Get Repeat Offenders

description lists tenant users who have been compromised multiple times in simulation and training campaigns via the microsoft graph api endpoint url /v1 0/reports/security/getattacksimulationrepeatoffenders method get inputs parameters (object) url query parameters filter (string) use the filter query parameter to retrieve just a subset of a collection for guidance on using filter , see https //learn microsoft com/en us/graph/filter query parameter https //learn microsoft com/en us/graph/filter query parameter orderby (string) use the orderby query parameter to specify the sort order of the items returned from microsoft graph top (number) sets the page size of results output example \[ { "status code" 200, "response headers" { "transfer encoding" "chunked", "content type" "application/json", "content encoding" "gzip", "vary" "accept encoding", "strict transport security" "max age=31536000", "request id" "8beed643 f868 4fd0 9e15 e0db4c50383e", "client request id" "8beed643 f868 4fd0 9e15 e0db4c50383e", "x ms ags diagnostic" "{\\"serverinfo\\" {\\"datacenter\\" \\"brazil south\\",\\"slice\\" \\"e\\",\\"ring\\" \\"3\\",\\"scaleunit\\" \\"001\\",\\"roleinstance\\" \\"cp1pepf00003034\\"}}", "date" "tue, 27 dec 2022 21🕛51 gmt" }, "reason" "ok", "json body" { "@odata context" "https //graph microsoft com/v1 0/$metadata#collection(microsoft graph attacksimulationrepeatoffender)", "@odata nextlink" "https //graph microsoft com/v1 0/reports/security/getattacksimulationrepeatoffenders?$skiptoken=+rid%3", "value" \[ { "repeatoffencecount" 5, "attacksimulationuser" { "userid" "6fcdab00 385b 46f2 a329 b843b49e9147", "displayname" "reed flores", "email" "reed\@contoso com" } }, { "repeatoffencecount" 638, "attacksimulationuser" { "userid" "478a22cd aecc 41df b995 88c8de17aaf5", "displayname" "reed flores", "email" "reed\@contoso com" } } ] } } ] output parameters status code (number) reason (string) json body (object) @odata context (string) @odata nextlink (string) value (array) repeatoffencecount (number) attacksimulationuser (object) userid (string) displayname (string) email (string) response headers header type transfer encoding string content type string content encoding string vary string strict transport security string request id string client request id string x ms ags diagnostic string date string