtures/test_onboarding_service.py
@@ -79,4 +84,5 @@ tests/integration/__init__.py
 tests/integration/test_cli_integration.py
 tests/integration/test_lastseen_integration.py
 tests/unit/__init__.py
+tests/unit/test_alerts_service.py
 tests/unit/test_detail_service.py