openapi: 3.1.0 info: title: Microsoft Graph Security description: Needs a description. paths: /reports/security: description: >- Provides operations to manage the security property of the microsoft.graph.reportRoot entity. get: tags: - reports.securityReportsRoot summary: Microsoft Graph Get security from reports description: >- Represents an abstract type that contains resources for attack simulation and training reports. operationId: reports.GetSecurity parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.securityReportsRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - reports.securityReportsRoot summary: Microsoft Graph Update the navigation property security in reports operationId: reports.UpdateSecurity requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.securityReportsRoot' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.securityReportsRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - reports.securityReportsRoot summary: Microsoft Graph Delete navigation property security for reports operationId: reports.DeleteSecurity parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /reports/security/getAttackSimulationRepeatOffenders(): description: Provides operations to call the getAttackSimulationRepeatOffenders method. get: tags: - reports.securityReportsRoot summary: Microsoft Graph Invoke function getAttackSimulationRepeatOffenders description: >- List the tenant users who have yielded to attacks more than once in attack simulation and training campaigns. This function supports @odata.nextLink for pagination. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/securityreportsroot-getattacksimulationrepeatoffenders?view=graph-rest-1.0 operationId: reports.security.getAttackSimulationRepeatOffenders parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' responses: 2XX: description: Success content: application/json: schema: type: object allOf: - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse' - type: object properties: value: type: array items: $ref: >- #/components/schemas/microsoft.graph.attackSimulationRepeatOffender 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore /reports/security/getAttackSimulationSimulationUserCoverage(): description: >- Provides operations to call the getAttackSimulationSimulationUserCoverage method. get: tags: - reports.securityReportsRoot summary: Microsoft Graph Invoke function getAttackSimulationSimulationUserCoverage description: >- List training coverage for each tenant user in attack simulation and training campaigns. This function supports @odata.nextLink for pagination. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/securityreportsroot-getattacksimulationsimulationusercoverage?view=graph-rest-1.0 operationId: reports.security.getAttackSimulationSimulationUserCoverage parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' responses: 2XX: description: Success content: application/json: schema: type: object allOf: - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse' - type: object properties: value: type: array items: $ref: >- #/components/schemas/microsoft.graph.attackSimulationSimulationUserCoverage 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore /reports/security/getAttackSimulationTrainingUserCoverage(): description: >- Provides operations to call the getAttackSimulationTrainingUserCoverage method. get: tags: - reports.securityReportsRoot summary: Microsoft Graph Invoke function getAttackSimulationTrainingUserCoverage description: >- List training coverage for tenant users in attack simulation and training campaigns. This function supports @odata.nextLink for pagination. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/securityreportsroot-getattacksimulationtrainingusercoverage?view=graph-rest-1.0 operationId: reports.security.getAttackSimulationTrainingUserCoverage parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' responses: 2XX: description: Success content: application/json: schema: type: object allOf: - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse' - type: object properties: value: type: array items: $ref: >- #/components/schemas/microsoft.graph.attackSimulationTrainingUserCoverage 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore /security: description: Provides operations to manage the security singleton. get: tags: - Security.security summary: Microsoft Graph Get security operationId: security.security.GetSecurity parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved entity content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - Security.security summary: Microsoft Graph Update security operationId: security.security.UpdateSecurity requestBody: description: New property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/alerts: description: >- Provides operations to manage the alerts property of the microsoft.graph.security entity. get: tags: - Security.alert summary: Microsoft Graph List alerts description: Retrieve a list of alert objects. externalDocs: description: Find more info here url: https://learn.microsoft.com/graph/api/alert-list?view=graph-rest-1.0 operationId: security.ListAlerts parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.alertCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' deprecated: true x-ms-deprecation: removalDate: '2026-04-10' date: '2024-04-10' version: 2024-01/Deprecation description: >- The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API. x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - Security.alert summary: Microsoft Graph Create new navigation property to alerts for security operationId: security.CreateAlerts requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.alert' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.alert' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' deprecated: true x-ms-deprecation: removalDate: '2026-04-10' date: '2024-04-10' version: 2024-01/Deprecation description: >- The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API. x-ms-docs-operation-type: operation /security/alerts_v2: description: >- Provides operations to manage the alerts_v2 property of the microsoft.graph.security entity. get: tags: - Security.alert summary: Microsoft Graph List alerts_v2 description: >- Get a list of alert resources created to track suspicious activities in an organization. This operation lets you filter and sort through alerts to create an informed cyber security response. It exposes a collection of alerts that were flagged in your network, within the time range you specified in your environment retention policy. The most recent alerts are displayed at the top of the list. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-list-alerts_v2?view=graph-rest-1.0 operationId: security.ListAlerts_v2 parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.alertCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - Security.alert summary: Microsoft Graph Create new navigation property to alerts_v2 for security operationId: security.CreateAlerts_v2 requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.alert' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.alert' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/alerts_v2/{alert-id}: description: >- Provides operations to manage the alerts_v2 property of the microsoft.graph.security entity. get: tags: - Security.alert summary: Microsoft Graph Get alert description: Get the properties and relationships of an alert object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-alert-get?view=graph-rest-1.0 operationId: security.GetAlerts_v2 parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.alert' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - Security.alert summary: Microsoft Graph Update alert description: >- Update the properties of an alert object in an organization based on the specified alert id property. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-alert-update?view=graph-rest-1.0 operationId: security.UpdateAlerts_v2 requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.alert' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.alert' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - Security.alert summary: Microsoft Graph Delete navigation property alerts_v2 for security operationId: security.DeleteAlerts_v2 parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: alert-id in: path description: The unique identifier of alert required: true schema: type: string x-ms-docs-key-type: alert /security/alerts_v2/{alert-id}/comments: post: tags: - Security.alert summary: Microsoft Graph Create comment for alert description: >- Create a comment for an existing alert based on the specified alert id property. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-alert-post-comments?view=graph-rest-1.0 operationId: security.alerts_v2.SetComments parameters: - name: If-Match in: header description: ETag schema: type: string requestBody: description: New property values content: application/json: schema: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alertComment' required: true responses: 2XX: description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alertComment' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: alert-id in: path description: The unique identifier of alert required: true schema: type: string x-ms-docs-key-type: alert /security/alerts_v2/{alert-id}/comments/$count: description: Provides operations to count the resources in the collection. get: tags: - Security.alert summary: Microsoft Graph Get the number of the resource operationId: security.alerts_v2.Comments.GetCount-2f70 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: alert-id in: path description: The unique identifier of alert required: true schema: type: string x-ms-docs-key-type: alert /security/alerts_v2/$count: description: Provides operations to count the resources in the collection. get: tags: - Security.alert summary: Microsoft Graph Get the number of the resource operationId: security.alerts_v2.GetCount-9522 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/alerts/{alert-id}: description: >- Provides operations to manage the alerts property of the microsoft.graph.security entity. get: tags: - Security.alert summary: Microsoft Graph Get alert description: Retrieve the properties and relationships of an alert object. externalDocs: description: Find more info here url: https://learn.microsoft.com/graph/api/alert-get?view=graph-rest-1.0 operationId: security.GetAlerts parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.alert' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' deprecated: true x-ms-deprecation: removalDate: '2026-04-10' date: '2024-04-10' version: 2024-01/Deprecation description: >- The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API. x-ms-docs-operation-type: operation patch: tags: - Security.alert summary: Microsoft Graph Update alert description: >- Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions. This method updates any solution that has a record of the referenced alert ID. externalDocs: description: Find more info here url: https://learn.microsoft.com/graph/api/alert-update?view=graph-rest-1.0 operationId: security.UpdateAlerts requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.alert' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.alert' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' deprecated: true x-ms-deprecation: removalDate: '2026-04-10' date: '2024-04-10' version: 2024-01/Deprecation description: >- The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API. x-ms-docs-operation-type: operation parameters: - name: alert-id in: path description: The unique identifier of alert required: true schema: type: string x-ms-docs-key-type: alert /security/alerts/$count: description: Provides operations to count the resources in the collection. get: tags: - Security.alert summary: Microsoft Graph Get the number of the resource operationId: security.alerts.GetCount-82d4 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' deprecated: true x-ms-deprecation: removalDate: '2026-04-10' date: '2024-04-10' version: 2024-01/Deprecation description: >- The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API. /security/attackSimulation: description: >- Provides operations to manage the attackSimulation property of the microsoft.graph.security entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get attackSimulation from security operationId: security.GetAttackSimulation parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property attackSimulation in security operationId: security.UpdateAttackSimulation requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationRoot' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property attackSimulation for security operationId: security.DeleteAttackSimulation parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/endUserNotifications: description: >- Provides operations to manage the endUserNotifications property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List endUserNotifications description: Get a list of endUserNotification objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-list-endusernotifications?view=graph-rest-1.0 operationId: security.attackSimulation.ListEndUserNotifications parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.endUserNotificationCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to endUserNotifications for security operationId: security.attackSimulation.CreateEndUserNotifications requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotification' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotification' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/endUserNotifications/{endUserNotification-id}: description: >- Provides operations to manage the endUserNotifications property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get endUserNotifications from security description: Represents an end user's notification for an attack simulation training. operationId: security.attackSimulation.GetEndUserNotifications parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotification' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property endUserNotifications in security operationId: security.attackSimulation.UpdateEndUserNotifications requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotification' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotification' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property endUserNotifications for security operationId: security.attackSimulation.DeleteEndUserNotifications parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: endUserNotification-id in: path description: The unique identifier of endUserNotification required: true schema: type: string x-ms-docs-key-type: endUserNotification /security/attackSimulation/endUserNotifications/{endUserNotification-id}/details: description: >- Provides operations to manage the details property of the microsoft.graph.endUserNotification entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get details from security operationId: security.attackSimulation.endUserNotifications.ListDetails parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.endUserNotificationDetailCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to details for security operationId: security.attackSimulation.endUserNotifications.CreateDetails requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotificationDetail' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotificationDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: endUserNotification-id in: path description: The unique identifier of endUserNotification required: true schema: type: string x-ms-docs-key-type: endUserNotification /security/attackSimulation/endUserNotifications/{endUserNotification-id}/details/{endUserNotificationDetail-id}: description: >- Provides operations to manage the details property of the microsoft.graph.endUserNotification entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get details from security operationId: security.attackSimulation.endUserNotifications.GetDetails parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotificationDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property details in security operationId: security.attackSimulation.endUserNotifications.UpdateDetails requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotificationDetail' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.endUserNotificationDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property details for security operationId: security.attackSimulation.endUserNotifications.DeleteDetails parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: endUserNotification-id in: path description: The unique identifier of endUserNotification required: true schema: type: string x-ms-docs-key-type: endUserNotification - name: endUserNotificationDetail-id in: path description: The unique identifier of endUserNotificationDetail required: true schema: type: string x-ms-docs-key-type: endUserNotificationDetail /security/attackSimulation/endUserNotifications/{endUserNotification-id}/details/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.endUserNotifications.details.GetCount-5759 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: endUserNotification-id in: path description: The unique identifier of endUserNotification required: true schema: type: string x-ms-docs-key-type: endUserNotification /security/attackSimulation/endUserNotifications/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.endUserNotifications.GetCount-421b parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/attackSimulation/landingPages: description: >- Provides operations to manage the landingPages property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List landingPages description: Get a list of the landingPage objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-list-landingpage?view=graph-rest-1.0 operationId: security.attackSimulation.ListLandingPages parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.landingPageCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to landingPages for security operationId: security.attackSimulation.CreateLandingPages requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPage' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/landingPages/{landingPage-id}: description: >- Provides operations to manage the landingPages property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get landingPage description: >- Get a landingPage associated with an attack simulation campaign for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/landingpage-get?view=graph-rest-1.0 operationId: security.attackSimulation.GetLandingPages parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property landingPages in security operationId: security.attackSimulation.UpdateLandingPages requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPage' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property landingPages for security operationId: security.attackSimulation.DeleteLandingPages parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: landingPage-id in: path description: The unique identifier of landingPage required: true schema: type: string x-ms-docs-key-type: landingPage /security/attackSimulation/landingPages/{landingPage-id}/details: description: >- Provides operations to manage the details property of the microsoft.graph.landingPage entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get details from security description: >- The detail information for a landing page associated with a simulation during its creation. operationId: security.attackSimulation.landingPages.ListDetails parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.landingPageDetailCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to details for security operationId: security.attackSimulation.landingPages.CreateDetails requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPageDetail' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPageDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: landingPage-id in: path description: The unique identifier of landingPage required: true schema: type: string x-ms-docs-key-type: landingPage /security/attackSimulation/landingPages/{landingPage-id}/details/{landingPageDetail-id}: description: >- Provides operations to manage the details property of the microsoft.graph.landingPage entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get details from security description: >- The detail information for a landing page associated with a simulation during its creation. operationId: security.attackSimulation.landingPages.GetDetails parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPageDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property details in security operationId: security.attackSimulation.landingPages.UpdateDetails requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPageDetail' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPageDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property details for security operationId: security.attackSimulation.landingPages.DeleteDetails parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: landingPage-id in: path description: The unique identifier of landingPage required: true schema: type: string x-ms-docs-key-type: landingPage - name: landingPageDetail-id in: path description: The unique identifier of landingPageDetail required: true schema: type: string x-ms-docs-key-type: landingPageDetail /security/attackSimulation/landingPages/{landingPage-id}/details/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.landingPages.details.GetCount-8be7 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: landingPage-id in: path description: The unique identifier of landingPage required: true schema: type: string x-ms-docs-key-type: landingPage /security/attackSimulation/landingPages/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.landingPages.GetCount-7f61 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/attackSimulation/loginPages: description: >- Provides operations to manage the loginPages property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List loginPages description: Get a list of the loginPage objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-list-loginpage?view=graph-rest-1.0 operationId: security.attackSimulation.ListLoginPages parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.loginPageCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to loginPages for security operationId: security.attackSimulation.CreateLoginPages requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.loginPage' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.loginPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/loginPages/{loginPage-id}: description: >- Provides operations to manage the loginPages property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get loginPage description: >- Get a loginPage associated with an attack simulation campaign for a tenant. Login pages are shown to users in attack simulations that use credential harvest and link in attachment social engineering techniques. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/loginpage-get?view=graph-rest-1.0 operationId: security.attackSimulation.GetLoginPages parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.loginPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property loginPages in security operationId: security.attackSimulation.UpdateLoginPages requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.loginPage' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.loginPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property loginPages for security operationId: security.attackSimulation.DeleteLoginPages parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: loginPage-id in: path description: The unique identifier of loginPage required: true schema: type: string x-ms-docs-key-type: loginPage /security/attackSimulation/loginPages/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.loginPages.GetCount-a7ea parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/attackSimulation/operations: description: >- Provides operations to manage the operations property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get attackSimulationOperation description: >- Get an attack simulation operation to track a long-running operation request for a tenant. operationId: security.attackSimulation.ListOperations parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.attackSimulationOperationCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to operations for security operationId: security.attackSimulation.CreateOperations requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationOperation' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationOperation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/operations/{attackSimulationOperation-id}: description: >- Provides operations to manage the operations property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get attackSimulationOperation description: >- Get an attack simulation operation to track a long-running operation request for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationoperation-get?view=graph-rest-1.0 operationId: security.attackSimulation.GetOperations parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationOperation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property operations in security operationId: security.attackSimulation.UpdateOperations requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationOperation' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.attackSimulationOperation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property operations for security operationId: security.attackSimulation.DeleteOperations parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: attackSimulationOperation-id in: path description: The unique identifier of attackSimulationOperation required: true schema: type: string x-ms-docs-key-type: attackSimulationOperation /security/attackSimulation/operations/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.operations.GetCount-e5f7 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/attackSimulation/payloads: description: >- Provides operations to manage the payloads property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List payloads description: >- Get a list of payloads for attack simulation campaigns. This operation expects the mandatory parameter source to filter and query the respective data source. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-list-payloads?view=graph-rest-1.0 operationId: security.attackSimulation.ListPayloads parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.payloadCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to payloads for security operationId: security.attackSimulation.CreatePayloads requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.payload' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.payload' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/payloads/{payload-id}: description: >- Provides operations to manage the payloads property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get payload description: Get an attack simulation campaign payload for a tenant. externalDocs: description: Find more info here url: https://learn.microsoft.com/graph/api/payload-get?view=graph-rest-1.0 operationId: security.attackSimulation.GetPayloads parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.payload' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property payloads in security operationId: security.attackSimulation.UpdatePayloads requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.payload' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.payload' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property payloads for security operationId: security.attackSimulation.DeletePayloads parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: payload-id in: path description: The unique identifier of payload required: true schema: type: string x-ms-docs-key-type: payload /security/attackSimulation/payloads/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.payloads.GetCount-f3a2 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/attackSimulation/simulationAutomations: description: >- Provides operations to manage the simulationAutomations property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List simulationAutomations description: Get a list of attack simulation automations for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-list-simulationautomations?view=graph-rest-1.0 operationId: security.attackSimulation.ListSimulationAutomations parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.simulationAutomationCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to simulationAutomations for security operationId: security.attackSimulation.CreateSimulationAutomations requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomation' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/simulationAutomations/{simulationAutomation-id}: description: >- Provides operations to manage the simulationAutomations property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get simulationAutomation description: Get an attack simulation automation for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/simulationautomation-get?view=graph-rest-1.0 operationId: security.attackSimulation.GetSimulationAutomations parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property simulationAutomations in security operationId: security.attackSimulation.UpdateSimulationAutomations requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomation' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property simulationAutomations for security operationId: security.attackSimulation.DeleteSimulationAutomations parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: simulationAutomation-id in: path description: The unique identifier of simulationAutomation required: true schema: type: string x-ms-docs-key-type: simulationAutomation /security/attackSimulation/simulationAutomations/{simulationAutomation-id}/runs: description: >- Provides operations to manage the runs property of the microsoft.graph.simulationAutomation entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List runs description: Get a list of the attack simulation automation runs for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/simulationautomation-list-runs?view=graph-rest-1.0 operationId: security.attackSimulation.simulationAutomations.ListRuns parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.simulationAutomationRunCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to runs for security operationId: security.attackSimulation.simulationAutomations.CreateRuns requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomationRun' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomationRun' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: simulationAutomation-id in: path description: The unique identifier of simulationAutomation required: true schema: type: string x-ms-docs-key-type: simulationAutomation /security/attackSimulation/simulationAutomations/{simulationAutomation-id}/runs/{simulationAutomationRun-id}: description: >- Provides operations to manage the runs property of the microsoft.graph.simulationAutomation entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get runs from security description: A collection of simulation automation runs. operationId: security.attackSimulation.simulationAutomations.GetRuns parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomationRun' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property runs in security operationId: security.attackSimulation.simulationAutomations.UpdateRuns requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomationRun' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationAutomationRun' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property runs for security operationId: security.attackSimulation.simulationAutomations.DeleteRuns parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: simulationAutomation-id in: path description: The unique identifier of simulationAutomation required: true schema: type: string x-ms-docs-key-type: simulationAutomation - name: simulationAutomationRun-id in: path description: The unique identifier of simulationAutomationRun required: true schema: type: string x-ms-docs-key-type: simulationAutomationRun /security/attackSimulation/simulationAutomations/{simulationAutomation-id}/runs/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.simulationAutomations.runs.GetCount-9ec4 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: simulationAutomation-id in: path description: The unique identifier of simulationAutomation required: true schema: type: string x-ms-docs-key-type: simulationAutomation /security/attackSimulation/simulationAutomations/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.simulationAutomations.GetCount-6071 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/attackSimulation/simulations: description: >- Provides operations to manage the simulations property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List simulations description: Get a list of attack simulation campaigns for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-list-simulations?view=graph-rest-1.0 operationId: security.attackSimulation.ListSimulations parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.simulationCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create simulation description: Create an attack simulation campaign for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-post-simulation?view=graph-rest-1.0 operationId: security.attackSimulation.CreateSimulations requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulation' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/simulations/{simulation-id}: description: >- Provides operations to manage the simulations property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get simulation description: Get an attack simulation campaign for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/simulation-get?view=graph-rest-1.0 operationId: security.attackSimulation.GetSimulations parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update simulation description: Update an attack simulation campaign for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/simulation-update?view=graph-rest-1.0 operationId: security.attackSimulation.UpdateSimulations requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulation' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete simulation description: Delete an attack simulation campaign for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/simulation-delete?view=graph-rest-1.0 operationId: security.attackSimulation.DeleteSimulations parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: simulation-id in: path description: The unique identifier of simulation required: true schema: type: string x-ms-docs-key-type: simulation /security/attackSimulation/simulations/{simulation-id}/landingPage: description: >- Provides operations to manage the landingPage property of the microsoft.graph.simulation entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get landingPage from security description: The landing page associated with a simulation during its creation. operationId: security.attackSimulation.simulations.GetLandingPage parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: simulation-id in: path description: The unique identifier of simulation required: true schema: type: string x-ms-docs-key-type: simulation /security/attackSimulation/simulations/{simulation-id}/loginPage: description: >- Provides operations to manage the loginPage property of the microsoft.graph.simulation entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get loginPage from security description: The login page associated with a simulation during its creation. operationId: security.attackSimulation.simulations.GetLoginPage parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.loginPage' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: simulation-id in: path description: The unique identifier of simulation required: true schema: type: string x-ms-docs-key-type: simulation /security/attackSimulation/simulations/{simulation-id}/payload: description: >- Provides operations to manage the payload property of the microsoft.graph.simulation entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get payload from security description: The payload associated with a simulation during its creation. operationId: security.attackSimulation.simulations.GetPayload parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.payload' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: simulation-id in: path description: The unique identifier of simulation required: true schema: type: string x-ms-docs-key-type: simulation /security/attackSimulation/simulations/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.simulations.GetCount-285e parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/attackSimulation/trainings: description: >- Provides operations to manage the trainings property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph List trainings description: Get a list of the training objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/attacksimulationroot-list-trainings?view=graph-rest-1.0 operationId: security.attackSimulation.ListTrainings parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.trainingCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to trainings for security operationId: security.attackSimulation.CreateTrainings requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.training' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.training' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/attackSimulation/trainings/{training-id}: description: >- Provides operations to manage the trainings property of the microsoft.graph.attackSimulationRoot entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get training description: Get an attack simulation training for a tenant. externalDocs: description: Find more info here url: https://learn.microsoft.com/graph/api/training-get?view=graph-rest-1.0 operationId: security.attackSimulation.GetTrainings parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.training' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property trainings in security operationId: security.attackSimulation.UpdateTrainings requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.training' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.training' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property trainings for security operationId: security.attackSimulation.DeleteTrainings parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: training-id in: path description: The unique identifier of training required: true schema: type: string x-ms-docs-key-type: training /security/attackSimulation/trainings/{training-id}/languageDetails: description: >- Provides operations to manage the languageDetails property of the microsoft.graph.training entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get trainingLanguageDetail description: >- Get the language details about an attack simulation training for a tenant. operationId: security.attackSimulation.trainings.ListLanguageDetails parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.trainingLanguageDetailCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.attackSimulationRoot summary: Microsoft Graph Create new navigation property to languageDetails for security operationId: security.attackSimulation.trainings.CreateLanguageDetails requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.trainingLanguageDetail' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.trainingLanguageDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: training-id in: path description: The unique identifier of training required: true schema: type: string x-ms-docs-key-type: training /security/attackSimulation/trainings/{training-id}/languageDetails/{trainingLanguageDetail-id}: description: >- Provides operations to manage the languageDetails property of the microsoft.graph.training entity. