{
  "opencollection": "1.0.0",
  "info": {
    "name": "Microsoft Graph Admin Admin.admin Security.incident API",
    "version": "1.0.0"
  },
  "items": [
    {
      "info": {
        "name": "Security.incident",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Microsoft Graph List incidents",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/security/incidents",
            "params": [
              {
                "name": "$top",
                "value": "50",
                "type": "query",
                "description": "Show only the first n items"
              },
              {
                "name": "$skip",
                "value": "",
                "type": "query",
                "description": "Skip the first n items"
              },
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              },
              {
                "name": "$count",
                "value": "",
                "type": "query",
                "description": "Include count of items"
              },
              {
                "name": "$orderby",
                "value": "",
                "type": "query",
                "description": "Order items by property values"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident. This operation allows you to filter and sort through incidents to create an informed cyber security response. It exposes a collection of inciden"
        },
        {
          "info": {
            "name": "Microsoft Graph Create new navigation property to incidents for security",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/security/incidents",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Microsoft Graph Create new navigation property to incidents for security"
        },
        {
          "info": {
            "name": "Microsoft Graph Get incident",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id",
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "Retrieve the properties and relationships of an incident object. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident."
        },
        {
          "info": {
            "name": "Microsoft Graph Update incident",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id",
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Update the properties of an incident object."
        },
        {
          "info": {
            "name": "Microsoft Graph Delete navigation property incidents for security",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id",
            "headers": [
              {
                "name": "If-Match",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              }
            ]
          },
          "docs": "Microsoft Graph Delete navigation property incidents for security"
        },
        {
          "info": {
            "name": "Microsoft Graph Get alerts from security",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id/alerts",
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              },
              {
                "name": "$top",
                "value": "50",
                "type": "query",
                "description": "Show only the first n items"
              },
              {
                "name": "$skip",
                "value": "",
                "type": "query",
                "description": "Skip the first n items"
              },
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              },
              {
                "name": "$count",
                "value": "",
                "type": "query",
                "description": "Include count of items"
              },
              {
                "name": "$orderby",
                "value": "",
                "type": "query",
                "description": "Order items by property values"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "The list of related alerts. Supports $expand."
        },
        {
          "info": {
            "name": "Microsoft Graph Get alerts from security",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id/alerts/:alert-id",
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              },
              {
                "name": "alert-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of alert"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "The list of related alerts. Supports $expand."
        },
        {
          "info": {
            "name": "Microsoft Graph Sets a new value for the collection of alertComment.",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id/alerts/:alert-id/comments",
            "headers": [
              {
                "name": "If-Match",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              },
              {
                "name": "alert-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of alert"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Microsoft Graph Sets a new value for the collection of alertComment."
        },
        {
          "info": {
            "name": "Microsoft Graph Get the number of the resource",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id/alerts/:alert-id/comments/$count",
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              },
              {
                "name": "alert-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of alert"
              },
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              }
            ]
          },
          "docs": "Microsoft Graph Get the number of the resource"
        },
        {
          "info": {
            "name": "Microsoft Graph Get the number of the resource",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/:incident-id/alerts/$count",
            "params": [
              {
                "name": "incident-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of incident"
              },
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              }
            ]
          },
          "docs": "Microsoft Graph Get the number of the resource"
        },
        {
          "info": {
            "name": "Microsoft Graph Get the number of the resource",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/security/incidents/$count",
            "params": [
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              }
            ]
          },
          "docs": "Microsoft Graph Get the number of the resource"
        }
      ]
    }
  ],
  "bundled": true
}