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get trainingLanguageDetail description: >- Get the language details about an attack simulation training for a tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/traininglanguagedetail-get?view=graph-rest-1.0 operationId: security.attackSimulation.trainings.GetLanguageDetails parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.trainingLanguageDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.attackSimulationRoot summary: Microsoft Graph Update the navigation property languageDetails in security operationId: security.attackSimulation.trainings.UpdateLanguageDetails requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.trainingLanguageDetail' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.trainingLanguageDetail' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.attackSimulationRoot summary: Microsoft Graph Delete navigation property languageDetails for security operationId: security.attackSimulation.trainings.DeleteLanguageDetails parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: training-id in: path description: The unique identifier of training required: true schema: type: string x-ms-docs-key-type: training - name: trainingLanguageDetail-id in: path description: The unique identifier of trainingLanguageDetail required: true schema: type: string x-ms-docs-key-type: trainingLanguageDetail /security/attackSimulation/trainings/{training-id}/languageDetails/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.trainings.languageDetails.GetCount-b009 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: training-id in: path description: The unique identifier of training required: true schema: type: string x-ms-docs-key-type: training /security/attackSimulation/trainings/$count: description: Provides operations to count the resources in the collection. get: tags: - security.attackSimulationRoot summary: Microsoft Graph Get the number of the resource operationId: security.attackSimulation.trainings.GetCount-b606 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/cases: description: >- Provides operations to manage the cases property of the microsoft.graph.security entity. get: tags: - security.casesRoot summary: Microsoft Graph Get cases from security operationId: security.GetCases parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.casesRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property cases in security operationId: security.UpdateCases requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.casesRoot' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.casesRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property cases for security operationId: security.DeleteCases parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/cases/ediscoveryCases: description: >- Provides operations to manage the ediscoveryCases property of the microsoft.graph.security.casesRoot entity. get: tags: - security.casesRoot summary: Microsoft Graph List ediscoveryCases description: Get a list of the ediscoveryCase objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-casesroot-list-ediscoverycases?view=graph-rest-1.0 operationId: security.cases.ListEdiscoveryCases parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryCaseCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create ediscoveryCase description: Create a new ediscoveryCase object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-casesroot-post-ediscoverycases?view=graph-rest-1.0 operationId: security.cases.CreateEdiscoveryCases requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoveryCase' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoveryCase' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/cases/ediscoveryCases/{ediscoveryCase-id}: description: >- Provides operations to manage the ediscoveryCases property of the microsoft.graph.security.casesRoot entity. get: tags: - security.casesRoot summary: Microsoft Graph Get ediscoveryCase description: Read the properties and relationships of an ediscoveryCase object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-get?view=graph-rest-1.0 operationId: security.cases.GetEdiscoveryCases parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoveryCase' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update ediscoveryCase description: Update the properties of an ediscoveryCase object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-update?view=graph-rest-1.0 operationId: security.cases.UpdateEdiscoveryCases requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoveryCase' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoveryCase' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete ediscoveryCase description: Delete an ediscoveryCase object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-casesroot-delete-ediscoverycases?view=graph-rest-1.0 operationId: security.cases.DeleteEdiscoveryCases parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians: description: >- Provides operations to manage the custodians property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph List ediscoveryCustodian description: Get a list of the custodian objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-list-custodians?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ListCustodians parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryCustodianCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create custodians description: "Create a new ediscoveryCustodian object.\r\nAfter the custodian object is created, you will need to create the custodian's userSource to reference their mailbox and OneDrive for Business site." externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-post-custodians?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.CreateCustodians requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCustodian required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCustodian 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}: description: >- Provides operations to manage the custodians property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get ediscoveryCustodian description: Read the properties and relationships of an ediscoveryCustodian object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-get?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.GetCustodians parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCustodian 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property custodians in security operationId: security.cases.ediscoveryCases.UpdateCustodians requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCustodian required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCustodian 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property custodians for security operationId: security.cases.ediscoveryCases.DeleteCustodians parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/lastIndexOperation: description: >- Provides operations to manage the lastIndexOperation property of the microsoft.graph.security.ediscoveryCustodian entity. get: tags: - security.casesRoot summary: Microsoft Graph List lastIndexOperation description: >- Get a list of the ediscoveryIndexOperations associated with an ediscoveryCustodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-list-lastindexoperation?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.GetLastIndexOperation parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryIndexOperation 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.activate: description: Provides operations to call the activate method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action activate description: >- Activate a custodian that has been released from a case to make them part of the case again. For details, see Manage custodians in an eDiscovery (Premium) case. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-activate?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.custodians.ediscoveryCustodian.activate responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian x-ms-docs-grouped-path: - /security/identities/sensorCandidates/microsoft.graph.security.activate /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.applyHold: description: Provides operations to call the applyHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action applyHold description: >- Start the process of applying hold on eDiscovery custodians. After the operation is created, you can use Get ediscoveryCustodian to retrieve the status of an ediscoveryCustodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-applyhold?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.custodians.ediscoveryCustodian.applyHold responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.applyHold /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.release: description: Provides operations to call the release method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action release description: >- Release a custodian from a case. For details, see Release a custodian from a case. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-release?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.custodians.ediscoveryCustodian.release responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.release ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.removeHold : description: Provides operations to call the removeHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action removeHold description: >- Start the process of removing hold from eDiscovery custodians. After the operation is created, you can get the status by retrieving the Location parameter from the response headers. The location provides a URL that will return an eDiscoveryHoldOperation object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-removehold?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.custodians.ediscoveryCustodian.removeHold responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.removeHold ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.updateIndex : description: Provides operations to call the updateIndex method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action updateIndex description: >- Trigger an indexOperation to make a custodian and associated sources searchable. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-updateindex?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.custodians.ediscoveryCustodian.updateIndex responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.updateIndex /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/siteSources: description: >- Provides operations to manage the siteSources property of the microsoft.graph.security.ediscoveryCustodian entity. get: tags: - security.casesRoot summary: Microsoft Graph List siteSources description: >- Get a list of the siteSource objects associated with an ediscoveryCustodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-list-sitesources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.ListSiteSources parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.siteSourceCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create siteSource description: Create a new siteSource object associated with an eDiscovery custodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-post-sitesources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.CreateSiteSources requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.siteSource' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.siteSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/siteSources/{siteSource-id}: description: >- Provides operations to manage the siteSources property of the microsoft.graph.security.ediscoveryCustodian entity. get: tags: - security.casesRoot summary: Microsoft Graph Get siteSources from security description: Data source entity for SharePoint sites associated with the custodian. operationId: security.cases.ediscoveryCases.custodians.GetSiteSources parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.siteSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property siteSources in security operationId: security.cases.ediscoveryCases.custodians.UpdateSiteSources requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.siteSource' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.siteSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete siteSource description: Delete a siteSource object associated with an ediscoveryCustodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-delete-sitesources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.DeleteSiteSources parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian - name: siteSource-id in: path description: The unique identifier of siteSource required: true schema: type: string x-ms-docs-key-type: siteSource /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/siteSources/{siteSource-id}/site: description: >- Provides operations to manage the site property of the microsoft.graph.security.siteSource entity. get: tags: - security.casesRoot summary: Microsoft Graph Get site from security description: The SharePoint site associated with the siteSource. operationId: security.cases.ediscoveryCases.custodians.siteSources.GetSite parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.site' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian - name: siteSource-id in: path description: The unique identifier of siteSource required: true schema: type: string x-ms-docs-key-type: siteSource /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/siteSources/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.custodians.siteSources.GetCount-a46a parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/unifiedGroupSources: description: >- Provides operations to manage the unifiedGroupSources property of the microsoft.graph.security.ediscoveryCustodian entity. get: tags: - security.casesRoot summary: Microsoft Graph List unifiedGroupSources description: >- Get a list of the unifiedGroupSource objects associated with an ediscoveryCustodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-list-unifiedgroupsources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.ListUnifiedGroupSources parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.unifiedGroupSourceCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create custodian unifiedGroupSource description: >- Create a new unifiedGroupSource object associated with an eDiscovery custodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-post-unifiedgroupsources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.CreateUnifiedGroupSources requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.unifiedGroupSource' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.unifiedGroupSource 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/unifiedGroupSources/{unifiedGroupSource-id} : description: >- Provides operations to manage the unifiedGroupSources property of the microsoft.graph.security.ediscoveryCustodian entity. get: tags: - security.casesRoot summary: Microsoft Graph Get unifiedGroupSources from security description: Data source entity for groups associated with the custodian. operationId: security.cases.ediscoveryCases.custodians.GetUnifiedGroupSources parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.unifiedGroupSource 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property unifiedGroupSources in security operationId: security.cases.ediscoveryCases.custodians.UpdateUnifiedGroupSources requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.unifiedGroupSource' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.unifiedGroupSource 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete unifiedGroupSource description: >- Delete a unifiedGroupSource object associated with an ediscoveryCustodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-unifiedgroupsource-delete?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.DeleteUnifiedGroupSources parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian - name: unifiedGroupSource-id in: path description: The unique identifier of unifiedGroupSource required: true schema: type: string x-ms-docs-key-type: unifiedGroupSource ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/unifiedGroupSources/{unifiedGroupSource-id}/group : description: >- Provides operations to manage the group property of the microsoft.graph.security.unifiedGroupSource entity. get: tags: - security.casesRoot summary: Microsoft Graph Get group from security description: Represents a group. operationId: security.cases.ediscoveryCases.custodians.unifiedGroupSources.GetGroup parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.group' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian - name: unifiedGroupSource-id in: path description: The unique identifier of unifiedGroupSource required: true schema: type: string x-ms-docs-key-type: unifiedGroupSource ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/unifiedGroupSources/{unifiedGroupSource-id}/group/serviceProvisioningErrors : get: tags: - security.casesRoot summary: Microsoft Graph Get serviceProvisioningErrors property value description: >- Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a group object. Supports $filter (eq, not, for isResolved and serviceInstance). operationId: >- security.cases.ediscoveryCases.custodians.unifiedGroupSources.group.ListServiceProvisioningErrors parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.serviceProvisioningErrorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian - name: unifiedGroupSource-id in: path description: The unique identifier of unifiedGroupSource required: true schema: type: string x-ms-docs-key-type: unifiedGroupSource ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/unifiedGroupSources/{unifiedGroupSource-id}/group/serviceProvisioningErrors/$count : description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: >- security.cases.ediscoveryCases.custodians.unifiedGroupSources.group.ServiceProvisioningErrors.GetCount-2e98 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian - name: unifiedGroupSource-id in: path description: The unique identifier of unifiedGroupSource required: true schema: type: string x-ms-docs-key-type: unifiedGroupSource /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/unifiedGroupSources/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: >- security.cases.ediscoveryCases.custodians.unifiedGroupSources.GetCount-bdfc parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/userSources: description: >- Provides operations to manage the userSources property of the microsoft.graph.security.ediscoveryCustodian entity. get: tags: - security.casesRoot summary: Microsoft Graph List userSources description: >- Get a list of the userSource objects associated with an ediscoveryCustodian or ediscoveryHoldPolicy. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-list-usersources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.ListUserSources parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.userSourceCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create custodian userSource description: Create a new userSource object associated with an eDiscovery custodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-post-usersources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.CreateUserSources requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.userSource' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.userSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/userSources/{userSource-id}: description: >- Provides operations to manage the userSources property of the microsoft.graph.security.ediscoveryCustodian entity. get: tags: - security.casesRoot summary: Microsoft Graph Get userSources from security description: >- Data source entity for a the custodian. This is the container for a custodian's mailbox and OneDrive for Business site. operationId: security.cases.ediscoveryCases.custodians.GetUserSources parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.userSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property userSources in security operationId: security.cases.ediscoveryCases.custodians.UpdateUserSources requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.userSource' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.userSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete userSource description: Delete a userSource object associated with an ediscoveryCustodian. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycustodian-delete-usersources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.custodians.DeleteUserSources parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian - name: userSource-id in: path description: The unique identifier of userSource required: true schema: type: string x-ms-docs-key-type: userSource /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/userSources/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.custodians.userSources.GetCount-9c7a parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryCustodian-id in: path description: The unique identifier of ediscoveryCustodian required: true schema: type: string x-ms-docs-key-type: ediscoveryCustodian /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.custodians.GetCount-ff1d parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.applyHold: description: Provides operations to call the applyHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action applyHold operationId: security.cases.ediscoveryCases.ediscoveryCase.custodians.applyHold requestBody: description: Action parameters content: application/json: schema: type: object properties: ids: type: array items: type: string nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.applyHold /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.removeHold: description: Provides operations to call the removeHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action removeHold operationId: security.cases.ediscoveryCases.ediscoveryCase.custodians.removeHold requestBody: description: Action parameters content: application/json: schema: type: object properties: ids: type: array items: type: string nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.removeHold /security/cases/ediscoveryCases/{ediscoveryCase-id}/microsoft.graph.security.close: description: Provides operations to call the close method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action close description: Close an eDiscovery case. For details, see Close a case. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-close?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ediscoveryCase.close responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/microsoft.graph.security.reopen: description: Provides operations to call the reopen method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action reopen description: >- Reopen an eDiscovery case that was closed. For details, see Reopen a closed case. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-reopen?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ediscoveryCase.reopen responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources: description: >- Provides operations to manage the noncustodialDataSources property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get noncustodialDataSources from security description: >- Returns a list of case ediscoveryNoncustodialDataSource objects for this case. operationId: security.cases.ediscoveryCases.ListNoncustodialDataSources parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryNoncustodialDataSourceCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create nonCustodialDataSources description: Create a new ediscoveryNoncustodialDataSource object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-post-noncustodialdatasources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.CreateNoncustodialDataSources requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}: description: >- Provides operations to manage the noncustodialDataSources property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get noncustodialDataSources from security description: >- Returns a list of case ediscoveryNoncustodialDataSource objects for this case. operationId: security.cases.ediscoveryCases.GetNoncustodialDataSources parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property noncustodialDataSources in security operationId: security.cases.ediscoveryCases.UpdateNoncustodialDataSources requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property noncustodialDataSources for security operationId: security.cases.ediscoveryCases.DeleteNoncustodialDataSources parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/dataSource : description: >- Provides operations to manage the dataSource property of the microsoft.graph.security.ediscoveryNoncustodialDataSource entity. get: tags: - security.casesRoot summary: Microsoft Graph Get dataSource from security description: User source or SharePoint site data source as noncustodial data source. operationId: security.cases.ediscoveryCases.noncustodialDataSources.GetDataSource parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property dataSource in security operationId: security.cases.ediscoveryCases.noncustodialDataSources.UpdateDataSource requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property dataSource for security operationId: security.cases.ediscoveryCases.noncustodialDataSources.DeleteDataSource parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/lastIndexOperation : description: >- Provides operations to manage the lastIndexOperation property of the microsoft.graph.security.ediscoveryNoncustodialDataSource entity. get: tags: - security.casesRoot summary: Microsoft Graph Get lastIndexOperation from security description: >- Operation entity that represents the latest indexing for the noncustodial data source. operationId: >- security.cases.ediscoveryCases.noncustodialDataSources.GetLastIndexOperation parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryIndexOperation 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.applyHold : description: Provides operations to call the applyHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action applyHold description: >- Start the process of applying hold on eDiscovery non-custodial data sources. After the operation is created, you can get the status by retrieving the Location parameter from the response headers. The location provides a URL that returns an eDiscoveryHoldOperation object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverynoncustodialdatasource-applyhold?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.noncustodialDataSources.ediscoveryNoncustodialDataSource.applyHold responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.applyHold ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.release : description: Provides operations to call the release method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action release description: Release the non-custodial data source from the case. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverynoncustodialdatasource-release?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.noncustodialDataSources.ediscoveryNoncustodialDataSource.release responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.release ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.removeHold : description: Provides operations to call the removeHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action removeHold description: >- Start the process of removing hold from eDiscovery non-custodial data sources. After the operation is created, you can get the status by retrieving the Location parameter from the response headers. The location provides a URL that returns an eDiscoveryHoldOperation object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverynoncustodialdatasource-removehold?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.noncustodialDataSources.ediscoveryNoncustodialDataSource.removeHold responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.removeHold ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.updateIndex : description: Provides operations to call the updateIndex method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action updateIndex description: >- Trigger an indexOperation to make a non-custodial data source and its associated data source searchable. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverynoncustodialdatasource-updateindex?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.noncustodialDataSources.ediscoveryNoncustodialDataSource.updateIndex responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.updateIndex /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.noncustodialDataSources.GetCount-68bd parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.applyHold: description: Provides operations to call the applyHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action applyHold operationId: >- security.cases.ediscoveryCases.ediscoveryCase.noncustodialDataSources.applyHold requestBody: description: Action parameters content: application/json: schema: type: object properties: ids: type: array items: type: string nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.applyHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.applyHold /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/microsoft.graph.security.removeHold: description: Provides operations to call the removeHold method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action removeHold operationId: >- security.cases.ediscoveryCases.ediscoveryCase.noncustodialDataSources.removeHold requestBody: description: Action parameters content: application/json: schema: type: object properties: ids: type: array items: type: string nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/microsoft.graph.security.removeHold - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/noncustodialDataSources/{ediscoveryNoncustodialDataSource-id}/microsoft.graph.security.removeHold /security/cases/ediscoveryCases/{ediscoveryCase-id}/operations: description: >- Provides operations to manage the operations property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph List caseOperations description: Get a list of the caseOperation objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-list-operations?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ListOperations parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.caseOperationCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create new navigation property to operations for security operationId: security.cases.ediscoveryCases.CreateOperations requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.caseOperation' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.caseOperation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/operations/{caseOperation-id}: description: >- Provides operations to manage the operations property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get caseOperation description: Read the properties and relationships of a caseOperation object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-caseoperation-get?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.GetOperations parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.caseOperation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property operations in security operationId: security.cases.ediscoveryCases.UpdateOperations requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.caseOperation' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.caseOperation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property operations for security operationId: security.cases.ediscoveryCases.DeleteOperations parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: caseOperation-id in: path description: The unique identifier of caseOperation required: true schema: type: string x-ms-docs-key-type: caseOperation /security/cases/ediscoveryCases/{ediscoveryCase-id}/operations/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.operations.GetCount-4abd parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets: description: >- Provides operations to manage the reviewSets property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph List reviewSets description: >- Get a list of ediscoveryReviewSet objects associated with an eDiscovery case. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-list-reviewsets?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ListReviewSets parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryReviewSetCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create reviewSets description: Create a new ediscoveryReviewSet object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-post-reviewsets?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.CreateReviewSets requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSet required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSet 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}: description: >- Provides operations to manage the reviewSets property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get ediscoveryReviewSet description: Read the properties and relationships of an ediscoveryReviewSet object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewset-get?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.GetReviewSets parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSet 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property reviewSets in security operationId: security.cases.ediscoveryCases.UpdateReviewSets requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSet required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSet 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property reviewSets for security operationId: security.cases.ediscoveryCases.DeleteReviewSets parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/microsoft.graph.security.addToReviewSet : description: Provides operations to call the addToReviewSet method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action addToReviewSet description: >- Start the process of adding a collection from Microsoft 365 services to a review set. After the operation is created, you can get the status of the operation by retrieving the Location parameter from the response headers. The location provides a URL that returns an Add to review set operation. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewset-addtoreviewset?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.reviewSets.ediscoveryReviewSet.addToReviewSet requestBody: description: Action parameters content: application/json: schema: type: object properties: search: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.ediscoverySearch - type: object nullable: true additionalDataOptions: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.additionalDataOptions - type: object nullable: true itemsToInclude: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.itemsToInclude - type: object nullable: true cloudAttachmentVersion: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.cloudAttachmentVersion - type: object nullable: true documentVersion: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.documentVersion - type: object nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/microsoft.graph.security.export: description: Provides operations to call the export method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action export description: >- Initiate an export from a ediscoveryReviewSet. For details, see Export documents from a review set in eDiscovery (Premium). externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewset-export?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.reviewSets.ediscoveryReviewSet.export requestBody: description: Action parameters content: application/json: schema: type: object properties: outputName: type: string nullable: true description: type: string nullable: true exportOptions: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportOptions - type: object nullable: true exportStructure: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportFileStructure - type: object nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/queries/{ediscoveryReviewSetQuery-id}/microsoft.graph.security.export /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/queries: description: >- Provides operations to manage the queries property of the microsoft.graph.security.ediscoveryReviewSet entity. get: tags: - security.casesRoot summary: Microsoft Graph List queries description: Get the list of queries associated with an eDiscovery review set. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewset-list-queries?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.reviewSets.ListQueries parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryReviewSetQueryCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create ediscoveryReviewSetQuery description: Create a new ediscoveryReviewSetQuery object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewset-post-queries?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.reviewSets.CreateQueries requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSetQuery required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSetQuery 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/queries/{ediscoveryReviewSetQuery-id} : description: >- Provides operations to manage the queries property of the microsoft.graph.security.ediscoveryReviewSet entity. get: tags: - security.casesRoot summary: Microsoft Graph Get ediscoveryReviewSetQuery description: >- Read the properties and relationships of an ediscoveryReviewSetQuery object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewsetquery-get?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.reviewSets.GetQueries parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSetQuery 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update ediscoveryReviewSetQuery description: Update the properties of an ediscoveryReviewSetQuery object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewsetquery-update?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.reviewSets.UpdateQueries requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSetQuery required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSetQuery 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete ediscoveryReviewSetQuery description: Delete an ediscoveryReviewSetQuery object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewset-delete-queries?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.reviewSets.DeleteQueries parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet - name: ediscoveryReviewSetQuery-id in: path description: The unique identifier of ediscoveryReviewSetQuery required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSetQuery ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/queries/{ediscoveryReviewSetQuery-id}/microsoft.graph.security.applyTags : description: Provides operations to call the applyTags method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action applyTags description: >- Apply tags to files in an eDiscovery review set. For details, see Tag documents in a review set in eDiscovery. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewsetquery-applytags?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.reviewSets.ediscoveryReviewSet.queries.ediscoveryReviewSetQuery.applyTags requestBody: description: Action parameters content: application/json: schema: type: object properties: tagsToAdd: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag tagsToRemove: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet - name: ediscoveryReviewSetQuery-id in: path description: The unique identifier of ediscoveryReviewSetQuery required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSetQuery ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/queries/{ediscoveryReviewSetQuery-id}/microsoft.graph.security.export : description: Provides operations to call the export method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action export description: >- Initiate an export from a ediscoveryReviewSetQuery. For details, see Export documents from a review set in eDiscovery (Premium). externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewsetquery-export?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.reviewSets.ediscoveryReviewSet.queries.ediscoveryReviewSetQuery.export requestBody: description: Action parameters content: application/json: schema: type: object properties: outputName: type: string nullable: true description: type: string nullable: true exportOptions: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportOptions - type: object nullable: true exportStructure: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportFileStructure - type: object nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet - name: ediscoveryReviewSetQuery-id in: path description: The unique identifier of ediscoveryReviewSetQuery required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSetQuery x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/microsoft.graph.security.export /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/{ediscoveryReviewSet-id}/queries/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.reviewSets.queries.GetCount-5777 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewSet-id in: path description: The unique identifier of ediscoveryReviewSet required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewSet /security/cases/ediscoveryCases/{ediscoveryCase-id}/reviewSets/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.reviewSets.GetCount-feba parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches: description: >- Provides operations to manage the searches property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph List searches description: >- Get the list of ediscoverySearch resources from an eDiscoveryCase object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-list-searches?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ListSearches parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoverySearchCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create searches description: Create a new ediscoverySearch object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-post-searches?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.CreateSearches requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoverySearch' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoverySearch' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}: description: >- Provides operations to manage the searches property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get ediscoverySearch description: Read the properties and relationships of an ediscoverySearch object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-get?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.GetSearches parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoverySearch' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update ediscoverySearch description: Update the properties of an ediscoverySearch object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-update?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.UpdateSearches requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoverySearch' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.ediscoverySearch' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete ediscoverySearch description: Delete an ediscoverySearch object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-delete-searches?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.DeleteSearches parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/additionalSources: description: >- Provides operations to manage the additionalSources property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph List additionalSources description: Get the list of additional sources associated with an eDiscovery search. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-list-additionalsources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.searches.ListAdditionalSources parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.dataSourceCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Add additional sources description: Create a new additional source associated with an eDiscovery search. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-post-additionalsources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.searches.CreateAdditionalSources requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/additionalSources/{dataSource-id}: description: >- Provides operations to manage the additionalSources property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph Get additionalSources from security description: Adds an additional source to the eDiscovery search. operationId: security.cases.ediscoveryCases.searches.GetAdditionalSources parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update the navigation property additionalSources in security operationId: security.cases.ediscoveryCases.searches.UpdateAdditionalSources requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property additionalSources for security operationId: security.cases.ediscoveryCases.searches.DeleteAdditionalSources parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch - name: dataSource-id in: path description: The unique identifier of dataSource required: true schema: type: string x-ms-docs-key-type: dataSource /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/additionalSources/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.searches.additionalSources.GetCount-f0d1 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/addToReviewSetOperation: description: >- Provides operations to manage the addToReviewSetOperation property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph Get addToReviewSetOperation from security description: Adds the results of the eDiscovery search to the specified reviewSet. operationId: security.cases.ediscoveryCases.searches.GetAddToReviewSetOperation parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryAddToReviewSetOperation 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/custodianSources: description: >- Provides operations to manage the custodianSources property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph List custodianSources description: >- Get the list of custodial data sources associated with an eDiscovery search. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-list-custodiansources?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.searches.ListCustodianSources parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.dataSourceCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/custodianSources/{dataSource-id}: description: >- Provides operations to manage the custodianSources property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph Get custodianSources from security description: Custodian sources that are included in the eDiscovery search. operationId: security.cases.ediscoveryCases.searches.GetCustodianSources parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.dataSource' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch - name: dataSource-id in: path description: The unique identifier of dataSource required: true schema: type: string x-ms-docs-key-type: dataSource /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/custodianSources/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.searches.custodianSources.GetCount-fb3f parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/lastEstimateStatisticsOperation: description: >- Provides operations to manage the lastEstimateStatisticsOperation property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph List lastEstimateStatisticsOperation description: Get the last ediscoveryEstimateOperation objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-list-lastestimatestatisticsoperation?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.searches.GetLastEstimateStatisticsOperation parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryEstimateOperation 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.estimateStatistics : description: Provides operations to call the estimateStatistics method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action estimateStatistics description: >- Run an estimate of the number of emails and documents in the eDiscovery search. To learn more about searches in eDiscovery, see Collect data for a case in eDiscovery (Premium). externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-estimatestatistics?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.searches.ediscoverySearch.estimateStatistics responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.exportReport: description: Provides operations to call the exportReport method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action exportReport description: >- Export an item report from an estimated ediscoverySearch. For details, see Manage a collection estimate. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-exportreport?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.searches.ediscoverySearch.exportReport requestBody: description: Action parameters content: application/json: schema: type: object properties: displayName: type: string nullable: true description: type: string nullable: true exportCriteria: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportCriteria - type: object nullable: true exportLocation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportLocation - type: object nullable: true additionalOptions: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.additionalOptions - type: object nullable: true cloudAttachmentVersion: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.cloudAttachmentVersion - type: object nullable: true documentVersion: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.documentVersion - type: object nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.exportResult: description: Provides operations to call the exportResult method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action exportResult description: >- Export results from an estimated ediscoverySearch. For details, see Manage a collection estimate. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-exportresult?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.searches.ediscoverySearch.exportResult requestBody: description: Action parameters content: application/json: schema: type: object properties: displayName: type: string nullable: true description: type: string nullable: true exportCriteria: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportCriteria - type: object nullable: true exportLocation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportLocation - type: object nullable: true additionalOptions: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.additionalOptions - type: object nullable: true exportFormat: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.exportFormat - type: object nullable: true exportSingleItems: type: boolean default: false nullable: true cloudAttachmentVersion: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.cloudAttachmentVersion - type: object nullable: true documentVersion: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.documentVersion - type: object nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.purgeData: description: Provides operations to call the purgeData method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action purgeData description: "Delete Exchange mailbox items or Microsoft Teams messages contained in an eDiscovery search. You can collect and purge the following categories of Teams content:\r\n- Teams 1:1 chats - Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called *conversations*.\r\n- Teams group chats - Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called *1:N* chats or *group conversations*.\r\n- Teams channels - Chat messages, posts, replies, and attachments shared in a standard Teams channel.\r\n- Private channels - Message posts, replies, and attachments shared in a private Teams channel.\r\n- Shared channels - Message posts, replies, and attachments shared in a shared Teams channel. For more information about purging Teams messages, see:\r\n- eDiscovery solution series: Data spillage scenario - Search and purge\r\n- eDiscovery (Premium) workflow for content in Microsoft Teams " externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverysearch-purgedata?view=graph-rest-1.0 operationId: >- security.cases.ediscoveryCases.ediscoveryCase.searches.ediscoverySearch.purgeData requestBody: description: Action parameters content: application/json: schema: type: object properties: purgeType: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.purgeType' - type: object nullable: true purgeAreas: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.purgeAreas' - type: object nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/noncustodialSources: description: >- Provides operations to manage the noncustodialSources property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph Get noncustodialSources from security description: >- noncustodialDataSource sources that are included in the eDiscovery search operationId: security.cases.ediscoveryCases.searches.ListNoncustodialSources parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryNoncustodialDataSourceCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch ? /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/noncustodialSources/{ediscoveryNoncustodialDataSource-id} : description: >- Provides operations to manage the noncustodialSources property of the microsoft.graph.security.ediscoverySearch entity. get: tags: - security.casesRoot summary: Microsoft Graph Get noncustodialSources from security description: >- noncustodialDataSource sources that are included in the eDiscovery search operationId: security.cases.ediscoveryCases.searches.GetNoncustodialSources parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch - name: ediscoveryNoncustodialDataSource-id in: path description: The unique identifier of ediscoveryNoncustodialDataSource required: true schema: type: string x-ms-docs-key-type: ediscoveryNoncustodialDataSource /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/noncustodialSources/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: >- security.cases.ediscoveryCases.searches.noncustodialSources.GetCount-14fa parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoverySearch-id in: path description: The unique identifier of ediscoverySearch required: true schema: type: string x-ms-docs-key-type: ediscoverySearch /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.searches.GetCount-87f1 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/settings: description: >- Provides operations to manage the settings property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get ediscoveryCaseSettings description: >- Read the properties and relationships of an ediscoveryCaseSettings object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycasesettings-get?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.GetSettings parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCaseSettings 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update ediscoveryCaseSettings description: Update the properties of an ediscoveryCaseSettings object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycasesettings-update?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.UpdateSettings requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCaseSettings required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCaseSettings 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Delete navigation property settings for security operationId: security.cases.ediscoveryCases.DeleteSettings parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/settings/microsoft.graph.security.resetToDefault: description: Provides operations to call the resetToDefault method. post: tags: - security.casesRoot summary: Microsoft Graph Invoke action resetToDefault description: Reset a caseSettings object to the default values. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycasesettings-resettodefault?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ediscoveryCase.settings.resetToDefault responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags: description: >- Provides operations to manage the tags property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph List tags description: Get a list of eDiscoveryReviewTag objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-list-tags?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.ListTags parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryReviewTagCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.casesRoot summary: Microsoft Graph Create tags description: Create a new ediscoveryReviewTag object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-post-tags?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.CreateTags requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags/{ediscoveryReviewTag-id}: description: >- Provides operations to manage the tags property of the microsoft.graph.security.ediscoveryCase entity. get: tags: - security.casesRoot summary: Microsoft Graph Get ediscoveryReviewTag description: Read the properties and relationships of an ediscoveryReviewTag object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewtag-get?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.GetTags parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.casesRoot summary: Microsoft Graph Update ediscoveryReviewTag description: Update the properties of an ediscoveryReviewTag object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewtag-update?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.UpdateTags requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.casesRoot summary: Microsoft Graph Remove ediscoveryReviewTag description: Remove an ediscoveryReviewTag object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoverycase-delete-tags?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.DeleteTags parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewTag-id in: path description: The unique identifier of ediscoveryReviewTag required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewTag /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags/{ediscoveryReviewTag-id}/childTags: description: >- Provides operations to manage the childTags property of the microsoft.graph.security.ediscoveryReviewTag entity. get: tags: - security.casesRoot summary: 'Microsoft Graph ediscoveryReviewTag: asHierarchy' description: List eDiscovery review tags with the tag hierarchy shown. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-ediscoveryreviewtag-ashierarchy?view=graph-rest-1.0 operationId: security.cases.ediscoveryCases.tags.ListChildTags parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.ediscoveryReviewTagCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewTag-id in: path description: The unique identifier of ediscoveryReviewTag required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewTag /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags/{ediscoveryReviewTag-id}/childTags/{ediscoveryReviewTag-id1}: description: >- Provides operations to manage the childTags property of the microsoft.graph.security.ediscoveryReviewTag entity. get: tags: - security.casesRoot summary: Microsoft Graph Get childTags from security description: Returns the tags that are a child of a tag. operationId: security.cases.ediscoveryCases.tags.GetChildTags parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewTag-id in: path description: The unique identifier of ediscoveryReviewTag required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewTag - name: ediscoveryReviewTag-id1 in: path description: The unique identifier of ediscoveryReviewTag required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewTag /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags/{ediscoveryReviewTag-id}/childTags/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.tags.childTags.GetCount-5afe parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewTag-id in: path description: The unique identifier of ediscoveryReviewTag required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewTag /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags/{ediscoveryReviewTag-id}/parent: description: >- Provides operations to manage the parent property of the microsoft.graph.security.ediscoveryReviewTag entity. get: tags: - security.casesRoot summary: Microsoft Graph Get parent from security description: Returns the parent tag of the specified tag. operationId: security.cases.ediscoveryCases.tags.GetParent parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase - name: ediscoveryReviewTag-id in: path description: The unique identifier of ediscoveryReviewTag required: true schema: type: string x-ms-docs-key-type: ediscoveryReviewTag /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.tags.GetCount-a3cc parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/{ediscoveryCase-id}/tags/microsoft.graph.security.asHierarchy(): description: Provides operations to call the asHierarchy method. get: tags: - security.casesRoot summary: Microsoft Graph Invoke function asHierarchy description: List eDiscovery review tags with the tag hierarchy shown. operationId: security.cases.ediscoveryCases.ediscoveryCase.tags.asHierarchy parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Success content: application/json: schema: title: Collection of ediscoveryReviewTag type: object allOf: - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse' - type: object properties: value: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore parameters: - name: ediscoveryCase-id in: path description: The unique identifier of ediscoveryCase required: true schema: type: string x-ms-docs-key-type: ediscoveryCase /security/cases/ediscoveryCases/$count: description: Provides operations to count the resources in the collection. get: tags: - security.casesRoot summary: Microsoft Graph Get the number of the resource operationId: security.cases.ediscoveryCases.GetCount-3b6b parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/dataSecurityAndGovernance: description: >- Provides operations to manage the dataSecurityAndGovernance property of the microsoft.graph.security entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get dataSecurityAndGovernance from security operationId: security.GetDataSecurityAndGovernance parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.tenantDataSecurityAndGovernance 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Update the navigation property dataSecurityAndGovernance in security operationId: security.UpdateDataSecurityAndGovernance requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.tenantDataSecurityAndGovernance required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.tenantDataSecurityAndGovernance 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Delete navigation property dataSecurityAndGovernance for security operationId: security.DeleteDataSecurityAndGovernance parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/dataSecurityAndGovernance/processContentAsync: description: Provides operations to call the processContentAsync method. post: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Invoke action processContentAsync operationId: security.dataSecurityAndGovernance.processContentAsync requestBody: description: Action parameters content: application/json: schema: type: object properties: processContentRequests: type: array items: $ref: >- #/components/schemas/microsoft.graph.processContentBatchRequest required: true responses: 2XX: description: Success content: application/json: schema: type: object allOf: - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse' - type: object properties: value: type: array items: $ref: >- #/components/schemas/microsoft.graph.processContentResponses 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore /security/dataSecurityAndGovernance/protectionScopes: description: >- Provides operations to manage the protectionScopes property of the microsoft.graph.tenantDataSecurityAndGovernance entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get protectionScopes from security description: >- Container for actions related to computing tenant-wide data protection scopes. operationId: security.dataSecurityAndGovernance.GetProtectionScopes parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.tenantProtectionScopeContainer 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Update the navigation property protectionScopes in security operationId: security.dataSecurityAndGovernance.UpdateProtectionScopes requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.tenantProtectionScopeContainer required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.tenantProtectionScopeContainer 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Delete navigation property protectionScopes for security operationId: security.dataSecurityAndGovernance.DeleteProtectionScopes parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/dataSecurityAndGovernance/protectionScopes/compute: description: Provides operations to call the compute method. post: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Invoke action compute operationId: security.dataSecurityAndGovernance.protectionScopes.compute requestBody: description: Action parameters content: application/json: schema: type: object properties: activities: anyOf: - $ref: '#/components/schemas/microsoft.graph.userActivityTypes' - type: object nullable: true locations: type: array items: $ref: '#/components/schemas/microsoft.graph.policyLocation' pivotOn: anyOf: - $ref: '#/components/schemas/microsoft.graph.policyPivotProperty' - type: object nullable: true deviceMetadata: anyOf: - $ref: '#/components/schemas/microsoft.graph.deviceMetadata' - type: object nullable: true integratedAppMetadata: anyOf: - $ref: >- #/components/schemas/microsoft.graph.integratedApplicationMetadata - type: object nullable: true required: true responses: 2XX: description: Success content: application/json: schema: type: object allOf: - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse' - type: object properties: value: type: array items: $ref: >- #/components/schemas/microsoft.graph.policyTenantScope 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore /security/dataSecurityAndGovernance/sensitivityLabels: description: >- Provides operations to manage the sensitivityLabels property of the microsoft.graph.dataSecurityAndGovernance entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph List sensitivityLabels description: List the sensitivity labels available for the entire tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/tenantdatasecurityandgovernance-list-sensitivitylabels?view=graph-rest-1.0 operationId: security.dataSecurityAndGovernance.ListSensitivityLabels parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.sensitivityLabelCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Create new navigation property to sensitivityLabels for security operationId: security.dataSecurityAndGovernance.CreateSensitivityLabels requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}: description: >- Provides operations to manage the sensitivityLabels property of the microsoft.graph.dataSecurityAndGovernance entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get sensitivityLabel description: Get a sensitivity label available for the entire tenant. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/sensitivitylabel-get?view=graph-rest-1.0 operationId: security.dataSecurityAndGovernance.GetSensitivityLabels parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Update the navigation property sensitivityLabels in security operationId: security.dataSecurityAndGovernance.UpdateSensitivityLabels requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Delete navigation property sensitivityLabels for security operationId: security.dataSecurityAndGovernance.DeleteSensitivityLabels parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/rights: description: >- Provides operations to manage the rights property of the microsoft.graph.sensitivityLabel entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get usageRightsIncluded description: >- Get the usage rights granted to the calling user for a specific sensitivity label that has admin-defined permissions. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/usagerightsincluded-get?view=graph-rest-1.0 operationId: security.dataSecurityAndGovernance.sensitivityLabels.GetRights parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.usageRightsIncluded' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel x-ms-docs-grouped-path: - >- /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/{sensitivityLabel-id1}/rights /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels: description: >- Provides operations to manage the sublabels property of the microsoft.graph.sensitivityLabel entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get sublabels from security operationId: security.dataSecurityAndGovernance.sensitivityLabels.ListSublabels parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.sensitivityLabelCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Create new navigation property to sublabels for security operationId: security.dataSecurityAndGovernance.sensitivityLabels.CreateSublabels requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/{sensitivityLabel-id1}: description: >- Provides operations to manage the sublabels property of the microsoft.graph.sensitivityLabel entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get sublabels from security operationId: security.dataSecurityAndGovernance.sensitivityLabels.GetSublabels parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Update the navigation property sublabels in security operationId: security.dataSecurityAndGovernance.sensitivityLabels.UpdateSublabels requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Delete navigation property sublabels for security operationId: security.dataSecurityAndGovernance.sensitivityLabels.DeleteSublabels parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel - name: sensitivityLabel-id1 in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/{sensitivityLabel-id1}/rights: description: >- Provides operations to manage the rights property of the microsoft.graph.sensitivityLabel entity. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get rights from security operationId: security.dataSecurityAndGovernance.sensitivityLabels.sublabels.GetRights parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.usageRightsIncluded' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel - name: sensitivityLabel-id1 in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel x-ms-docs-grouped-path: - >- /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/rights /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/$count: description: Provides operations to count the resources in the collection. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get the number of the resource operationId: >- security.dataSecurityAndGovernance.sensitivityLabels.sublabels.GetCount-6580 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel ? /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/computeInheritance(labelIds={labelIds},locale='{locale}',contentFormats={contentFormats}) : description: Provides operations to call the computeInheritance method. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Invoke function computeInheritance description: >- Calculate the sensitivity label that should be inherited by an output artifact, given a set of sensitivity labels from input or referenced artifacts. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/sensitivitylabel-computeinheritance?view=graph-rest-1.0 operationId: >- security.dataSecurityAndGovernance.sensitivityLabels.sensitivityLabel.sublabels.computeInheritance responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel - name: labelIds in: path description: 'Usage: labelIds={labelIds}' required: true content: application/json: schema: type: array items: type: string - name: locale in: path description: 'Usage: locale=''{locale}''' required: true schema: type: string nullable: true - name: contentFormats in: path description: 'Usage: contentFormats={contentFormats}' required: true content: application/json: schema: type: array items: type: string x-ms-docs-grouped-path: - >- /security/dataSecurityAndGovernance/sensitivityLabels/computeInheritance(labelIds={labelIds},locale='{locale}',contentFormats={contentFormats}) /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/computeRightsAndInheritance: description: Provides operations to call the computeRightsAndInheritance method. post: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Invoke action computeRightsAndInheritance description: >- Computes the rights and inheritance for sensitivity labels based on the input content and labels. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/sensitivitylabel-computerightsandinheritance?view=graph-rest-1.0 operationId: >- security.dataSecurityAndGovernance.sensitivityLabels.sensitivityLabel.sublabels.computeRightsAndInheritance requestBody: description: Action parameters content: application/json: schema: type: object properties: delegatedUserEmail: type: string nullable: true locale: type: string nullable: true protectedContents: type: array items: $ref: '#/components/schemas/microsoft.graph.protectedContent' supportedContentFormats: type: array items: type: string required: true responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: >- #/components/schemas/microsoft.graph.computeRightsAndInheritanceResult - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: sensitivityLabel-id in: path description: The unique identifier of sensitivityLabel required: true schema: type: string x-ms-docs-key-type: sensitivityLabel x-ms-docs-grouped-path: - >- /security/dataSecurityAndGovernance/sensitivityLabels/computeRightsAndInheritance /security/dataSecurityAndGovernance/sensitivityLabels/$count: description: Provides operations to count the resources in the collection. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Get the number of the resource operationId: security.dataSecurityAndGovernance.sensitivityLabels.GetCount-bfc1 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' ? /security/dataSecurityAndGovernance/sensitivityLabels/computeInheritance(labelIds={labelIds},locale='{locale}',contentFormats={contentFormats}) : description: Provides operations to call the computeInheritance method. get: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Invoke function computeInheritance description: >- Calculate the sensitivity label that should be inherited by an output artifact, given a set of sensitivity labels from input or referenced artifacts. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/sensitivitylabel-computeinheritance?view=graph-rest-1.0 operationId: security.dataSecurityAndGovernance.sensitivityLabels.computeInheritance responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function parameters: - name: labelIds in: path description: 'Usage: labelIds={labelIds}' required: true content: application/json: schema: type: array items: type: string - name: locale in: path description: 'Usage: locale=''{locale}''' required: true schema: type: string nullable: true - name: contentFormats in: path description: 'Usage: contentFormats={contentFormats}' required: true content: application/json: schema: type: array items: type: string x-ms-docs-grouped-path: - >- /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/computeInheritance(labelIds={labelIds},locale='{locale}',contentFormats={contentFormats}) /security/dataSecurityAndGovernance/sensitivityLabels/computeRightsAndInheritance: description: Provides operations to call the computeRightsAndInheritance method. post: tags: - security.tenantDataSecurityAndGovernance summary: Microsoft Graph Invoke action computeRightsAndInheritance description: >- Computes the rights and inheritance for sensitivity labels based on the input content and labels. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/sensitivitylabel-computerightsandinheritance?view=graph-rest-1.0 operationId: >- security.dataSecurityAndGovernance.sensitivityLabels.computeRightsAndInheritance requestBody: description: Action parameters content: application/json: schema: type: object properties: delegatedUserEmail: type: string nullable: true locale: type: string nullable: true protectedContents: type: array items: $ref: '#/components/schemas/microsoft.graph.protectedContent' supportedContentFormats: type: array items: type: string required: true responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: >- #/components/schemas/microsoft.graph.computeRightsAndInheritanceResult - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action x-ms-docs-grouped-path: - >- /security/dataSecurityAndGovernance/sensitivityLabels/{sensitivityLabel-id}/sublabels/computeRightsAndInheritance /security/identities: description: >- Provides operations to manage the identities property of the microsoft.graph.security entity. get: tags: - security.identityContainer summary: Microsoft Graph Get identities from security description: A container for security identities APIs. operationId: security.GetIdentities parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.identityContainer 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.identityContainer summary: Microsoft Graph Update the navigation property identities in security operationId: security.UpdateIdentities requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.identityContainer' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.identityContainer 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.identityContainer summary: Microsoft Graph Delete navigation property identities for security operationId: security.DeleteIdentities parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/identities/healthIssues: description: >- Provides operations to manage the healthIssues property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph List healthIssues description: Get a list of healthIssue objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-identitycontainer-list-healthissues?view=graph-rest-1.0 operationId: security.identities.ListHealthIssues parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.healthIssueCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.identityContainer summary: Microsoft Graph Create new navigation property to healthIssues for security operationId: security.identities.CreateHealthIssues requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/identities/healthIssues/{healthIssue-id}: description: >- Provides operations to manage the healthIssues property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph Get healthIssue description: Read the properties and relationships of a healthIssue object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-healthissue-get?view=graph-rest-1.0 operationId: security.identities.GetHealthIssues parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.identityContainer summary: Microsoft Graph Update healthIssue description: Update the properties of a healthIssue object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-healthissue-update?view=graph-rest-1.0 operationId: security.identities.UpdateHealthIssues requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.identityContainer summary: Microsoft Graph Delete navigation property healthIssues for security operationId: security.identities.DeleteHealthIssues parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: healthIssue-id in: path description: The unique identifier of healthIssue required: true schema: type: string x-ms-docs-key-type: healthIssue /security/identities/healthIssues/$count: description: Provides operations to count the resources in the collection. get: tags: - security.identityContainer summary: Microsoft Graph Get the number of the resource operationId: security.identities.healthIssues.GetCount-f9af parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/identities/identityAccounts: description: >- Provides operations to manage the identityAccounts property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph List identityAccounts objects description: Get a list of the identityAccounts objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-identitycontainer-list-identityaccounts?view=graph-rest-1.0 operationId: security.identities.ListIdentityAccounts parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.identityAccountsCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.identityContainer summary: Microsoft Graph Create new navigation property to identityAccounts for security operationId: security.identities.CreateIdentityAccounts requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.identityAccounts' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.identityAccounts' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/identities/identityAccounts/{identityAccounts-id}: description: >- Provides operations to manage the identityAccounts property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph Get identityAccounts description: >- Read the properties and relationships of a single identity security account object. This allows retrieving information about available identity accounts. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-identityaccounts-get?view=graph-rest-1.0 operationId: security.identities.GetIdentityAccounts parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.identityAccounts' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.identityContainer summary: Microsoft Graph Update the navigation property identityAccounts in security operationId: security.identities.UpdateIdentityAccounts requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.identityAccounts' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.identityAccounts' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.identityContainer summary: Microsoft Graph Delete navigation property identityAccounts for security operationId: security.identities.DeleteIdentityAccounts parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: identityAccounts-id in: path description: The unique identifier of identityAccounts required: true schema: type: string x-ms-docs-key-type: identityAccounts /security/identities/identityAccounts/{identityAccounts-id}/microsoft.graph.security.invokeAction: description: Provides operations to call the invokeAction method. post: tags: - security.identityContainer summary: Microsoft Graph Invoke action invokeAction description: >- Perform actions such as revoking accounts and forcing password reset for identity accounts that are observed in Microsoft Defender for Identity. This action allows reading and performing identity security actions on behalf of the signed-in identity. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-identityaccounts-invokeaction?view=graph-rest-1.0 operationId: security.identities.identityAccounts.identityAccounts.invokeAction requestBody: description: Action parameters content: application/json: schema: type: object properties: accountId: type: string action: $ref: '#/components/schemas/microsoft.graph.security.action' identityProvider: $ref: >- #/components/schemas/microsoft.graph.security.identityProvider required: true responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.invokeActionResult - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action parameters: - name: identityAccounts-id in: path description: The unique identifier of identityAccounts required: true schema: type: string x-ms-docs-key-type: identityAccounts /security/identities/identityAccounts/$count: description: Provides operations to count the resources in the collection. get: tags: - security.identityContainer summary: Microsoft Graph Get the number of the resource operationId: security.identities.identityAccounts.GetCount-3544 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/identities/sensorCandidateActivationConfiguration: description: >- Provides operations to manage the sensorCandidateActivationConfiguration property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph Get sensorCandidateActivationConfiguration description: >- Read the properties and relationships of microsoft.graph.security.sensorCandidateActivationConfiguration object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-sensorcandidateactivationconfiguration-get?view=graph-rest-1.0 operationId: security.identities.GetSensorCandidateActivationConfiguration parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.sensorCandidateActivationConfiguration 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.identityContainer summary: >- Microsoft Graph Update the navigation property sensorCandidateActivationConfiguration in security operationId: security.identities.UpdateSensorCandidateActivationConfiguration requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.sensorCandidateActivationConfiguration required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.sensorCandidateActivationConfiguration 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.identityContainer summary: >- Microsoft Graph Delete navigation property sensorCandidateActivationConfiguration for security operationId: security.identities.DeleteSensorCandidateActivationConfiguration parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/identities/sensorCandidates: description: >- Provides operations to manage the sensorCandidates property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph List sensorCandidate objects description: Get a list of the sensorCandidate objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-identitycontainer-list-sensorcandidates?view=graph-rest-1.0 operationId: security.identities.ListSensorCandidates parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.sensorCandidateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.identityContainer summary: Microsoft Graph Create new navigation property to sensorCandidates for security operationId: security.identities.CreateSensorCandidates requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensorCandidate' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensorCandidate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/identities/sensorCandidates/{sensorCandidate-id}: description: >- Provides operations to manage the sensorCandidates property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph Get sensorCandidates from security description: >- Represents Microsoft Defender for Identity sensors that are ready to be activated. operationId: security.identities.GetSensorCandidates parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensorCandidate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.identityContainer summary: Microsoft Graph Update the navigation property sensorCandidates in security operationId: security.identities.UpdateSensorCandidates requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensorCandidate' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensorCandidate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.identityContainer summary: Microsoft Graph Delete navigation property sensorCandidates for security operationId: security.identities.DeleteSensorCandidates parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensorCandidate-id in: path description: The unique identifier of sensorCandidate required: true schema: type: string x-ms-docs-key-type: sensorCandidate /security/identities/sensorCandidates/$count: description: Provides operations to count the resources in the collection. get: tags: - security.identityContainer summary: Microsoft Graph Get the number of the resource operationId: security.identities.sensorCandidates.GetCount-fa5a parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/identities/sensorCandidates/microsoft.graph.security.activate: description: Provides operations to call the activate method. post: tags: - security.identityContainer summary: Microsoft Graph Invoke action activate description: Activate Microsoft Defender for Identity sensors. operationId: security.identities.sensorCandidates.activate requestBody: description: Action parameters content: application/json: schema: type: object properties: serverIds: type: array items: type: string nullable: true required: true responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action x-ms-docs-grouped-path: - >- /security/cases/ediscoveryCases/{ediscoveryCase-id}/custodians/{ediscoveryCustodian-id}/microsoft.graph.security.activate /security/identities/sensors: description: >- Provides operations to manage the sensors property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph List sensors description: Get a list of sensor objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-identitycontainer-list-sensors?view=graph-rest-1.0 operationId: security.identities.ListSensors parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.sensorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.identityContainer summary: Microsoft Graph Create new navigation property to sensors for security operationId: security.identities.CreateSensors requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensor' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensor' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/identities/sensors/{sensor-id}: description: >- Provides operations to manage the sensors property of the microsoft.graph.security.identityContainer entity. get: tags: - security.identityContainer summary: Microsoft Graph Get sensor description: Read the properties and relationships of a sensor object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-sensor-get?view=graph-rest-1.0 operationId: security.identities.GetSensors parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensor' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.identityContainer summary: Microsoft Graph Update sensor description: Update the properties of a sensor object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-sensor-update?view=graph-rest-1.0 operationId: security.identities.UpdateSensors requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensor' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sensor' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.identityContainer summary: Microsoft Graph Delete sensor description: Delete a sensor object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-sensor-delete?view=graph-rest-1.0 operationId: security.identities.DeleteSensors parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensor-id in: path description: The unique identifier of sensor required: true schema: type: string x-ms-docs-key-type: sensor /security/identities/sensors/{sensor-id}/healthIssues: description: >- Provides operations to manage the healthIssues property of the microsoft.graph.security.sensor entity. get: tags: - security.identityContainer summary: Microsoft Graph Get healthIssues from security description: >- Represents potential issues within a customer's Microsoft Defender for Identity configuration that Microsoft Defender for Identity identified related to the sensor. operationId: security.identities.sensors.ListHealthIssues parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.healthIssueCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: sensor-id in: path description: The unique identifier of sensor required: true schema: type: string x-ms-docs-key-type: sensor /security/identities/sensors/{sensor-id}/healthIssues/{healthIssue-id}: description: >- Provides operations to manage the healthIssues property of the microsoft.graph.security.sensor entity. get: tags: - security.identityContainer summary: Microsoft Graph Get healthIssues from security description: >- Represents potential issues within a customer's Microsoft Defender for Identity configuration that Microsoft Defender for Identity identified related to the sensor. operationId: security.identities.sensors.GetHealthIssues parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sensor-id in: path description: The unique identifier of sensor required: true schema: type: string x-ms-docs-key-type: sensor - name: healthIssue-id in: path description: The unique identifier of healthIssue required: true schema: type: string x-ms-docs-key-type: healthIssue /security/identities/sensors/{sensor-id}/healthIssues/$count: description: Provides operations to count the resources in the collection. get: tags: - security.identityContainer summary: Microsoft Graph Get the number of the resource operationId: security.identities.sensors.healthIssues.GetCount-0a59 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: sensor-id in: path description: The unique identifier of sensor required: true schema: type: string x-ms-docs-key-type: sensor /security/identities/sensors/$count: description: Provides operations to count the resources in the collection. get: tags: - security.identityContainer summary: Microsoft Graph Get the number of the resource operationId: security.identities.sensors.GetCount-000d parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/identities/sensors/microsoft.graph.security.getDeploymentAccessKey(): description: Provides operations to call the getDeploymentAccessKey method. get: tags: - security.identityContainer summary: Microsoft Graph Invoke function getDeploymentAccessKey description: >- Get the deployment access key for Microsoft Defender for Identity that is required to install sensors associated with the workspace. operationId: security.identities.sensors.getDeploymentAccessKey responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.deploymentAccessKeyType - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function /security/identities/sensors/microsoft.graph.security.getDeploymentPackageUri(): description: Provides operations to call the getDeploymentPackageUri method. get: tags: - security.identityContainer summary: Microsoft Graph Invoke function getDeploymentPackageUri description: >- Get the sensor deployment package URL and version. You can use this URL to download the installer to install the sensor on a server. operationId: security.identities.sensors.getDeploymentPackageUri responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.sensorDeploymentPackage - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function /security/identities/sensors/microsoft.graph.security.regenerateDeploymentAccessKey: description: Provides operations to call the regenerateDeploymentAccessKey method. post: tags: - security.identityContainer summary: Microsoft Graph Invoke action regenerateDeploymentAccessKey description: >- Generate a new deployment access key that can be used to install a sensor associated with the workspace. operationId: security.identities.sensors.regenerateDeploymentAccessKey responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.deploymentAccessKeyType - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action /security/incidents: description: >- Provides operations to manage the incidents property of the microsoft.graph.security entity. get: tags: - Security.incident summary: Microsoft Graph List incidents description: >- Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident. This operation allows you to filter and sort through incidents to create an informed cyber security response. It exposes a collection of incidents that were flagged in your network, within the time range you specified in your environment retention policy. The most recent incidents are displayed at the top of the list. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-list-incidents?view=graph-rest-1.0 operationId: security.ListIncidents parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.incidentCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - Security.incident summary: Microsoft Graph Create new navigation property to incidents for security operationId: security.CreateIncidents requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.incident' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.incident' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/incidents/{incident-id}: description: >- Provides operations to manage the incidents property of the microsoft.graph.security entity. get: tags: - Security.incident summary: Microsoft Graph Get incident description: >- Retrieve the properties and relationships of an incident object. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-incident-get?view=graph-rest-1.0 operationId: security.GetIncidents parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.incident' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - Security.incident summary: Microsoft Graph Update incident description: Update the properties of an incident object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-incident-update?view=graph-rest-1.0 operationId: security.UpdateIncidents requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.incident' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.incident' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - Security.incident summary: Microsoft Graph Delete navigation property incidents for security operationId: security.DeleteIncidents parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: incident-id in: path description: The unique identifier of incident required: true schema: type: string x-ms-docs-key-type: incident /security/incidents/{incident-id}/alerts: description: >- Provides operations to manage the alerts property of the microsoft.graph.security.incident entity. get: tags: - Security.incident summary: Microsoft Graph Get alerts from security description: The list of related alerts. Supports $expand. operationId: security.incidents.ListAlerts parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.alertCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: incident-id in: path description: The unique identifier of incident required: true schema: type: string x-ms-docs-key-type: incident /security/incidents/{incident-id}/alerts/{alert-id}: description: >- Provides operations to manage the alerts property of the microsoft.graph.security.incident entity. get: tags: - Security.incident summary: Microsoft Graph Get alerts from security description: The list of related alerts. Supports $expand. operationId: security.incidents.GetAlerts parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.alert' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: incident-id in: path description: The unique identifier of incident required: true schema: type: string x-ms-docs-key-type: incident - name: alert-id in: path description: The unique identifier of alert required: true schema: type: string x-ms-docs-key-type: alert /security/incidents/{incident-id}/alerts/{alert-id}/comments: post: tags: - Security.incident summary: Microsoft Graph Sets a new value for the collection of alertComment. operationId: security.incidents.alerts.SetComments parameters: - name: If-Match in: header description: ETag schema: type: string requestBody: description: New property values content: application/json: schema: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alertComment' required: true responses: 2XX: description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alertComment' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: incident-id in: path description: The unique identifier of incident required: true schema: type: string x-ms-docs-key-type: incident - name: alert-id in: path description: The unique identifier of alert required: true schema: type: string x-ms-docs-key-type: alert /security/incidents/{incident-id}/alerts/{alert-id}/comments/$count: description: Provides operations to count the resources in the collection. get: tags: - Security.incident summary: Microsoft Graph Get the number of the resource operationId: security.incidents.alerts.Comments.GetCount-ee8f parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: incident-id in: path description: The unique identifier of incident required: true schema: type: string x-ms-docs-key-type: incident - name: alert-id in: path description: The unique identifier of alert required: true schema: type: string x-ms-docs-key-type: alert /security/incidents/{incident-id}/alerts/$count: description: Provides operations to count the resources in the collection. get: tags: - Security.incident summary: Microsoft Graph Get the number of the resource operationId: security.incidents.alerts.GetCount-d6ba parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: incident-id in: path description: The unique identifier of incident required: true schema: type: string x-ms-docs-key-type: incident /security/incidents/$count: description: Provides operations to count the resources in the collection. get: tags: - Security.incident summary: Microsoft Graph Get the number of the resource operationId: security.incidents.GetCount-9725 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/labels: description: >- Provides operations to manage the labels property of the microsoft.graph.security entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get labels from security operationId: security.GetLabels parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.labelsRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property labels in security operationId: security.UpdateLabels requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.labelsRoot' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.labelsRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete navigation property labels for security operationId: security.DeleteLabels parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/labels/authorities: description: >- Provides operations to manage the authorities property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph List authorityTemplates description: Get a list of the authorityTemplate objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-list-authorities?view=graph-rest-1.0 operationId: security.labels.ListAuthorities parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.authorityTemplateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create authorityTemplate description: Create a new authorityTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-post-authorities?view=graph-rest-1.0 operationId: security.labels.CreateAuthorities requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.authorityTemplate' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.authorityTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/labels/authorities/{authorityTemplate-id}: description: >- Provides operations to manage the authorities property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get authorityTemplate description: Read the properties and relationships of a authorityTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-authoritytemplate-get?view=graph-rest-1.0 operationId: security.labels.GetAuthorities parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.authorityTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property authorities in security operationId: security.labels.UpdateAuthorities requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.authorityTemplate' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.authorityTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete authorityTemplate description: Delete a authorityTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-delete-authorities?view=graph-rest-1.0 operationId: security.labels.DeleteAuthorities parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: authorityTemplate-id in: path description: The unique identifier of authorityTemplate required: true schema: type: string x-ms-docs-key-type: authorityTemplate /security/labels/authorities/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.authorities.GetCount-ecc0 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/labels/categories: description: >- Provides operations to manage the categories property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph List categoryTemplates description: Get a list of the categoryTemplate objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-list-categories?view=graph-rest-1.0 operationId: security.labels.ListCategories parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.categoryTemplateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create categoryTemplate description: Create a new categoryTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-post-categories?view=graph-rest-1.0 operationId: security.labels.CreateCategories requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.categoryTemplate' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.categoryTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/labels/categories/{categoryTemplate-id}: description: >- Provides operations to manage the categories property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get categoryTemplate description: Read the properties and relationships of a categoryTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-categorytemplate-get?view=graph-rest-1.0 operationId: security.labels.GetCategories parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.categoryTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property categories in security operationId: security.labels.UpdateCategories requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.categoryTemplate' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.categoryTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete categoryTemplate description: Delete a categoryTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-delete-categories?view=graph-rest-1.0 operationId: security.labels.DeleteCategories parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: categoryTemplate-id in: path description: The unique identifier of categoryTemplate required: true schema: type: string x-ms-docs-key-type: categoryTemplate /security/labels/categories/{categoryTemplate-id}/subcategories: description: >- Provides operations to manage the subcategories property of the microsoft.graph.security.categoryTemplate entity. get: tags: - security.labelsRoot summary: Microsoft Graph List subcategories description: >- Get a list of subcategories subcategoryTemplate associated with a category template. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-categorytemplate-list-subcategories?view=graph-rest-1.0 operationId: security.labels.categories.ListSubcategories parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.subcategoryTemplateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create subcategoryTemplate description: Create a new subcategoryTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-categorytemplate-post-subcategories?view=graph-rest-1.0 operationId: security.labels.categories.CreateSubcategories requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.subcategoryTemplate required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.subcategoryTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: categoryTemplate-id in: path description: The unique identifier of categoryTemplate required: true schema: type: string x-ms-docs-key-type: categoryTemplate /security/labels/categories/{categoryTemplate-id}/subcategories/{subcategoryTemplate-id}: description: >- Provides operations to manage the subcategories property of the microsoft.graph.security.categoryTemplate entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get subcategoryTemplate description: Read the properties and relationships of a subcategoryTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-subcategorytemplate-get?view=graph-rest-1.0 operationId: security.labels.categories.GetSubcategories parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.subcategoryTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property subcategories in security operationId: security.labels.categories.UpdateSubcategories requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.subcategoryTemplate required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.subcategoryTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete navigation property subcategories for security operationId: security.labels.categories.DeleteSubcategories parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: categoryTemplate-id in: path description: The unique identifier of categoryTemplate required: true schema: type: string x-ms-docs-key-type: categoryTemplate - name: subcategoryTemplate-id in: path description: The unique identifier of subcategoryTemplate required: true schema: type: string x-ms-docs-key-type: subcategoryTemplate /security/labels/categories/{categoryTemplate-id}/subcategories/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.categories.subcategories.GetCount-ec6d parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: categoryTemplate-id in: path description: The unique identifier of categoryTemplate required: true schema: type: string x-ms-docs-key-type: categoryTemplate /security/labels/categories/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.categories.GetCount-908b parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/labels/citations: description: >- Provides operations to manage the citations property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph List citationTemplates description: Get a list of the citationTemplate objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-list-citations?view=graph-rest-1.0 operationId: security.labels.ListCitations parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.citationTemplateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create citationTemplate description: Create a new citationTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-post-citations?view=graph-rest-1.0 operationId: security.labels.CreateCitations requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.citationTemplate' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.citationTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/labels/citations/{citationTemplate-id}: description: >- Provides operations to manage the citations property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get citationTemplate description: Read the properties and relationships of a citationTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-citationtemplate-get?view=graph-rest-1.0 operationId: security.labels.GetCitations parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.citationTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property citations in security operationId: security.labels.UpdateCitations requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.citationTemplate' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.citationTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete citationTemplate description: Delete a citationTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-delete-citations?view=graph-rest-1.0 operationId: security.labels.DeleteCitations parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: citationTemplate-id in: path description: The unique identifier of citationTemplate required: true schema: type: string x-ms-docs-key-type: citationTemplate /security/labels/citations/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.citations.GetCount-15c2 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/labels/departments: description: >- Provides operations to manage the departments property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph List departmentTemplates description: Get a list of the departmentTemplate objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-list-departments?view=graph-rest-1.0 operationId: security.labels.ListDepartments parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.departmentTemplateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create departmentTemplate description: Create a new departmentTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-post-departments?view=graph-rest-1.0 operationId: security.labels.CreateDepartments requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.departmentTemplate' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.departmentTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/labels/departments/{departmentTemplate-id}: description: >- Provides operations to manage the departments property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get departmentTemplate description: Read the properties and relationships of a departmentTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-departmenttemplate-get?view=graph-rest-1.0 operationId: security.labels.GetDepartments parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.departmentTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property departments in security operationId: security.labels.UpdateDepartments requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.departmentTemplate' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.departmentTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete departmentTemplate description: Delete a departmentTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-delete-departments?view=graph-rest-1.0 operationId: security.labels.DeleteDepartments parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: departmentTemplate-id in: path description: The unique identifier of departmentTemplate required: true schema: type: string x-ms-docs-key-type: departmentTemplate /security/labels/departments/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.departments.GetCount-b983 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/labels/filePlanReferences: description: >- Provides operations to manage the filePlanReferences property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph List filePlanReferenceTemplates description: >- Get a list of the filePlanReferenceTemplate objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-list-fileplanreferences?view=graph-rest-1.0 operationId: security.labels.ListFilePlanReferences parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.filePlanReferenceTemplateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create filePlanReferenceTemplate description: Create a new filePlanReferenceTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-post-fileplanreferences?view=graph-rest-1.0 operationId: security.labels.CreateFilePlanReferences requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/labels/filePlanReferences/{filePlanReferenceTemplate-id}: description: >- Provides operations to manage the filePlanReferences property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get filePlanReferenceTemplate description: >- Read the properties and relationships of a filePlanReferenceTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-fileplanreferencetemplate-get?view=graph-rest-1.0 operationId: security.labels.GetFilePlanReferences parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property filePlanReferences in security operationId: security.labels.UpdateFilePlanReferences requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete filePlanReferenceTemplate description: Delete a filePlanReferenceTemplate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-delete-fileplanreferences?view=graph-rest-1.0 operationId: security.labels.DeleteFilePlanReferences parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: filePlanReferenceTemplate-id in: path description: The unique identifier of filePlanReferenceTemplate required: true schema: type: string x-ms-docs-key-type: filePlanReferenceTemplate /security/labels/filePlanReferences/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.filePlanReferences.GetCount-3c22 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/labels/retentionLabels: description: >- Provides operations to manage the retentionLabels property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph List retentionLabels description: Get a list of the retentionLabel objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-list-retentionlabel?view=graph-rest-1.0 operationId: security.labels.ListRetentionLabels parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.retentionLabelCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create retentionLabel description: >- Create a new retentionLabel object. To create a disposition review stage, include the actionAfterRetentionPeriod property in the request body with one of the possible values specified. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-labelsroot-post-retentionlabel?view=graph-rest-1.0 operationId: security.labels.CreateRetentionLabels requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionLabel' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/labels/retentionLabels/{retentionLabel-id}: description: >- Provides operations to manage the retentionLabels property of the microsoft.graph.security.labelsRoot entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get retentionLabels from security description: >- Represents how customers can manage their data, whether and for how long to retain or delete it. operationId: security.labels.GetRetentionLabels parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update retentionLabel description: >- Update the properties of a retentionLabel object. To update a disposition review stage, include the actionAfterRetentionPeriod property in the request body with one of the possible values specified. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentionlabel-update?view=graph-rest-1.0 operationId: security.labels.UpdateRetentionLabels requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionLabel' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionLabel' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete retentionLabel description: Delete a retentionLabel object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentionlabel-delete?view=graph-rest-1.0 operationId: security.labels.DeleteRetentionLabels parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/descriptors: description: >- Provides operations to manage the descriptors property of the microsoft.graph.security.retentionLabel entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get descriptors from security description: >- Represents out-of-the-box values that provide more options to improve the manageability and organization of the content you need to label. operationId: security.labels.retentionLabels.GetDescriptors parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanDescriptor 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property descriptors in security operationId: security.labels.retentionLabels.UpdateDescriptors requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.filePlanDescriptor' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanDescriptor 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete navigation property descriptors for security operationId: security.labels.retentionLabels.DeleteDescriptors parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/descriptors/authorityTemplate: description: >- Provides operations to manage the authorityTemplate property of the microsoft.graph.security.filePlanDescriptor entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get authorityTemplate from security description: >- Specifies the underlying authority that describes the type of content to be retained and its retention schedule. operationId: security.labels.retentionLabels.descriptors.GetAuthorityTemplate parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.authorityTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/descriptors/categoryTemplate: description: >- Provides operations to manage the categoryTemplate property of the microsoft.graph.security.filePlanDescriptor entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get categoryTemplate from security description: >- Specifies a group of similar types of content in a particular department. operationId: security.labels.retentionLabels.descriptors.GetCategoryTemplate parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.categoryTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/descriptors/citationTemplate: description: >- Provides operations to manage the citationTemplate property of the microsoft.graph.security.filePlanDescriptor entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get citationTemplate from security description: >- The specific rule or regulation created by a jurisdiction used to determine whether certain labels and content should be retained or deleted. operationId: security.labels.retentionLabels.descriptors.GetCitationTemplate parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.citationTemplate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/descriptors/departmentTemplate: description: >- Provides operations to manage the departmentTemplate property of the microsoft.graph.security.filePlanDescriptor entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get departmentTemplate from security description: >- Specifies the department or business unit of an organization to which a label belongs. operationId: security.labels.retentionLabels.descriptors.GetDepartmentTemplate parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.departmentTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/descriptors/filePlanReferenceTemplate: description: >- Provides operations to manage the filePlanReferenceTemplate property of the microsoft.graph.security.filePlanDescriptor entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get filePlanReferenceTemplate from security description: >- Specifies a unique alpha-numeric identifier for an organization’s retention schedule. operationId: security.labels.retentionLabels.descriptors.GetFilePlanReferenceTemplate parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/dispositionReviewStages: description: >- Provides operations to manage the dispositionReviewStages property of the microsoft.graph.security.retentionLabel entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get dispositionReviewStages from security description: >- When action at the end of retention is chosen as 'dispositionReview', dispositionReviewStages specifies a sequential set of stages with at least one reviewer in each stage. operationId: security.labels.retentionLabels.ListDispositionReviewStages parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.dispositionReviewStageCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.labelsRoot summary: Microsoft Graph Create new navigation property to dispositionReviewStages for security operationId: security.labels.retentionLabels.CreateDispositionReviewStages requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.dispositionReviewStage required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.dispositionReviewStage 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/dispositionReviewStages/{dispositionReviewStage-stageNumber}: description: >- Provides operations to manage the dispositionReviewStages property of the microsoft.graph.security.retentionLabel entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get dispositionReviewStages from security description: >- When action at the end of retention is chosen as 'dispositionReview', dispositionReviewStages specifies a sequential set of stages with at least one reviewer in each stage. operationId: security.labels.retentionLabels.GetDispositionReviewStages parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.dispositionReviewStage 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.labelsRoot summary: Microsoft Graph Update the navigation property dispositionReviewStages in security operationId: security.labels.retentionLabels.UpdateDispositionReviewStages requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.dispositionReviewStage required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.dispositionReviewStage 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.labelsRoot summary: Microsoft Graph Delete navigation property dispositionReviewStages for security operationId: security.labels.retentionLabels.DeleteDispositionReviewStages parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel - name: dispositionReviewStage-stageNumber in: path description: The unique identifier of dispositionReviewStage required: true schema: type: string x-ms-docs-key-type: dispositionReviewStage /security/labels/retentionLabels/{retentionLabel-id}/dispositionReviewStages/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.retentionLabels.dispositionReviewStages.GetCount-48b2 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/{retentionLabel-id}/retentionEventType: description: >- Provides operations to manage the retentionEventType property of the microsoft.graph.security.retentionLabel entity. get: tags: - security.labelsRoot summary: Microsoft Graph Get retentionEventType from security description: Represents the type associated with a retention event. operationId: security.labels.retentionLabels.GetRetentionEventType parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionLabel-id in: path description: The unique identifier of retentionLabel required: true schema: type: string x-ms-docs-key-type: retentionLabel /security/labels/retentionLabels/$count: description: Provides operations to count the resources in the collection. get: tags: - security.labelsRoot summary: Microsoft Graph Get the number of the resource operationId: security.labels.retentionLabels.GetCount-3249 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/microsoft.graph.security.runHuntingQuery: description: Provides operations to call the runHuntingQuery method. post: tags: - security.security.Actions summary: Microsoft Graph Invoke action runHuntingQuery description: >- Queries a specified set of event, activity, or entity data supported by Microsoft 365 Defender to proactively look for specific threats in your environment. This method is for advanced hunting in Microsoft 365 Defender. This method includes a query in Kusto Query Language (KQL). It specifies a data table in the advanced hunting schema and a piped sequence of operators to filter or search that data, and format the query output in specific ways. Find out more about hunting for threats across devices, emails, apps, and identities. Learn about KQL. For information on using advanced hunting in the Microsoft 365 Defender portal, see Proactively hunt for threats with advanced hunting in Microsoft 365 Defender. operationId: security.runHuntingQuery requestBody: description: Action parameters content: application/json: schema: type: object properties: query: type: string nullable: true timespan: type: string nullable: true required: true responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.huntingQueryResults - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action /security/secureScoreControlProfiles: description: >- Provides operations to manage the secureScoreControlProfiles property of the microsoft.graph.security entity. get: tags: - security.secureScoreControlProfile summary: Microsoft Graph List secureScoreControlProfiles description: >- Retrieve the properties and relationships of a secureScoreControlProfiles object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-list-securescorecontrolprofiles?view=graph-rest-1.0 operationId: security.ListSecureScoreControlProfiles parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.secureScoreControlProfileCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.secureScoreControlProfile summary: >- Microsoft Graph Create new navigation property to secureScoreControlProfiles for security operationId: security.CreateSecureScoreControlProfiles requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScoreControlProfile' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScoreControlProfile' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/secureScoreControlProfiles/{secureScoreControlProfile-id}: description: >- Provides operations to manage the secureScoreControlProfiles property of the microsoft.graph.security entity. get: tags: - security.secureScoreControlProfile summary: Microsoft Graph Get secureScoreControlProfile description: >- Retrieve the properties and relationships of an securescorecontrolprofile object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/securescorecontrolprofile-get?view=graph-rest-1.0 operationId: security.GetSecureScoreControlProfiles parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScoreControlProfile' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.secureScoreControlProfile summary: Microsoft Graph Update secureScoreControlProfile description: >- Update an editable secureScoreControlProfile object within any integrated solution to change various properties, such as assignedTo or tenantNote. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/securescorecontrolprofile-update?view=graph-rest-1.0 operationId: security.UpdateSecureScoreControlProfiles requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScoreControlProfile' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScoreControlProfile' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.secureScoreControlProfile summary: Microsoft Graph Delete navigation property secureScoreControlProfiles for security operationId: security.DeleteSecureScoreControlProfiles parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: secureScoreControlProfile-id in: path description: The unique identifier of secureScoreControlProfile required: true schema: type: string x-ms-docs-key-type: secureScoreControlProfile /security/secureScoreControlProfiles/$count: description: Provides operations to count the resources in the collection. get: tags: - security.secureScoreControlProfile summary: Microsoft Graph Get the number of the resource operationId: security.secureScoreControlProfiles.GetCount-05f1 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/secureScores: description: >- Provides operations to manage the secureScores property of the microsoft.graph.security entity. get: tags: - security.secureScore summary: Microsoft Graph List secureScores description: Retrieve a list of secureScore objects. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-list-securescores?view=graph-rest-1.0 operationId: security.ListSecureScores parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.secureScoreCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.secureScore summary: Microsoft Graph Create new navigation property to secureScores for security operationId: security.CreateSecureScores requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScore' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScore' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/secureScores/{secureScore-id}: description: >- Provides operations to manage the secureScores property of the microsoft.graph.security entity. get: tags: - security.secureScore summary: Microsoft Graph Get secureScore description: Retrieve the properties and relationships of a secureScore object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/securescore-get?view=graph-rest-1.0 operationId: security.GetSecureScores parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScore' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.secureScore summary: Microsoft Graph Update the navigation property secureScores in security operationId: security.UpdateSecureScores requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScore' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScore' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.secureScore summary: Microsoft Graph Delete navigation property secureScores for security operationId: security.DeleteSecureScores parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: secureScore-id in: path description: The unique identifier of secureScore required: true schema: type: string x-ms-docs-key-type: secureScore /security/secureScores/$count: description: Provides operations to count the resources in the collection. get: tags: - security.secureScore summary: Microsoft Graph Get the number of the resource operationId: security.secureScores.GetCount-cb39 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/subjectRightsRequests: description: >- Provides operations to manage the subjectRightsRequests property of the microsoft.graph.security entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get subjectRightsRequests from security operationId: security.ListSubjectRightsRequests parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.subjectRightsRequestCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.subjectRightsRequest summary: Microsoft Graph Create new navigation property to subjectRightsRequests for security operationId: security.CreateSubjectRightsRequests requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.subjectRightsRequest' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.subjectRightsRequest' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/subjectRightsRequests/{subjectRightsRequest-id}: description: >- Provides operations to manage the subjectRightsRequests property of the microsoft.graph.security entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get subjectRightsRequests from security operationId: security.GetSubjectRightsRequests parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.subjectRightsRequest' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.subjectRightsRequest summary: Microsoft Graph Update the navigation property subjectRightsRequests in security operationId: security.UpdateSubjectRightsRequests requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.subjectRightsRequest' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.subjectRightsRequest' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.subjectRightsRequest summary: Microsoft Graph Delete navigation property subjectRightsRequests for security operationId: security.DeleteSubjectRightsRequests parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers: description: >- Provides operations to manage the approvers property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get approvers from security description: >- Collection of users who can approve the request. Currently only supported for requests of type delete. operationId: security.subjectRightsRequests.ListApprovers parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.userCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers/{user-id}: description: >- Provides operations to manage the approvers property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get approvers from security description: >- Collection of users who can approve the request. Currently only supported for requests of type delete. operationId: security.subjectRightsRequests.GetApprovers parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.user' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user x-ms-docs-grouped-path: - >- /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers(userPrincipalName='{userPrincipalName}') /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers/{user-id}/mailboxSettings: get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get mailboxSettings property value description: >- Settings for the primary mailbox of the signed-in user. You can get or update settings for sending automatic replies to incoming messages, locale, and time zone. Returned only on $select. operationId: security.subjectRightsRequests.approvers.GetMailboxSettings parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Entity result. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.mailboxSettings' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' patch: tags: - security.subjectRightsRequest summary: Microsoft Graph Update property mailboxSettings value. operationId: security.subjectRightsRequests.approvers.UpdateMailboxSettings requestBody: description: New property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.mailboxSettings' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.mailboxSettings' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers/{user-id}/serviceProvisioningErrors: get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get serviceProvisioningErrors property value description: >- Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a user object. Supports $filter (eq, not, for isResolved and serviceInstance). operationId: security.subjectRightsRequests.approvers.ListServiceProvisioningErrors parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.serviceProvisioningErrorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers/{user-id}/serviceProvisioningErrors/$count: description: Provides operations to count the resources in the collection. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get the number of the resource operationId: >- security.subjectRightsRequests.approvers.ServiceProvisioningErrors.GetCount-2135 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers(userPrincipalName='{userPrincipalName}'): description: >- Provides operations to manage the approvers property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get approvers from security description: >- Collection of users who can approve the request. Currently only supported for requests of type delete. operationId: security.subjectRightsRequests.approvers.GetByUserPrincipalName parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.user' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: userPrincipalName in: path description: Alternate key of user required: true schema: type: string nullable: true x-ms-docs-grouped-path: - >- /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers/{user-id} /security/subjectRightsRequests/{subjectRightsRequest-id}/approvers/$count: description: Provides operations to count the resources in the collection. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get the number of the resource operationId: security.subjectRightsRequests.approvers.GetCount-2c51 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators: description: >- Provides operations to manage the collaborators property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get collaborators from security description: Collection of users who can collaborate on the request. operationId: security.subjectRightsRequests.ListCollaborators parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: '#/components/responses/microsoft.graph.userCollectionResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators/{user-id}: description: >- Provides operations to manage the collaborators property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get collaborators from security description: Collection of users who can collaborate on the request. operationId: security.subjectRightsRequests.GetCollaborators parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.user' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user x-ms-docs-grouped-path: - >- /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators(userPrincipalName='{userPrincipalName}') /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators/{user-id}/mailboxSettings: get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get mailboxSettings property value description: >- Settings for the primary mailbox of the signed-in user. You can get or update settings for sending automatic replies to incoming messages, locale, and time zone. Returned only on $select. operationId: security.subjectRightsRequests.collaborators.GetMailboxSettings parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Entity result. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.mailboxSettings' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' patch: tags: - security.subjectRightsRequest summary: Microsoft Graph Update property mailboxSettings value. operationId: security.subjectRightsRequests.collaborators.UpdateMailboxSettings requestBody: description: New property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.mailboxSettings' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.mailboxSettings' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators/{user-id}/serviceProvisioningErrors: get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get serviceProvisioningErrors property value description: >- Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a user object. Supports $filter (eq, not, for isResolved and serviceInstance). operationId: >- security.subjectRightsRequests.collaborators.ListServiceProvisioningErrors parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.serviceProvisioningErrorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators/{user-id}/serviceProvisioningErrors/$count: description: Provides operations to count the resources in the collection. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get the number of the resource operationId: >- security.subjectRightsRequests.collaborators.ServiceProvisioningErrors.GetCount-9d67 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: user-id in: path description: The unique identifier of user required: true schema: type: string x-ms-docs-key-type: user /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators(userPrincipalName='{userPrincipalName}'): description: >- Provides operations to manage the collaborators property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get collaborators from security description: Collection of users who can collaborate on the request. operationId: security.subjectRightsRequests.collaborators.GetByUserPrincipalName parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.user' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: userPrincipalName in: path description: Alternate key of user required: true schema: type: string nullable: true x-ms-docs-grouped-path: - >- /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators/{user-id} /security/subjectRightsRequests/{subjectRightsRequest-id}/collaborators/$count: description: Provides operations to count the resources in the collection. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get the number of the resource operationId: security.subjectRightsRequests.collaborators.GetCount-11c6 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/getFinalAttachment(): description: Provides operations to call the getFinalAttachment method. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Invoke function getFinalAttachment description: >- Get the final attachment for a subject rights request. The attachment is a zip file that contains all the files that were included by the privacy administrator. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/subjectrightsrequest-getfinalattachment?view=graph-rest-1.0 operationId: security.subjectRightsRequests.subjectRightsRequest.getFinalAttachment responses: 2XX: description: Success content: application/octet-stream: schema: type: object properties: value: type: string format: base64url nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/getFinalReport(): description: Provides operations to call the getFinalReport method. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Invoke function getFinalReport description: >- Get the final report for a subject rights request. The report is a text file that contains information about the files that were included by the privacy administrator. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/subjectrightsrequest-getfinalreport?view=graph-rest-1.0 operationId: security.subjectRightsRequests.subjectRightsRequest.getFinalReport responses: 2XX: description: Success content: application/octet-stream: schema: type: object properties: value: type: string format: base64url nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/notes: description: >- Provides operations to manage the notes property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get notes from security description: List of notes associated with the request. operationId: security.subjectRightsRequests.ListNotes parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.authoredNoteCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.subjectRightsRequest summary: Microsoft Graph Create new navigation property to notes for security operationId: security.subjectRightsRequests.CreateNotes requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.authoredNote' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.authoredNote' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/notes/{authoredNote-id}: description: >- Provides operations to manage the notes property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get notes from security description: List of notes associated with the request. operationId: security.subjectRightsRequests.GetNotes parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.authoredNote' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.subjectRightsRequest summary: Microsoft Graph Update the navigation property notes in security operationId: security.subjectRightsRequests.UpdateNotes requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.authoredNote' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.authoredNote' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.subjectRightsRequest summary: Microsoft Graph Delete navigation property notes for security operationId: security.subjectRightsRequests.DeleteNotes parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest - name: authoredNote-id in: path description: The unique identifier of authoredNote required: true schema: type: string x-ms-docs-key-type: authoredNote /security/subjectRightsRequests/{subjectRightsRequest-id}/notes/$count: description: Provides operations to count the resources in the collection. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get the number of the resource operationId: security.subjectRightsRequests.notes.GetCount-d132 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/{subjectRightsRequest-id}/team: description: >- Provides operations to manage the team property of the microsoft.graph.subjectRightsRequest entity. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get team from security description: >- Information about the Microsoft Teams team that was created for the request. operationId: security.subjectRightsRequests.GetTeam parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.team' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subjectRightsRequest-id in: path description: The unique identifier of subjectRightsRequest required: true schema: type: string x-ms-docs-key-type: subjectRightsRequest /security/subjectRightsRequests/$count: description: Provides operations to count the resources in the collection. get: tags: - security.subjectRightsRequest summary: Microsoft Graph Get the number of the resource operationId: security.subjectRightsRequests.GetCount-8072 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence: description: >- Provides operations to manage the threatIntelligence property of the microsoft.graph.security entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get threatIntelligence from security operationId: security.GetThreatIntelligence parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.threatIntelligence 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property threatIntelligence in security operationId: security.UpdateThreatIntelligence requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.threatIntelligence' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.threatIntelligence 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property threatIntelligence for security operationId: security.DeleteThreatIntelligence parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/articleIndicators: description: >- Provides operations to manage the articleIndicators property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get articleIndicator description: Read the properties and relationships of an articleIndicator object. operationId: security.threatIntelligence.ListArticleIndicators parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.articleIndicatorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to articleIndicators for security operationId: security.threatIntelligence.CreateArticleIndicators requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/articleIndicators/{articleIndicator-id}: description: >- Provides operations to manage the articleIndicators property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get articleIndicator description: Read the properties and relationships of an articleIndicator object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-articleindicator-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetArticleIndicators parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property articleIndicators in security operationId: security.threatIntelligence.UpdateArticleIndicators requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property articleIndicators for security operationId: security.threatIntelligence.DeleteArticleIndicators parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: articleIndicator-id in: path description: The unique identifier of articleIndicator required: true schema: type: string x-ms-docs-key-type: articleIndicator /security/threatIntelligence/articleIndicators/{articleIndicator-id}/artifact: description: >- Provides operations to manage the artifact property of the microsoft.graph.security.indicator entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get artifact from security description: The artifact related to this indicator. operationId: security.threatIntelligence.articleIndicators.GetArtifact parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.artifact' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: articleIndicator-id in: path description: The unique identifier of articleIndicator required: true schema: type: string x-ms-docs-key-type: articleIndicator x-ms-docs-grouped-path: - >- /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicator-id}/artifact /security/threatIntelligence/articleIndicators/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.articleIndicators.GetCount-c9c7 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/articles: description: >- Provides operations to manage the articles property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List articles description: >- Get a list of article objects, including their properties and relationships. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-threatintelligence-list-articles?view=graph-rest-1.0 operationId: security.threatIntelligence.ListArticles parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.articleCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to articles for security operationId: security.threatIntelligence.CreateArticles requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.article' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.article' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/articles/{article-id}: description: >- Provides operations to manage the articles property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get article description: Read the properties and relationships of an article object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-article-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetArticles parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.article' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property articles in security operationId: security.threatIntelligence.UpdateArticles requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.article' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.article' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property articles for security operationId: security.threatIntelligence.DeleteArticles parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: article-id in: path description: The unique identifier of article required: true schema: type: string x-ms-docs-key-type: article /security/threatIntelligence/articles/{article-id}/indicators: description: >- Provides operations to manage the indicators property of the microsoft.graph.security.article entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List indicators description: >- Get a list of articleIndicator objects that represent indicators of threat or compromise related to the contents of an article. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-article-list-indicators?view=graph-rest-1.0 operationId: security.threatIntelligence.articles.ListIndicators parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.articleIndicatorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: article-id in: path description: The unique identifier of article required: true schema: type: string x-ms-docs-key-type: article /security/threatIntelligence/articles/{article-id}/indicators/{articleIndicator-id}: description: >- Provides operations to manage the indicators property of the microsoft.graph.security.article entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get indicators from security description: Indicators related to this article. operationId: security.threatIntelligence.articles.GetIndicators parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: article-id in: path description: The unique identifier of article required: true schema: type: string x-ms-docs-key-type: article - name: articleIndicator-id in: path description: The unique identifier of articleIndicator required: true schema: type: string x-ms-docs-key-type: articleIndicator /security/threatIntelligence/articles/{article-id}/indicators/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.articles.indicators.GetCount-1d6c parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: article-id in: path description: The unique identifier of article required: true schema: type: string x-ms-docs-key-type: article /security/threatIntelligence/articles/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.articles.GetCount-3702 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/hostComponents: description: >- Provides operations to manage the hostComponents property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostComponent description: Read the properties and relationships of a hostComponent object. operationId: security.threatIntelligence.ListHostComponents parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostComponentCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to hostComponents for security operationId: security.threatIntelligence.CreateHostComponents requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/hostComponents/{hostComponent-id}: description: >- Provides operations to manage the hostComponents property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostComponent description: Read the properties and relationships of a hostComponent object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-hostcomponent-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetHostComponents parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property hostComponents in security operationId: security.threatIntelligence.UpdateHostComponents requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property hostComponents for security operationId: security.threatIntelligence.DeleteHostComponents parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostComponent-id in: path description: The unique identifier of hostComponent required: true schema: type: string x-ms-docs-key-type: hostComponent /security/threatIntelligence/hostComponents/{hostComponent-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.hostComponent entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: >- The host related to this component. This is a reverse navigation property. When navigating to components from a host, this should be assumed to be a return reference. operationId: security.threatIntelligence.hostComponents.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostComponent-id in: path description: The unique identifier of hostComponent required: true schema: type: string x-ms-docs-key-type: hostComponent /security/threatIntelligence/hostComponents/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hostComponents.GetCount-3ca4 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/hostCookies: description: >- Provides operations to manage the hostCookies property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostCookie description: Read the properties and relationships of a hostCookie object. operationId: security.threatIntelligence.ListHostCookies parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostCookieCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to hostCookies for security operationId: security.threatIntelligence.CreateHostCookies requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/hostCookies/{hostCookie-id}: description: >- Provides operations to manage the hostCookies property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostCookie description: Read the properties and relationships of a hostCookie object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-hostcookie-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetHostCookies parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property hostCookies in security operationId: security.threatIntelligence.UpdateHostCookies requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property hostCookies for security operationId: security.threatIntelligence.DeleteHostCookies parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostCookie-id in: path description: The unique identifier of hostCookie required: true schema: type: string x-ms-docs-key-type: hostCookie /security/threatIntelligence/hostCookies/{hostCookie-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.hostCookie entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: >- Indicates that a cookie of this name and domain was found related to this host. operationId: security.threatIntelligence.hostCookies.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostCookie-id in: path description: The unique identifier of hostCookie required: true schema: type: string x-ms-docs-key-type: hostCookie /security/threatIntelligence/hostCookies/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hostCookies.GetCount-ca74 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/hostPairs: description: >- Provides operations to manage the hostPairs property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostPair description: Read the properties and relationships of a hostPair object. operationId: security.threatIntelligence.ListHostPairs parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostPairCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to hostPairs for security operationId: security.threatIntelligence.CreateHostPairs requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/hostPairs/{hostPair-id}: description: >- Provides operations to manage the hostPairs property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostPair description: Read the properties and relationships of a hostPair object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-hostpair-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetHostPairs parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property hostPairs in security operationId: security.threatIntelligence.UpdateHostPairs requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property hostPairs for security operationId: security.threatIntelligence.DeleteHostPairs parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostPair-id in: path description: The unique identifier of hostPair required: true schema: type: string x-ms-docs-key-type: hostPair /security/threatIntelligence/hostPairs/{hostPair-id}/childHost: description: >- Provides operations to manage the childHost property of the microsoft.graph.security.hostPair entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get childHost from security description: Host reached via the parentHost. operationId: security.threatIntelligence.hostPairs.GetChildHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostPair-id in: path description: The unique identifier of hostPair required: true schema: type: string x-ms-docs-key-type: hostPair /security/threatIntelligence/hostPairs/{hostPair-id}/parentHost: description: >- Provides operations to manage the parentHost property of the microsoft.graph.security.hostPair entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get parentHost from security description: Host used to reach the childHost. operationId: security.threatIntelligence.hostPairs.GetParentHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostPair-id in: path description: The unique identifier of hostPair required: true schema: type: string x-ms-docs-key-type: hostPair /security/threatIntelligence/hostPairs/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hostPairs.GetCount-6e30 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/hostPorts: description: >- Provides operations to manage the hostPorts property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostPort description: Read the properties and relationships of a hostPort object. operationId: security.threatIntelligence.ListHostPorts parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostPortCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to hostPorts for security operationId: security.threatIntelligence.CreateHostPorts requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPort' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPort' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/hostPorts/{hostPort-id}: description: >- Provides operations to manage the hostPorts property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostPort description: Read the properties and relationships of a hostPort object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-hostport-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetHostPorts parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPort' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property hostPorts in security operationId: security.threatIntelligence.UpdateHostPorts requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPort' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPort' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property hostPorts for security operationId: security.threatIntelligence.DeleteHostPorts parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostPort-id in: path description: The unique identifier of hostPort required: true schema: type: string x-ms-docs-key-type: hostPort /security/threatIntelligence/hostPorts/{hostPort-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.hostPort entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: >- The host related to this hostPort. This is a reverse navigation property. When you navigate to hostPorts from a host, assume that this is a return reference. operationId: security.threatIntelligence.hostPorts.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostPort-id in: path description: The unique identifier of hostPort required: true schema: type: string x-ms-docs-key-type: hostPort /security/threatIntelligence/hostPorts/{hostPort-id}/mostRecentSslCertificate: description: >- Provides operations to manage the mostRecentSslCertificate property of the microsoft.graph.security.hostPort entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get mostRecentSslCertificate from security description: The most recent sslCertificate used to communicate on the port. operationId: security.threatIntelligence.hostPorts.GetMostRecentSslCertificate parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostPort-id in: path description: The unique identifier of hostPort required: true schema: type: string x-ms-docs-key-type: hostPort /security/threatIntelligence/hostPorts/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hostPorts.GetCount-5189 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/hosts: description: >- Provides operations to manage the hosts property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host description: >- Read the properties and relationships of a host object. The host resource is the abstract base type that returns an implementation. A host can be of one of the following types: operationId: security.threatIntelligence.ListHosts parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to hosts for security operationId: security.threatIntelligence.CreateHosts requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/hosts/{host-id}: description: >- Provides operations to manage the hosts property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host description: >- Read the properties and relationships of a host object. The host resource is the abstract base type that returns an implementation. A host can be of one of the following types: externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetHosts parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property hosts in security operationId: security.threatIntelligence.UpdateHosts requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property hosts for security operationId: security.threatIntelligence.DeleteHosts parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/childHostPairs: description: >- Provides operations to manage the childHostPairs property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List childHostPairs description: >- Get the list of hostPair resources associated with a host, where that host is the *parent* and has an outgoing pairing to a *child*. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-childhostpairs?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListChildHostPairs parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostPairCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/childHostPairs/{hostPair-id}: description: >- Provides operations to manage the childHostPairs property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get childHostPairs from security description: >- The hostPairs that are resources associated with a host, where that host is the parentHost and has an outgoing pairing to a childHost. operationId: security.threatIntelligence.hosts.GetChildHostPairs parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostPair-id in: path description: The unique identifier of hostPair required: true schema: type: string x-ms-docs-key-type: hostPair /security/threatIntelligence/hosts/{host-id}/childHostPairs/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.childHostPairs.GetCount-d960 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/components: description: >- Provides operations to manage the components property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List components description: Get a list of hostComponent resources. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-components?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListComponents parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostComponentCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/components/{hostComponent-id}: description: >- Provides operations to manage the components property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get components from security description: The hostComponents that are associated with this host. operationId: security.threatIntelligence.hosts.GetComponents parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostComponent-id in: path description: The unique identifier of hostComponent required: true schema: type: string x-ms-docs-key-type: hostComponent /security/threatIntelligence/hosts/{host-id}/components/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.components.GetCount-3f6d parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/cookies: description: >- Provides operations to manage the cookies property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List cookies description: Get a list of hostCookie resources. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-cookies?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListCookies parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostCookieCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/cookies/{hostCookie-id}: description: >- Provides operations to manage the cookies property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get cookies from security description: The hostCookies that are associated with this host. operationId: security.threatIntelligence.hosts.GetCookies parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostCookie-id in: path description: The unique identifier of hostCookie required: true schema: type: string x-ms-docs-key-type: hostCookie /security/threatIntelligence/hosts/{host-id}/cookies/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.cookies.GetCount-d607 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/hostPairs: description: >- Provides operations to manage the hostPairs property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List hostPairs description: >- Get the list of hostPair resources associated with a host, where that host is *either* the *parent* or the *child*. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-hostpairs?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListHostPairs parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostPairCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/hostPairs/{hostPair-id}: description: >- Provides operations to manage the hostPairs property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostPairs from security description: >- The hostPairs that are associated with this host, where this host is either the parentHost or childHost. operationId: security.threatIntelligence.hosts.GetHostPairs parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostPair-id in: path description: The unique identifier of hostPair required: true schema: type: string x-ms-docs-key-type: hostPair /security/threatIntelligence/hosts/{host-id}/hostPairs/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.hostPairs.GetCount-e637 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/parentHostPairs: description: >- Provides operations to manage the parentHostPairs property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List parentHostPairs description: >- Get the list of hostPair resources associated with a host, where that host is the *child* and has an incoming pairing with a *parent*. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-parenthostpairs?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListParentHostPairs parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostPairCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/parentHostPairs/{hostPair-id}: description: >- Provides operations to manage the parentHostPairs property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get parentHostPairs from security description: >- The hostPairs that are associated with a host, where that host is the childHost and has an incoming pairing with a parentHost. operationId: security.threatIntelligence.hosts.GetParentHostPairs parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPair' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostPair-id in: path description: The unique identifier of hostPair required: true schema: type: string x-ms-docs-key-type: hostPair /security/threatIntelligence/hosts/{host-id}/parentHostPairs/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.parentHostPairs.GetCount-51b4 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/passiveDns: description: >- Provides operations to manage the passiveDns property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List passiveDns description: >- Get a list of passiveDnsRecord resources associated with a host. This method is a forward DNS lookup that queries the IP address of the specified host using its hostname. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-passivedns?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListPassiveDns parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.passiveDnsRecordCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/passiveDns/{passiveDnsRecord-id}: description: >- Provides operations to manage the passiveDns property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get passiveDns from security description: Passive DNS retrieval about this host. operationId: security.threatIntelligence.hosts.GetPassiveDns parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: passiveDnsRecord-id in: path description: The unique identifier of passiveDnsRecord required: true schema: type: string x-ms-docs-key-type: passiveDnsRecord /security/threatIntelligence/hosts/{host-id}/passiveDns/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.passiveDns.GetCount-7c2c parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/passiveDnsReverse: description: >- Provides operations to manage the passiveDnsReverse property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List passiveDnsReverse description: >- Get a collection of passiveDnsRecord resources from a reverse passive DNS retrieval. A reverse DNS lookup queries the hostname of a host using an IP address. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-passivednsreverse?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListPassiveDnsReverse parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.passiveDnsRecordCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/passiveDnsReverse/{passiveDnsRecord-id}: description: >- Provides operations to manage the passiveDnsReverse property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get passiveDnsReverse from security description: Reverse passive DNS retrieval about this host. operationId: security.threatIntelligence.hosts.GetPassiveDnsReverse parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: passiveDnsRecord-id in: path description: The unique identifier of passiveDnsRecord required: true schema: type: string x-ms-docs-key-type: passiveDnsRecord /security/threatIntelligence/hosts/{host-id}/passiveDnsReverse/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.passiveDnsReverse.GetCount-0421 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/ports: description: >- Provides operations to manage the ports property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List hostPorts description: Get the list of hostPort resources associated with a host. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-ports?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListPorts parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostPortCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/ports/{hostPort-id}: description: >- Provides operations to manage the ports property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get ports from security description: The hostPorts associated with a host. operationId: security.threatIntelligence.hosts.GetPorts parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostPort' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostPort-id in: path description: The unique identifier of hostPort required: true schema: type: string x-ms-docs-key-type: hostPort /security/threatIntelligence/hosts/{host-id}/ports/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.ports.GetCount-af86 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/reputation: description: >- Provides operations to manage the reputation property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostReputation description: Get the properties and relationships of a hostReputation object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-get-reputation?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.GetReputation parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostReputation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property reputation in security operationId: security.threatIntelligence.hosts.UpdateReputation requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostReputation' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostReputation' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property reputation for security operationId: security.threatIntelligence.hosts.DeleteReputation parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/sslCertificates: description: >- Provides operations to manage the sslCertificates property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List hostSslCertificates description: >- Get a list of hostSslCertificate objects from the host navigation property. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-sslcertificates?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListSslCertificates parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostSslCertificateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/sslCertificates/{hostSslCertificate-id}: description: >- Provides operations to manage the sslCertificates property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get sslCertificates from security description: The hostSslCertificates that are associated with this host. operationId: security.threatIntelligence.hosts.GetSslCertificates parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.hostSslCertificate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostSslCertificate-id in: path description: The unique identifier of hostSslCertificate required: true schema: type: string x-ms-docs-key-type: hostSslCertificate /security/threatIntelligence/hosts/{host-id}/sslCertificates/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.sslCertificates.GetCount-eba7 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/subdomains: description: >- Provides operations to manage the subdomains property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List subdomains description: Get the list of subdomain resources associated with a host. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-subdomains?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListSubdomains parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.subdomainCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/subdomains/{subdomain-id}: description: >- Provides operations to manage the subdomains property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get subdomains from security description: The subdomains that are associated with this host. operationId: security.threatIntelligence.hosts.GetSubdomains parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.subdomain' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: subdomain-id in: path description: The unique identifier of subdomain required: true schema: type: string x-ms-docs-key-type: subdomain /security/threatIntelligence/hosts/{host-id}/subdomains/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.subdomains.GetCount-67a8 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/trackers: description: >- Provides operations to manage the trackers property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List trackers description: Get a list of hostTracker resources. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-host-list-trackers?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.ListTrackers parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostTrackerCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/trackers/{hostTracker-id}: description: >- Provides operations to manage the trackers property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get trackers from security description: The hostTrackers that are associated with this host. operationId: security.threatIntelligence.hosts.GetTrackers parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host - name: hostTracker-id in: path description: The unique identifier of hostTracker required: true schema: type: string x-ms-docs-key-type: hostTracker /security/threatIntelligence/hosts/{host-id}/trackers/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.trackers.GetCount-b20f parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/{host-id}/whois: description: >- Provides operations to manage the whois property of the microsoft.graph.security.host entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get whoisRecord description: "Get the specified whoisRecord resource. Specify the desired whoisRecord in one of the following two ways:\r\n- Identify a host and get its current whoisRecord. \r\n- Specify an id value to get the corresponding whoisRecord." externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-whoisrecord-get?view=graph-rest-1.0 operationId: security.threatIntelligence.hosts.GetWhois parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/hosts/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hosts.GetCount-5d36 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/hostSslCertificates: description: >- Provides operations to manage the hostSslCertificates property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostSslCertificate description: Get the properties and relationships of a hostSslCertificate object. operationId: security.threatIntelligence.ListHostSslCertificates parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostSslCertificateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to hostSslCertificates for security operationId: security.threatIntelligence.CreateHostSslCertificates requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostSslCertificate' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.hostSslCertificate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/hostSslCertificates/{hostSslCertificate-id}: description: >- Provides operations to manage the hostSslCertificates property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostSslCertificate description: Get the properties and relationships of a hostSslCertificate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-hostsslcertificate-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetHostSslCertificates parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.hostSslCertificate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property hostSslCertificates in security operationId: security.threatIntelligence.UpdateHostSslCertificates requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostSslCertificate' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.hostSslCertificate 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property hostSslCertificates for security operationId: security.threatIntelligence.DeleteHostSslCertificates parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostSslCertificate-id in: path description: The unique identifier of hostSslCertificate required: true schema: type: string x-ms-docs-key-type: hostSslCertificate /security/threatIntelligence/hostSslCertificates/{hostSslCertificate-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.hostSslCertificate entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: The host for this hostSslCertificate. operationId: security.threatIntelligence.hostSslCertificates.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostSslCertificate-id in: path description: The unique identifier of hostSslCertificate required: true schema: type: string x-ms-docs-key-type: hostSslCertificate /security/threatIntelligence/hostSslCertificates/{hostSslCertificate-id}/sslCertificate: description: >- Provides operations to manage the sslCertificate property of the microsoft.graph.security.hostSslCertificate entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get sslCertificate from security description: The sslCertificate for this hostSslCertificate. operationId: security.threatIntelligence.hostSslCertificates.GetSslCertificate parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostSslCertificate-id in: path description: The unique identifier of hostSslCertificate required: true schema: type: string x-ms-docs-key-type: hostSslCertificate /security/threatIntelligence/hostSslCertificates/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hostSslCertificates.GetCount-a40b parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/hostTrackers: description: >- Provides operations to manage the hostTrackers property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostTracker description: Read the properties and relationships of a hostTracker object. operationId: security.threatIntelligence.ListHostTrackers parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostTrackerCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to hostTrackers for security operationId: security.threatIntelligence.CreateHostTrackers requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/hostTrackers/{hostTracker-id}: description: >- Provides operations to manage the hostTrackers property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get hostTracker description: Read the properties and relationships of a hostTracker object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-hosttracker-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetHostTrackers parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property hostTrackers in security operationId: security.threatIntelligence.UpdateHostTrackers requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property hostTrackers for security operationId: security.threatIntelligence.DeleteHostTrackers parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostTracker-id in: path description: The unique identifier of hostTracker required: true schema: type: string x-ms-docs-key-type: hostTracker /security/threatIntelligence/hostTrackers/{hostTracker-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.hostTracker entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: >- The host related to this hostTracker. When navigating to a hostTracker from a host, this should be assumed to be a return reference. operationId: security.threatIntelligence.hostTrackers.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: hostTracker-id in: path description: The unique identifier of hostTracker required: true schema: type: string x-ms-docs-key-type: hostTracker /security/threatIntelligence/hostTrackers/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.hostTrackers.GetCount-1b5a parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/intelligenceProfileIndicators: description: >- Provides operations to manage the intelligenceProfileIndicators property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get intelligenceProfileIndicator description: >- Read the properties and relationships of a intelligenceProfileIndicator object. operationId: security.threatIntelligence.ListIntelligenceProfileIndicators parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.intelligenceProfileIndicatorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: >- Microsoft Graph Create new navigation property to intelligenceProfileIndicators for security operationId: security.threatIntelligence.CreateIntelligenceProfileIndicators requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfileIndicator required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfileIndicator 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicator-id}: description: >- Provides operations to manage the intelligenceProfileIndicators property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get intelligenceProfileIndicator description: >- Read the properties and relationships of a intelligenceProfileIndicator object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-intelligenceprofileindicator-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetIntelligenceProfileIndicators parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfileIndicator 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property intelligenceProfileIndicators in security operationId: security.threatIntelligence.UpdateIntelligenceProfileIndicators requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfileIndicator required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfileIndicator 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property intelligenceProfileIndicators for security operationId: security.threatIntelligence.DeleteIntelligenceProfileIndicators parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: intelligenceProfileIndicator-id in: path description: The unique identifier of intelligenceProfileIndicator required: true schema: type: string x-ms-docs-key-type: intelligenceProfileIndicator /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicator-id}/artifact: description: >- Provides operations to manage the artifact property of the microsoft.graph.security.indicator entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get artifact from security description: The artifact related to this indicator. operationId: security.threatIntelligence.intelligenceProfileIndicators.GetArtifact parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.artifact' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: intelligenceProfileIndicator-id in: path description: The unique identifier of intelligenceProfileIndicator required: true schema: type: string x-ms-docs-key-type: intelligenceProfileIndicator x-ms-docs-grouped-path: - >- /security/threatIntelligence/articleIndicators/{articleIndicator-id}/artifact /security/threatIntelligence/intelligenceProfileIndicators/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.intelligenceProfileIndicators.GetCount-9a16 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/intelProfiles: description: >- Provides operations to manage the intelProfiles property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List intelProfiles description: Get a list of the intelligenceProfile objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-threatintelligence-list-intelprofiles?view=graph-rest-1.0 operationId: security.threatIntelligence.ListIntelProfiles parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.intelligenceProfileCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to intelProfiles for security operationId: security.threatIntelligence.CreateIntelProfiles requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfile required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfile 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/intelProfiles/{intelligenceProfile-id}: description: >- Provides operations to manage the intelProfiles property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get intelligenceProfile description: Read the properties and relationships of a intelligenceProfile object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-intelligenceprofile-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetIntelProfiles parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfile 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property intelProfiles in security operationId: security.threatIntelligence.UpdateIntelProfiles requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfile required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfile 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property intelProfiles for security operationId: security.threatIntelligence.DeleteIntelProfiles parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: intelligenceProfile-id in: path description: The unique identifier of intelligenceProfile required: true schema: type: string x-ms-docs-key-type: intelligenceProfile /security/threatIntelligence/intelProfiles/{intelligenceProfile-id}/indicators: description: >- Provides operations to manage the indicators property of the microsoft.graph.security.intelligenceProfile entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List indicators description: >- Get the intelligenceProfileIndicator resources from the indicators navigation property of an intelligenceProfile. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-intelligenceprofile-list-indicators?view=graph-rest-1.0 operationId: security.threatIntelligence.intelProfiles.ListIndicators parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.intelligenceProfileIndicatorCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: intelligenceProfile-id in: path description: The unique identifier of intelligenceProfile required: true schema: type: string x-ms-docs-key-type: intelligenceProfile /security/threatIntelligence/intelProfiles/{intelligenceProfile-id}/indicators/{intelligenceProfileIndicator-id}: description: >- Provides operations to manage the indicators property of the microsoft.graph.security.intelligenceProfile entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get indicators from security description: >- Includes an assemblage of high-fidelity network indicators of compromise. operationId: security.threatIntelligence.intelProfiles.GetIndicators parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfileIndicator 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: intelligenceProfile-id in: path description: The unique identifier of intelligenceProfile required: true schema: type: string x-ms-docs-key-type: intelligenceProfile - name: intelligenceProfileIndicator-id in: path description: The unique identifier of intelligenceProfileIndicator required: true schema: type: string x-ms-docs-key-type: intelligenceProfileIndicator /security/threatIntelligence/intelProfiles/{intelligenceProfile-id}/indicators/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.intelProfiles.indicators.GetCount-a1bc parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: intelligenceProfile-id in: path description: The unique identifier of intelligenceProfile required: true schema: type: string x-ms-docs-key-type: intelligenceProfile /security/threatIntelligence/intelProfiles/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.intelProfiles.GetCount-4b06 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/passiveDnsRecords: description: >- Provides operations to manage the passiveDnsRecords property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get passiveDnsRecord description: Read the properties and relationships of a passiveDnsRecord object. operationId: security.threatIntelligence.ListPassiveDnsRecords parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.passiveDnsRecordCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to passiveDnsRecords for security operationId: security.threatIntelligence.CreatePassiveDnsRecords requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecord-id}: description: >- Provides operations to manage the passiveDnsRecords property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get passiveDnsRecord description: Read the properties and relationships of a passiveDnsRecord object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-passivednsrecord-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetPassiveDnsRecords parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property passiveDnsRecords in security operationId: security.threatIntelligence.UpdatePassiveDnsRecords requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property passiveDnsRecords for security operationId: security.threatIntelligence.DeletePassiveDnsRecords parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: passiveDnsRecord-id in: path description: The unique identifier of passiveDnsRecord required: true schema: type: string x-ms-docs-key-type: passiveDnsRecord /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecord-id}/artifact: description: >- Provides operations to manage the artifact property of the microsoft.graph.security.passiveDnsRecord entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get artifact from security description: The artifact related to this passiveDnsRecord entry. operationId: security.threatIntelligence.passiveDnsRecords.GetArtifact parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.artifact' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: passiveDnsRecord-id in: path description: The unique identifier of passiveDnsRecord required: true schema: type: string x-ms-docs-key-type: passiveDnsRecord /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecord-id}/parentHost: description: >- Provides operations to manage the parentHost property of the microsoft.graph.security.passiveDnsRecord entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get parentHost from security description: >- The parent host related to this passiveDnsRecord entry. Generally, this is the value that you can search to discover this passiveDnsRecord value. operationId: security.threatIntelligence.passiveDnsRecords.GetParentHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: passiveDnsRecord-id in: path description: The unique identifier of passiveDnsRecord required: true schema: type: string x-ms-docs-key-type: passiveDnsRecord /security/threatIntelligence/passiveDnsRecords/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.passiveDnsRecords.GetCount-a5be parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/sslCertificates: description: >- Provides operations to manage the sslCertificates property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List sslCertificates description: Get a list of sslCertificate objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-threatintelligence-list-sslcertificates?view=graph-rest-1.0 operationId: security.threatIntelligence.ListSslCertificates parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.sslCertificateCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to sslCertificates for security operationId: security.threatIntelligence.CreateSslCertificates requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/sslCertificates/{sslCertificate-id}: description: >- Provides operations to manage the sslCertificates property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get sslCertificate description: Get the properties and relationships of an sslCertificate object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-sslcertificate-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetSslCertificates parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property sslCertificates in security operationId: security.threatIntelligence.UpdateSslCertificates requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property sslCertificates for security operationId: security.threatIntelligence.DeleteSslCertificates parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sslCertificate-id in: path description: The unique identifier of sslCertificate required: true schema: type: string x-ms-docs-key-type: sslCertificate /security/threatIntelligence/sslCertificates/{sslCertificate-id}/relatedHosts: description: >- Provides operations to manage the relatedHosts property of the microsoft.graph.security.sslCertificate entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List relatedHosts description: Get a list of related host resources associated with an sslCertificate. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-sslcertificate-list-relatedhosts?view=graph-rest-1.0 operationId: security.threatIntelligence.sslCertificates.ListRelatedHosts parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.hostCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: sslCertificate-id in: path description: The unique identifier of sslCertificate required: true schema: type: string x-ms-docs-key-type: sslCertificate /security/threatIntelligence/sslCertificates/{sslCertificate-id}/relatedHosts/{host-id}: description: >- Provides operations to manage the relatedHosts property of the microsoft.graph.security.sslCertificate entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get relatedHosts from security description: The host resources related with this sslCertificate. operationId: security.threatIntelligence.sslCertificates.GetRelatedHosts parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: sslCertificate-id in: path description: The unique identifier of sslCertificate required: true schema: type: string x-ms-docs-key-type: sslCertificate - name: host-id in: path description: The unique identifier of host required: true schema: type: string x-ms-docs-key-type: host /security/threatIntelligence/sslCertificates/{sslCertificate-id}/relatedHosts/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.sslCertificates.relatedHosts.GetCount-0b8e parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: sslCertificate-id in: path description: The unique identifier of sslCertificate required: true schema: type: string x-ms-docs-key-type: sslCertificate /security/threatIntelligence/sslCertificates/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.sslCertificates.GetCount-cfbd parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/subdomains: description: >- Provides operations to manage the subdomains property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get subdomain description: Read the properties and relationships of a subdomain object. operationId: security.threatIntelligence.ListSubdomains parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.subdomainCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to subdomains for security operationId: security.threatIntelligence.CreateSubdomains requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.subdomain' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.subdomain' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/subdomains/{subdomain-id}: description: >- Provides operations to manage the subdomains property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get subdomain description: Read the properties and relationships of a subdomain object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-subdomain-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetSubdomains parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.subdomain' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property subdomains in security operationId: security.threatIntelligence.UpdateSubdomains requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.subdomain' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.subdomain' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property subdomains for security operationId: security.threatIntelligence.DeleteSubdomains parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subdomain-id in: path description: The unique identifier of subdomain required: true schema: type: string x-ms-docs-key-type: subdomain /security/threatIntelligence/subdomains/{subdomain-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.subdomain entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: The host of the subdomain. operationId: security.threatIntelligence.subdomains.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: subdomain-id in: path description: The unique identifier of subdomain required: true schema: type: string x-ms-docs-key-type: subdomain /security/threatIntelligence/subdomains/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.subdomains.GetCount-34a3 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/vulnerabilities: description: >- Provides operations to manage the vulnerabilities property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get vulnerability description: Read the properties and relationships of a vulnerability object. operationId: security.threatIntelligence.ListVulnerabilities parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.vulnerabilityCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to vulnerabilities for security operationId: security.threatIntelligence.CreateVulnerabilities requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.vulnerability' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.vulnerability' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/vulnerabilities/{vulnerability-id}: description: >- Provides operations to manage the vulnerabilities property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get vulnerability description: Read the properties and relationships of a vulnerability object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-vulnerability-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetVulnerabilities parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.vulnerability' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property vulnerabilities in security operationId: security.threatIntelligence.UpdateVulnerabilities requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.vulnerability' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.vulnerability' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property vulnerabilities for security operationId: security.threatIntelligence.DeleteVulnerabilities parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: vulnerability-id in: path description: The unique identifier of vulnerability required: true schema: type: string x-ms-docs-key-type: vulnerability /security/threatIntelligence/vulnerabilities/{vulnerability-id}/articles: description: >- Provides operations to manage the articles property of the microsoft.graph.security.vulnerability entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get articles from security description: Articles related to this vulnerability. operationId: security.threatIntelligence.vulnerabilities.ListArticles parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.articleCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: vulnerability-id in: path description: The unique identifier of vulnerability required: true schema: type: string x-ms-docs-key-type: vulnerability /security/threatIntelligence/vulnerabilities/{vulnerability-id}/articles/{article-id}: description: >- Provides operations to manage the articles property of the microsoft.graph.security.vulnerability entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get articles from security description: Articles related to this vulnerability. operationId: security.threatIntelligence.vulnerabilities.GetArticles parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.article' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: vulnerability-id in: path description: The unique identifier of vulnerability required: true schema: type: string x-ms-docs-key-type: vulnerability - name: article-id in: path description: The unique identifier of article required: true schema: type: string x-ms-docs-key-type: article /security/threatIntelligence/vulnerabilities/{vulnerability-id}/articles/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.vulnerabilities.articles.GetCount-3551 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: vulnerability-id in: path description: The unique identifier of vulnerability required: true schema: type: string x-ms-docs-key-type: vulnerability /security/threatIntelligence/vulnerabilities/{vulnerability-id}/components: description: >- Provides operations to manage the components property of the microsoft.graph.security.vulnerability entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List components description: >- Get a list of vulnerabilityComponent objects related to a known vulnerability. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-vulnerability-list-components?view=graph-rest-1.0 operationId: security.threatIntelligence.vulnerabilities.ListComponents parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.vulnerabilityComponentCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to components for security operationId: security.threatIntelligence.vulnerabilities.CreateComponents requestBody: description: New navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.vulnerabilityComponent required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.vulnerabilityComponent 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: vulnerability-id in: path description: The unique identifier of vulnerability required: true schema: type: string x-ms-docs-key-type: vulnerability /security/threatIntelligence/vulnerabilities/{vulnerability-id}/components/{vulnerabilityComponent-id}: description: >- Provides operations to manage the components property of the microsoft.graph.security.vulnerability entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get vulnerabilityComponent description: >- Read the properties and relationships of a vulnerabilityComponent object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-vulnerabilitycomponent-get?view=graph-rest-1.0 operationId: security.threatIntelligence.vulnerabilities.GetComponents parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.vulnerabilityComponent 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property components in security operationId: security.threatIntelligence.vulnerabilities.UpdateComponents requestBody: description: New navigation property values content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.vulnerabilityComponent required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.vulnerabilityComponent 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property components for security operationId: security.threatIntelligence.vulnerabilities.DeleteComponents parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: vulnerability-id in: path description: The unique identifier of vulnerability required: true schema: type: string x-ms-docs-key-type: vulnerability - name: vulnerabilityComponent-id in: path description: The unique identifier of vulnerabilityComponent required: true schema: type: string x-ms-docs-key-type: vulnerabilityComponent /security/threatIntelligence/vulnerabilities/{vulnerability-id}/components/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.vulnerabilities.components.GetCount-d51b parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: vulnerability-id in: path description: The unique identifier of vulnerability required: true schema: type: string x-ms-docs-key-type: vulnerability /security/threatIntelligence/vulnerabilities/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.vulnerabilities.GetCount-d2da parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/whoisHistoryRecords: description: >- Provides operations to manage the whoisHistoryRecords property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get whoisHistoryRecords from security description: >- Retrieve details about whoisHistoryRecord objects.Note: List retrieval is not yet supported. operationId: security.threatIntelligence.ListWhoisHistoryRecords parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.whoisHistoryRecordCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to whoisHistoryRecords for security operationId: security.threatIntelligence.CreateWhoisHistoryRecords requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisHistoryRecord' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.whoisHistoryRecord 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/whoisHistoryRecords/{whoisHistoryRecord-id}: description: >- Provides operations to manage the whoisHistoryRecords property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get whoisHistoryRecords from security description: >- Retrieve details about whoisHistoryRecord objects.Note: List retrieval is not yet supported. operationId: security.threatIntelligence.GetWhoisHistoryRecords parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.whoisHistoryRecord 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property whoisHistoryRecords in security operationId: security.threatIntelligence.UpdateWhoisHistoryRecords requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisHistoryRecord' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.whoisHistoryRecord 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property whoisHistoryRecords for security operationId: security.threatIntelligence.DeleteWhoisHistoryRecords parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: whoisHistoryRecord-id in: path description: The unique identifier of whoisHistoryRecord required: true schema: type: string x-ms-docs-key-type: whoisHistoryRecord /security/threatIntelligence/whoisHistoryRecords/{whoisHistoryRecord-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.whoisBaseRecord entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: The host associated to this WHOIS object. operationId: security.threatIntelligence.whoisHistoryRecords.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: whoisHistoryRecord-id in: path description: The unique identifier of whoisHistoryRecord required: true schema: type: string x-ms-docs-key-type: whoisHistoryRecord x-ms-docs-grouped-path: - /security/threatIntelligence/whoisRecords/{whoisRecord-id}/host /security/threatIntelligence/whoisHistoryRecords/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.whoisHistoryRecords.GetCount-175e parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/threatIntelligence/whoisRecords: description: >- Provides operations to manage the whoisRecords property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph List whoisRecords description: Get a list of whoisRecord objects. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-threatintelligence-list-whoisrecords?view=graph-rest-1.0 operationId: security.threatIntelligence.ListWhoisRecords parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.whoisRecordCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.threatIntelligence summary: Microsoft Graph Create new navigation property to whoisRecords for security operationId: security.threatIntelligence.CreateWhoisRecords requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/threatIntelligence/whoisRecords/{whoisRecord-id}: description: >- Provides operations to manage the whoisRecords property of the microsoft.graph.security.threatIntelligence entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get whoisRecord description: "Get the specified whoisRecord resource. Specify the desired whoisRecord in one of the following two ways:\r\n- Identify a host and get its current whoisRecord. \r\n- Specify an id value to get the corresponding whoisRecord." externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-whoisrecord-get?view=graph-rest-1.0 operationId: security.threatIntelligence.GetWhoisRecords parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.threatIntelligence summary: Microsoft Graph Update the navigation property whoisRecords in security operationId: security.threatIntelligence.UpdateWhoisRecords requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.threatIntelligence summary: Microsoft Graph Delete navigation property whoisRecords for security operationId: security.threatIntelligence.DeleteWhoisRecords parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: whoisRecord-id in: path description: The unique identifier of whoisRecord required: true schema: type: string x-ms-docs-key-type: whoisRecord /security/threatIntelligence/whoisRecords/{whoisRecord-id}/history: description: >- Provides operations to manage the history property of the microsoft.graph.security.whoisRecord entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get history from security description: The collection of historical records associated to this WHOIS object. operationId: security.threatIntelligence.whoisRecords.ListHistory parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.whoisHistoryRecordCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation parameters: - name: whoisRecord-id in: path description: The unique identifier of whoisRecord required: true schema: type: string x-ms-docs-key-type: whoisRecord /security/threatIntelligence/whoisRecords/{whoisRecord-id}/history/{whoisHistoryRecord-id}: description: >- Provides operations to manage the history property of the microsoft.graph.security.whoisRecord entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get history from security description: The collection of historical records associated to this WHOIS object. operationId: security.threatIntelligence.whoisRecords.GetHistory parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.whoisHistoryRecord 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: whoisRecord-id in: path description: The unique identifier of whoisRecord required: true schema: type: string x-ms-docs-key-type: whoisRecord - name: whoisHistoryRecord-id in: path description: The unique identifier of whoisHistoryRecord required: true schema: type: string x-ms-docs-key-type: whoisHistoryRecord /security/threatIntelligence/whoisRecords/{whoisRecord-id}/history/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.whoisRecords.history.GetCount-86f0 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' parameters: - name: whoisRecord-id in: path description: The unique identifier of whoisRecord required: true schema: type: string x-ms-docs-key-type: whoisRecord /security/threatIntelligence/whoisRecords/{whoisRecord-id}/host: description: >- Provides operations to manage the host property of the microsoft.graph.security.whoisBaseRecord entity. get: tags: - security.threatIntelligence summary: Microsoft Graph Get host from security description: The host associated to this WHOIS object. operationId: security.threatIntelligence.whoisRecords.GetHost parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.host' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: whoisRecord-id in: path description: The unique identifier of whoisRecord required: true schema: type: string x-ms-docs-key-type: whoisRecord x-ms-docs-grouped-path: - >- /security/threatIntelligence/whoisHistoryRecords/{whoisHistoryRecord-id}/host /security/threatIntelligence/whoisRecords/$count: description: Provides operations to count the resources in the collection. get: tags: - security.threatIntelligence summary: Microsoft Graph Get the number of the resource operationId: security.threatIntelligence.whoisRecords.GetCount-21a1 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/triggers: description: >- Provides operations to manage the triggers property of the microsoft.graph.security entity. get: tags: - security.triggersRoot summary: Microsoft Graph Get triggers from security operationId: security.GetTriggers parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.triggersRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.triggersRoot summary: Microsoft Graph Update the navigation property triggers in security operationId: security.UpdateTriggers requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.triggersRoot' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.triggersRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.triggersRoot summary: Microsoft Graph Delete navigation property triggers for security operationId: security.DeleteTriggers parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/triggers/retentionEvents: description: >- Provides operations to manage the retentionEvents property of the microsoft.graph.security.triggersRoot entity. get: tags: - security.triggersRoot summary: Microsoft Graph List retentionEvents description: Get a list of the retentionEvent objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentionevent-list?view=graph-rest-1.0 operationId: security.triggers.ListRetentionEvents parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.retentionEventCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.triggersRoot summary: Microsoft Graph Create retentionEvent description: Create a new retentionEvent object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentionevent-post?view=graph-rest-1.0 operationId: security.triggers.CreateRetentionEvents requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionEvent' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionEvent' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/triggers/retentionEvents/{retentionEvent-id}: description: >- Provides operations to manage the retentionEvents property of the microsoft.graph.security.triggersRoot entity. get: tags: - security.triggersRoot summary: Microsoft Graph Get retentionEvent description: Read the properties and relationships of a retentionEvent object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentionevent-get?view=graph-rest-1.0 operationId: security.triggers.GetRetentionEvents parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionEvent' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.triggersRoot summary: Microsoft Graph Update the navigation property retentionEvents in security operationId: security.triggers.UpdateRetentionEvents requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionEvent' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionEvent' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.triggersRoot summary: Microsoft Graph Delete retentionEvent description: Delete a retentionEvent object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentionevent-delete?view=graph-rest-1.0 operationId: security.triggers.DeleteRetentionEvents parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionEvent-id in: path description: The unique identifier of retentionEvent required: true schema: type: string x-ms-docs-key-type: retentionEvent /security/triggers/retentionEvents/{retentionEvent-id}/retentionEventType: description: >- Provides operations to manage the retentionEventType property of the microsoft.graph.security.retentionEvent entity. get: tags: - security.triggersRoot summary: Microsoft Graph Get retentionEventType from security description: >- Specifies the event that will start the retention period for labels that use this event type when an event is created. operationId: security.triggers.retentionEvents.GetRetentionEventType parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionEvent-id in: path description: The unique identifier of retentionEvent required: true schema: type: string x-ms-docs-key-type: retentionEvent /security/triggers/retentionEvents/$count: description: Provides operations to count the resources in the collection. get: tags: - security.triggersRoot summary: Microsoft Graph Get the number of the resource operationId: security.triggers.retentionEvents.GetCount-84a4 parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' /security/triggerTypes: description: >- Provides operations to manage the triggerTypes property of the microsoft.graph.security entity. get: tags: - security.triggerTypesRoot summary: Microsoft Graph Get triggerTypes from security operationId: security.GetTriggerTypes parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.triggerTypesRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.triggerTypesRoot summary: Microsoft Graph Update the navigation property triggerTypes in security operationId: security.UpdateTriggerTypes requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.triggerTypesRoot' required: true responses: 2XX: description: Success content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.triggerTypesRoot' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.triggerTypesRoot summary: Microsoft Graph Delete navigation property triggerTypes for security operationId: security.DeleteTriggerTypes parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/triggerTypes/retentionEventTypes: description: >- Provides operations to manage the retentionEventTypes property of the microsoft.graph.security.triggerTypesRoot entity. get: tags: - security.triggerTypesRoot summary: Microsoft Graph List retentionEventTypes description: Get a list of the retentionEventType objects and their properties. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentioneventtype-list?view=graph-rest-1.0 operationId: security.triggerTypes.ListRetentionEventTypes parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: $ref: >- #/components/responses/microsoft.graph.security.retentionEventTypeCollectionResponse 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore x-ms-docs-operation-type: operation post: tags: - security.triggerTypesRoot summary: Microsoft Graph Create retentionEventType description: Create a new retentionEventType object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentioneventtype-post?view=graph-rest-1.0 operationId: security.triggerTypes.CreateRetentionEventTypes requestBody: description: New navigation property content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionEventType' required: true responses: 2XX: description: Created navigation property. content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation /security/triggerTypes/retentionEventTypes/{retentionEventType-id}: description: >- Provides operations to manage the retentionEventTypes property of the microsoft.graph.security.triggerTypesRoot entity. get: tags: - security.triggerTypesRoot summary: Microsoft Graph Get retentionEventType description: Read the properties and relationships of a retentionEventType object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentioneventtype-get?view=graph-rest-1.0 operationId: security.triggerTypes.GetRetentionEventTypes parameters: - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Retrieved navigation property content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation patch: tags: - security.triggerTypesRoot summary: Microsoft Graph Update the navigation property retentionEventTypes in security operationId: security.triggerTypes.UpdateRetentionEventTypes requestBody: description: New navigation property values content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.security.retentionEventType' required: true responses: 2XX: description: Success content: application/json: schema: $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation delete: tags: - security.triggerTypesRoot summary: Microsoft Graph Delete retentionEventType description: Delete a retentionEventType object. externalDocs: description: Find more info here url: >- https://learn.microsoft.com/graph/api/security-retentioneventtype-delete?view=graph-rest-1.0 operationId: security.triggerTypes.DeleteRetentionEventTypes parameters: - name: If-Match in: header description: ETag schema: type: string responses: '204': description: Success 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: operation parameters: - name: retentionEventType-id in: path description: The unique identifier of retentionEventType required: true schema: type: string x-ms-docs-key-type: retentionEventType /security/triggerTypes/retentionEventTypes/$count: description: Provides operations to count the resources in the collection. get: tags: - security.triggerTypesRoot summary: Microsoft Graph Get the number of the resource operationId: security.triggerTypes.retentionEventTypes.GetCount-e3fe parameters: - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' responses: 2XX: $ref: '#/components/responses/ODataCountResponse' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' components: schemas: microsoft.graph.securityReportsRoot: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: securityReportsRoot required: - '@odata.type' type: object properties: '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.securityReportsRoot' BaseCollectionPaginationCountResponse: title: Base collection pagination and count responses type: object properties: '@odata.count': type: integer format: int64 nullable: true '@odata.nextLink': type: string nullable: true microsoft.graph.security: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: security required: - '@odata.type' type: object properties: alerts: type: array items: $ref: '#/components/schemas/microsoft.graph.alert' x-ms-navigationProperty: true alerts_v2: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alert' description: A collection of alerts in Microsoft 365 Defender. x-ms-navigationProperty: true attackSimulation: anyOf: - $ref: '#/components/schemas/microsoft.graph.attackSimulationRoot' - type: object nullable: true x-ms-navigationProperty: true cases: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.casesRoot' - type: object nullable: true x-ms-navigationProperty: true dataSecurityAndGovernance: anyOf: - $ref: >- #/components/schemas/microsoft.graph.tenantDataSecurityAndGovernance - type: object nullable: true x-ms-navigationProperty: true identities: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.identityContainer - type: object nullable: true description: A container for security identities APIs. x-ms-navigationProperty: true incidents: type: array items: $ref: '#/components/schemas/microsoft.graph.security.incident' description: >- A collection of incidents in Microsoft 365 Defender, each of which is a set of correlated alerts and associated metadata that reflects the story of an attack. x-ms-navigationProperty: true labels: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.labelsRoot' - type: object nullable: true x-ms-navigationProperty: true secureScoreControlProfiles: type: array items: $ref: '#/components/schemas/microsoft.graph.secureScoreControlProfile' x-ms-navigationProperty: true secureScores: type: array items: $ref: '#/components/schemas/microsoft.graph.secureScore' x-ms-navigationProperty: true subjectRightsRequests: type: array items: $ref: '#/components/schemas/microsoft.graph.subjectRightsRequest' x-ms-navigationProperty: true threatIntelligence: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.threatIntelligence - type: object nullable: true x-ms-navigationProperty: true triggers: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.triggersRoot' - type: object nullable: true x-ms-navigationProperty: true triggerTypes: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.triggerTypesRoot - type: object nullable: true x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security' microsoft.graph.alert: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: alert required: - '@odata.type' type: object properties: activityGroupName: type: string description: >- Name or alias of the activity group (attacker) this alert is attributed to. nullable: true alertDetections: type: array items: $ref: '#/components/schemas/microsoft.graph.alertDetection' assignedTo: type: string description: >- Name of the analyst the alert is assigned to for triage, investigation, or remediation (supports update). nullable: true azureSubscriptionId: type: string description: >- Azure subscription ID, present if this alert is related to an Azure resource. nullable: true azureTenantId: type: string description: Microsoft Entra tenant ID. Required. category: type: string description: >- Category of the alert (for example, credentialTheft, ransomware). nullable: true closedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Time at which the alert was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z (supports update). format: date-time nullable: true cloudAppStates: type: array items: $ref: '#/components/schemas/microsoft.graph.cloudAppSecurityState' description: >- Security-related stateful information generated by the provider about the cloud application/s related to this alert. comments: type: array items: type: string nullable: true description: >- Customer-provided comments on alert (for customer alert management) (supports update). confidence: maximum: 2147483647 minimum: -2147483648 type: number description: Confidence of the detection logic (percentage between 1-100). format: int32 nullable: true createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Time at which the alert was created by the alert provider. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Required. format: date-time nullable: true description: type: string description: Alert description. nullable: true detectionIds: type: array items: type: string nullable: true description: >- Set of alerts related to this alert entity (each alert is pushed to the SIEM as a separate record). eventDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Time at which the event or events that served as the trigger to generate the alert occurred. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Required. format: date-time nullable: true feedback: anyOf: - $ref: '#/components/schemas/microsoft.graph.alertFeedback' - type: object nullable: true description: >- Analyst feedback on the alert. The possible values are: unknown, truePositive, falsePositive, benignPositive. Supports update. fileStates: type: array items: $ref: '#/components/schemas/microsoft.graph.fileSecurityState' description: >- Security-related stateful information generated by the provider about the file(s) related to this alert. historyStates: type: array items: $ref: '#/components/schemas/microsoft.graph.alertHistoryState' hostStates: type: array items: $ref: '#/components/schemas/microsoft.graph.hostSecurityState' description: >- Security-related stateful information generated by the provider about the host(s) related to this alert. incidentIds: type: array items: type: string nullable: true description: IDs of incidents related to current alert. investigationSecurityStates: type: array items: $ref: >- #/components/schemas/microsoft.graph.investigationSecurityState lastEventDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string format: date-time nullable: true lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Time at which the alert entity was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true malwareStates: type: array items: $ref: '#/components/schemas/microsoft.graph.malwareState' description: Threat Intelligence pertaining to malware related to this alert. messageSecurityStates: type: array items: $ref: '#/components/schemas/microsoft.graph.messageSecurityState' networkConnections: type: array items: $ref: '#/components/schemas/microsoft.graph.networkConnection' description: >- Security-related stateful information generated by the provider about the network connection(s) related to this alert. processes: type: array items: $ref: '#/components/schemas/microsoft.graph.process' description: >- Security-related stateful information generated by the provider about the process or processes related to this alert. recommendedActions: type: array items: type: string nullable: true description: >- Vendor/provider recommended action(s) to take as a result of the alert (for example, isolate machine, enforce2FA, reimage host). registryKeyStates: type: array items: $ref: '#/components/schemas/microsoft.graph.registryKeyState' description: >- Security-related stateful information generated by the provider about the registry keys related to this alert. securityResources: type: array items: $ref: '#/components/schemas/microsoft.graph.securityResource' description: >- Resources related to current alert. For example, for some alerts this can have the Azure Resource value. severity: $ref: '#/components/schemas/microsoft.graph.alertSeverity' sourceMaterials: type: array items: type: string nullable: true description: >- Hyperlinks (URIs) to the source material related to the alert, for example, provider's user interface for alerts or log search. status: $ref: '#/components/schemas/microsoft.graph.alertStatus' tags: type: array items: type: string nullable: true description: >- User-definable labels that can be applied to an alert and can serve as filter conditions (for example 'HVA', 'SAW') (supports update). title: type: string description: Alert title. Required. nullable: true triggers: type: array items: $ref: '#/components/schemas/microsoft.graph.alertTrigger' description: >- Security-related information about the specific properties that triggered the alert (properties appearing in the alert). Alerts might contain information about multiple users, hosts, files, ip addresses. This field indicates which properties triggered the alert generation. uriClickSecurityStates: type: array items: $ref: '#/components/schemas/microsoft.graph.uriClickSecurityState' userStates: type: array items: $ref: '#/components/schemas/microsoft.graph.userSecurityState' description: >- Security-related stateful information generated by the provider about the user accounts related to this alert. vendorInformation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.securityVendorInformation - type: object nullable: true description: >- Complex type containing details about the security product/service vendor, provider, and subprovider (for example, vendor=Microsoft; provider=Windows Defender ATP; subProvider=AppLocker). Required. vulnerabilityStates: type: array items: $ref: '#/components/schemas/microsoft.graph.vulnerabilityState' description: >- Threat intelligence pertaining to one or more vulnerabilities related to this alert. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.alert' microsoft.graph.security.alert: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: alert required: - '@odata.type' type: object properties: actorDisplayName: type: string description: >- The adversary or activity group that is associated with this alert. nullable: true additionalData: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.dictionary' - type: object nullable: true description: >- A collection of other alert properties, including user-defined properties. Any custom details defined in the alert, and any dynamic content in the alert details, are stored here. alertPolicyId: type: string description: >- The ID of the policy that generated the alert, and populated when there is a specific policy that generated the alert, whether configured by a customer or a built-in policy. nullable: true alertWebUrl: type: string description: URL for the Microsoft 365 Defender portal alert page. nullable: true assignedTo: type: string description: Owner of the alert, or null if no owner is assigned. nullable: true category: type: string description: >- The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework. nullable: true classification: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.alertClassification - type: object nullable: true description: >- Specifies whether the alert represents a true threat. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue. comments: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alertComment' description: >- Array of comments created by the Security Operations (SecOps) team during the alert management process. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when Microsoft 365 Defender created the alert. format: date-time nullable: true customDetails: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.dictionary' - type: object nullable: true description: User defined custom fields with string values. description: type: string description: String value describing each alert. nullable: true detectionSource: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.detectionSource - type: object nullable: true description: >- Detection technology or sensor that identified the notable component or activity. The possible values are: unknown, microsoftDefenderForEndpoint, antivirus, smartScreen, customTi, microsoftDefenderForOffice365, automatedInvestigation, microsoftThreatExperts, customDetection, microsoftDefenderForIdentity, cloudAppSecurity, microsoft365Defender, azureAdIdentityProtection, manual, microsoftDataLossPrevention, appGovernancePolicy, appGovernanceDetection, unknownFutureValue, microsoftDefenderForCloud, microsoftDefenderForIoT, microsoftDefenderForServers, microsoftDefenderForStorage, microsoftDefenderForDNS, microsoftDefenderForDatabases, microsoftDefenderForContainers, microsoftDefenderForNetwork, microsoftDefenderForAppService, microsoftDefenderForKeyVault, microsoftDefenderForResourceManager, microsoftDefenderForApiManagement, microsoftSentinel, nrtAlerts, scheduledAlerts, microsoftDefenderThreatIntelligenceAnalytics, builtInMl, microsoftThreatIntelligence, microsoftDefenderForAIServices, securityCopilot. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: microsoftDefenderForCloud, microsoftDefenderForIoT, microsoftDefenderForServers, microsoftDefenderForStorage, microsoftDefenderForDNS, microsoftDefenderForDatabases, microsoftDefenderForContainers, microsoftDefenderForNetwork, microsoftDefenderForAppService, microsoftDefenderForKeyVault, microsoftDefenderForResourceManager, microsoftDefenderForApiManagement, microsoftSentinel, nrtAlerts, scheduledAlerts, microsoftDefenderThreatIntelligenceAnalytics, builtInMl, microsoftThreatIntelligence, microsoftDefenderForAIServices, securityCopilot. detectorId: type: string description: The ID of the detector that triggered the alert. nullable: true determination: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.alertDetermination - type: object nullable: true description: >- Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue. evidence: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alertEvidence' description: Collection of evidence related to the alert. firstActivityDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The earliest activity associated with the alert. format: date-time nullable: true incidentId: type: string description: >- Unique identifier to represent the incident this alert resource is associated with. nullable: true incidentWebUrl: type: string description: URL for the incident page in the Microsoft 365 Defender portal. nullable: true investigationState: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.investigationState - type: object nullable: true description: >- Information on the current status of the investigation. The possible values are: unknown, terminated, successfullyRemediated, benign, failed, partiallyRemediated, running, pendingApproval, pendingResource, queued, innerFailure, preexistingAlert, unsupportedOs, unsupportedAlertType, suppressedAlert, partiallyInvestigated, terminatedByUser, terminatedBySystem, unknownFutureValue. lastActivityDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The oldest activity associated with the alert. format: date-time nullable: true lastUpdateDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when the alert was last updated at Microsoft 365 Defender. format: date-time nullable: true mitreTechniques: type: array items: type: string nullable: true description: >- The attack techniques, as aligned with the MITRE ATT&CK framework. productName: type: string description: The name of the product which published this alert. nullable: true providerAlertId: type: string description: >- The ID of the alert as it appears in the security provider product that generated the alert. nullable: true recommendedActions: type: string description: >- Recommended response and remediation actions to take in the event this alert was generated. nullable: true resolvedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when the alert was resolved. format: date-time nullable: true serviceSource: $ref: '#/components/schemas/microsoft.graph.security.serviceSource' severity: $ref: '#/components/schemas/microsoft.graph.security.alertSeverity' status: $ref: '#/components/schemas/microsoft.graph.security.alertStatus' systemTags: type: array items: type: string nullable: true description: The system tags associated with the alert. tenantId: type: string description: The Microsoft Entra tenant the alert was created in. nullable: true threatDisplayName: type: string description: The threat associated with this alert. nullable: true threatFamilyName: type: string description: Threat family associated with this alert. nullable: true title: type: string description: Brief identifying string value describing the alert. nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.alert' microsoft.graph.security.alertComment: title: alertComment required: - '@odata.type' type: object properties: comment: type: string description: The comment text. nullable: true createdByDisplayName: type: string description: The person or app name that submitted the comment. nullable: true createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The time when the comment was submitted. format: date-time '@odata.type': type: string microsoft.graph.attackSimulationRoot: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: attackSimulationRoot required: - '@odata.type' type: object properties: endUserNotifications: type: array items: $ref: '#/components/schemas/microsoft.graph.endUserNotification' description: >- Represents an end user's notification for an attack simulation training. x-ms-navigationProperty: true landingPages: type: array items: $ref: '#/components/schemas/microsoft.graph.landingPage' description: Represents an attack simulation training landing page. x-ms-navigationProperty: true loginPages: type: array items: $ref: '#/components/schemas/microsoft.graph.loginPage' description: Represents an attack simulation training login page. x-ms-navigationProperty: true operations: type: array items: $ref: '#/components/schemas/microsoft.graph.attackSimulationOperation' description: Represents an attack simulation training operation. x-ms-navigationProperty: true payloads: type: array items: $ref: '#/components/schemas/microsoft.graph.payload' description: >- Represents an attack simulation training campaign payload in a tenant. x-ms-navigationProperty: true simulationAutomations: type: array items: $ref: '#/components/schemas/microsoft.graph.simulationAutomation' description: Represents simulation automation created to run on a tenant. x-ms-navigationProperty: true simulations: type: array items: $ref: '#/components/schemas/microsoft.graph.simulation' description: Represents an attack simulation training campaign in a tenant. x-ms-navigationProperty: true trainings: type: array items: $ref: '#/components/schemas/microsoft.graph.training' description: Represents details about attack simulation trainings. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.attackSimulationRoot' microsoft.graph.endUserNotification: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: endUserNotification required: - '@odata.type' type: object properties: createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who created the notification. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the notification was created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true description: type: string description: Description of the notification as defined by the user. nullable: true displayName: type: string description: Name of the notification as defined by the user. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who last modified the notification. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the notification was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true notificationType: anyOf: - $ref: '#/components/schemas/microsoft.graph.endUserNotificationType' - type: object nullable: true description: >- Type of notification. The possible values are: unknown, positiveReinforcement, noTraining, trainingAssignment, trainingReminder, unknownFutureValue. source: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentSource' - type: object nullable: true description: >- The source of the content. The possible values are: unknown, global, tenant, unknownFutureValue. status: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentStatus' - type: object nullable: true description: >- The status of the notification. The possible values are: unknown, draft, ready, archive, delete, unknownFutureValue. supportedLocales: type: array items: type: string nullable: true description: Supported locales for endUserNotification content. details: type: array items: $ref: '#/components/schemas/microsoft.graph.endUserNotificationDetail' x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.endUserNotification' microsoft.graph.endUserNotificationDetail: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: endUserNotificationDetail required: - '@odata.type' type: object properties: emailContent: type: string description: Email HTML content. isDefaultLangauge: type: boolean description: Indicates whether this language is default. nullable: true language: type: string description: Notification language. locale: type: string description: Notification locale. sentFrom: $ref: '#/components/schemas/microsoft.graph.emailIdentity' subject: type: string description: Mail subject. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.endUserNotificationDetail' microsoft.graph.landingPage: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: landingPage required: - '@odata.type' type: object properties: createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who created the landing page. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the landing page was created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true description: type: string description: Description of the landing page as defined by the user. nullable: true displayName: type: string description: The display name of the landing page. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Email identity of the user who last modified the landing page. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the landing page was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true locale: type: string description: Content locale. nullable: true source: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentSource' - type: object nullable: true description: >- The source of the content. The possible values are: unknown, global, tenant, unknownFutureValue. status: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentStatus' - type: object nullable: true description: >- The status of the simulation. The possible values are: unknown, draft, ready, archive, delete, unknownFutureValue. supportedLocales: type: array items: type: string nullable: true description: Supported locales. details: type: array items: $ref: '#/components/schemas/microsoft.graph.landingPageDetail' description: >- The detail information for a landing page associated with a simulation during its creation. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.landingPage' microsoft.graph.landingPageDetail: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: landingPageDetail required: - '@odata.type' type: object properties: content: type: string description: Landing page detail content. isDefaultLangauge: type: boolean description: >- Indicates whether this language detail is default for the landing page. nullable: true language: type: string description: The content language for the landing page. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.landingPageDetail' microsoft.graph.loginPage: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: loginPage required: - '@odata.type' type: object properties: content: type: string description: The HTML content of the login page. nullable: true createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who created the login page. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the login page was created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true description: type: string description: Description about the login page. nullable: true displayName: type: string description: Display name of the login page. nullable: true language: type: string description: The content language of the login page. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who last modified the login page. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the login page was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true source: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentSource' - type: object nullable: true description: >- The source of the content. The possible values are: unknown, global, tenant, unknownFutureValue. status: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentStatus' - type: object nullable: true description: >- The login page status. The possible values are: unknown, draft, ready, archive, delete, unknownFutureValue. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.loginPage' microsoft.graph.attackSimulationOperation: allOf: - $ref: '#/components/schemas/microsoft.graph.longRunningOperation' - title: attackSimulationOperation required: - '@odata.type' type: object properties: percentageCompleted: maximum: 2147483647 minimum: -2147483648 type: number description: Percentage of completion of the respective operation. format: int32 tenantId: type: string description: Tenant identifier. nullable: true type: anyOf: - $ref: >- #/components/schemas/microsoft.graph.attackSimulationOperationType - type: object nullable: true description: >- The attack simulation operation type. The possible values are: createSimulation, updateSimulation, unknownFutureValue. '@odata.type': type: string description: The status of a long-running operation. x-ms-discriminator-value: '#microsoft.graph.attackSimulationOperation' microsoft.graph.payload: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: payload required: - '@odata.type' type: object properties: brand: anyOf: - $ref: '#/components/schemas/microsoft.graph.payloadBrand' - type: object nullable: true description: >- The branch of a payload. The possible values are: unknown, other, americanExpress, capitalOne, dhl, docuSign, dropbox, facebook, firstAmerican, microsoft, netflix, scotiabank, sendGrid, stewartTitle, tesco, wellsFargo, syrinxCloud, adobe, teams, zoom, unknownFutureValue. complexity: anyOf: - $ref: '#/components/schemas/microsoft.graph.payloadComplexity' - type: object nullable: true description: >- The complexity of a payload. The possible values are: unknown, low, medium, high, unknownFutureValue. createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: >- Identity of the user who created the attack simulation and training campaign payload. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the attack simulation and training campaign payload. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true description: type: string description: >- Description of the attack simulation and training campaign payload. nullable: true detail: anyOf: - $ref: '#/components/schemas/microsoft.graph.payloadDetail' - type: object nullable: true description: Additional details about the payload. displayName: type: string description: >- Display name of the attack simulation and training campaign payload. Supports $filter and $orderby. nullable: true industry: anyOf: - $ref: '#/components/schemas/microsoft.graph.payloadIndustry' - type: object nullable: true description: >- Industry of a payload. The possible values are: unknown, other, banking, businessServices, consumerServices, education, energy, construction, consulting, financialServices, government, hospitality, insurance, legal, courierServices, IT, healthcare, manufacturing, retail, telecom, realEstate, unknownFutureValue. isAutomated: type: boolean description: >- Indicates whether the attack simulation and training campaign payload was created from an automation flow. Supports $filter and $orderby. nullable: true isControversial: type: boolean description: Indicates whether the payload is controversial. nullable: true isCurrentEvent: type: boolean description: Indicates whether the payload is from any recent event. nullable: true language: type: string description: Payload language. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: >- Identity of the user who most recently modified the attack simulation and training campaign payload. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the attack simulation and training campaign payload was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true payloadTags: type: array items: type: string nullable: true description: Free text tags for a payload. platform: anyOf: - $ref: '#/components/schemas/microsoft.graph.payloadDeliveryPlatform' - type: object nullable: true description: >- The payload delivery platform for a simulation. The possible values are: unknown, sms, email, teams, unknownFutureValue. predictedCompromiseRate: oneOf: - type: number format: double nullable: true - type: string nullable: true - $ref: '#/components/schemas/ReferenceNumeric' description: Predicted probability for a payload to phish a targeted user. simulationAttackType: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationAttackType' - type: object nullable: true description: >- Attack type of the attack simulation and training campaign. Supports $filter and $orderby. The possible values are: unknown, social, cloud, endpoint, unknownFutureValue. source: $ref: '#/components/schemas/microsoft.graph.simulationContentSource' status: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentStatus' - type: object nullable: true description: >- Simulation content status. Supports $filter and $orderby. The possible values are: unknown, draft, ready, archive, delete, unknownFutureValue. technique: anyOf: - $ref: >- #/components/schemas/microsoft.graph.simulationAttackTechnique - type: object nullable: true description: >- The social engineering technique used in the attack simulation and training campaign. Supports $filter and $orderby. The possible values are: unknown, credentialHarvesting, attachmentMalware, driveByUrl, linkInAttachment, linkToMalwareFile, unknownFutureValue, oAuthConsentGrant. Use the Prefer: include-unknown-enum-members request header to get the following values from this evolvable enum: oAuthConsentGrant. For more information on the types of social engineering attack techniques, see simulations. theme: anyOf: - $ref: '#/components/schemas/microsoft.graph.payloadTheme' - type: object nullable: true description: >- The theme of a payload. The possible values are: unknown, other, accountActivation, accountVerification, billing, cleanUpMail, controversial, documentReceived, expense, fax, financeReport, incomingMessages, invoice, itemReceived, loginAlert, mailReceived, password, payment, payroll, personalizedOffer, quarantine, remoteWork, reviewMessage, securityUpdate, serviceSuspended, signatureRequired, upgradeMailboxStorage, verifyMailbox, voicemail, advertisement, employeeEngagement, unknownFutureValue. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.payload' microsoft.graph.simulationAutomation: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: simulationAutomation required: - '@odata.type' type: object properties: createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: >- Identity of the user who created the attack simulation automation. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Date and time when the attack simulation automation was created. format: date-time nullable: true description: type: string description: Description of the attack simulation automation. nullable: true displayName: type: string description: >- Display name of the attack simulation automation. Supports $filter and $orderby. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: >- Identity of the user who most recently modified the attack simulation automation. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the attack simulation automation was most recently modified. format: date-time nullable: true lastRunDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time of the latest run of the attack simulation automation. format: date-time nullable: true nextRunDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time of the upcoming run of the attack simulation automation. format: date-time nullable: true status: anyOf: - $ref: >- #/components/schemas/microsoft.graph.simulationAutomationStatus - type: object nullable: true description: >- Status of the attack simulation automation. Supports $filter and $orderby. The possible values are: unknown, draft, notRunning, running, completed, unknownFutureValue. runs: type: array items: $ref: '#/components/schemas/microsoft.graph.simulationAutomationRun' description: A collection of simulation automation runs. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.simulationAutomation' microsoft.graph.simulationAutomationRun: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: simulationAutomationRun required: - '@odata.type' type: object properties: endDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the run ends in an attack simulation automation. format: date-time nullable: true simulationId: type: string description: >- Unique identifier for the attack simulation campaign initiated in the attack simulation automation run. nullable: true startDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the run starts in an attack simulation automation. format: date-time nullable: true status: anyOf: - $ref: >- #/components/schemas/microsoft.graph.simulationAutomationRunStatus - type: object nullable: true description: >- Status of the attack simulation automation run. The possible values are: unknown, running, succeeded, failed, skipped, unknownFutureValue. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.simulationAutomationRun' microsoft.graph.simulation: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: simulation required: - '@odata.type' type: object properties: attackTechnique: anyOf: - $ref: >- #/components/schemas/microsoft.graph.simulationAttackTechnique - type: object nullable: true description: >- The social engineering technique used in the attack simulation and training campaign. Supports $filter and $orderby. The possible values are: unknown, credentialHarvesting, attachmentMalware, driveByUrl, linkInAttachment, linkToMalwareFile, unknownFutureValue, oAuthConsentGrant. Use the Prefer: include-unknown-enum-members request header to get the following values from this evolvable enum: oAuthConsentGrant. For more information on the types of social engineering attack techniques, see simulations. attackType: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationAttackType' - type: object nullable: true description: >- Attack type of the attack simulation and training campaign. Supports $filter and $orderby. The possible values are: unknown, social, cloud, endpoint, unknownFutureValue. automationId: type: string description: Unique identifier for the attack simulation automation. nullable: true completionDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time of completion of the attack simulation and training campaign. Supports $filter and $orderby. format: date-time nullable: true createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: >- Identity of the user who created the attack simulation and training campaign. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time of creation of the attack simulation and training campaign. format: date-time nullable: true description: type: string description: Description of the attack simulation and training campaign. nullable: true displayName: type: string description: >- Display name of the attack simulation and training campaign. Supports $filter and $orderby. nullable: true durationInDays: maximum: 2147483647 minimum: -2147483648 type: number description: Simulation duration in days. format: int32 nullable: true endUserNotificationSetting: anyOf: - $ref: >- #/components/schemas/microsoft.graph.endUserNotificationSetting - type: object nullable: true description: Details about the end user notification setting. excludedAccountTarget: anyOf: - $ref: '#/components/schemas/microsoft.graph.accountTargetContent' - type: object nullable: true description: Users excluded from the simulation. includedAccountTarget: anyOf: - $ref: '#/components/schemas/microsoft.graph.accountTargetContent' - type: object nullable: true description: Users targeted in the simulation. isAutomated: type: boolean description: >- Flag that represents if the attack simulation and training campaign was created from a simulation automation flow. Supports $filter and $orderby. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: >- Identity of the user who most recently modified the attack simulation and training campaign. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time of the most recent modification of the attack simulation and training campaign. format: date-time nullable: true launchDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time of the launch/start of the attack simulation and training campaign. Supports $filter and $orderby. format: date-time nullable: true oAuthConsentAppDetail: anyOf: - $ref: '#/components/schemas/microsoft.graph.oAuthConsentAppDetail' - type: object nullable: true description: OAuth app details for the OAuth technique. payloadDeliveryPlatform: anyOf: - $ref: '#/components/schemas/microsoft.graph.payloadDeliveryPlatform' - type: object nullable: true description: >- Method of delivery of the phishing payload used in the attack simulation and training campaign. The possible values are: unknown, sms, email, teams, unknownFutureValue. report: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationReport' - type: object nullable: true description: Report of the attack simulation and training campaign. status: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationStatus' - type: object nullable: true description: >- Status of the attack simulation and training campaign. Supports $filter and $orderby. The possible values are: unknown, draft, running, scheduled, succeeded, failed, cancelled, excluded, unknownFutureValue. trainingSetting: anyOf: - $ref: '#/components/schemas/microsoft.graph.trainingSetting' - type: object nullable: true description: Details about the training settings for a simulation. landingPage: anyOf: - $ref: '#/components/schemas/microsoft.graph.landingPage' - type: object nullable: true description: >- The landing page associated with a simulation during its creation. x-ms-navigationProperty: true loginPage: anyOf: - $ref: '#/components/schemas/microsoft.graph.loginPage' - type: object nullable: true description: The login page associated with a simulation during its creation. x-ms-navigationProperty: true payload: anyOf: - $ref: '#/components/schemas/microsoft.graph.payload' - type: object nullable: true description: The payload associated with a simulation during its creation. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.simulation' microsoft.graph.training: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: training required: - '@odata.type' type: object properties: availabilityStatus: anyOf: - $ref: >- #/components/schemas/microsoft.graph.trainingAvailabilityStatus - type: object nullable: true description: >- Training availability status. The possible values are: unknown, notAvailable, available, archive, delete, unknownFutureValue. createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who created the training. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the training was created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true description: type: string description: The description for the training. nullable: true displayName: type: string description: The display name for the training. nullable: true durationInMinutes: maximum: 2147483647 minimum: -2147483648 type: number description: Training duration. format: int32 nullable: true hasEvaluation: type: boolean description: Indicates whether the training has any evaluation. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who last modified the training. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the training was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true source: anyOf: - $ref: '#/components/schemas/microsoft.graph.simulationContentSource' - type: object nullable: true description: >- Training content source. The possible values are: unknown, global, tenant, unknownFutureValue. supportedLocales: type: array items: type: string nullable: true description: Supported locales for content for the associated training. tags: type: array items: type: string nullable: true description: Training tags. type: anyOf: - $ref: '#/components/schemas/microsoft.graph.trainingType' - type: object nullable: true description: >- The type of training. The possible values are: unknown, phishing, unknownFutureValue. languageDetails: type: array items: $ref: '#/components/schemas/microsoft.graph.trainingLanguageDetail' description: Language specific details on a training. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.training' microsoft.graph.trainingLanguageDetail: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: trainingLanguageDetail required: - '@odata.type' type: object properties: content: type: string description: Language specific content for the training. createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who created the language details. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the language details were created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true description: type: string description: Description as defined by the user. nullable: true displayName: type: string description: Display name as defined by the user. nullable: true isDefaultLangauge: type: boolean description: Indicates whether the training has a default language. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.emailIdentity' - type: object nullable: true description: Identity of the user who last modified the details. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Date and time when the trainingLanguageDetail was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true locale: type: string description: Content locale for the training detail. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.trainingLanguageDetail' microsoft.graph.security.casesRoot: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: casesRoot required: - '@odata.type' type: object properties: ediscoveryCases: type: array items: $ref: '#/components/schemas/microsoft.graph.security.ediscoveryCase' x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.casesRoot' microsoft.graph.security.ediscoveryCase: allOf: - $ref: '#/components/schemas/microsoft.graph.security.case' - title: ediscoveryCase required: - '@odata.type' type: object properties: closedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user who closed the case. closedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z format: date-time nullable: true externalId: type: string description: The external case number for customer reference. nullable: true custodians: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCustodian description: >- Returns a list of case ediscoveryCustodian objects for this case. x-ms-navigationProperty: true noncustodialDataSources: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource description: >- Returns a list of case ediscoveryNoncustodialDataSource objects for this case. x-ms-navigationProperty: true operations: type: array items: $ref: '#/components/schemas/microsoft.graph.security.caseOperation' description: Returns a list of case caseOperation objects for this case. x-ms-navigationProperty: true reviewSets: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewSet description: Returns a list of eDiscoveryReviewSet objects in the case. x-ms-navigationProperty: true searches: type: array items: $ref: '#/components/schemas/microsoft.graph.security.ediscoverySearch' description: >- Returns a list of eDiscoverySearch objects associated with this case. x-ms-navigationProperty: true settings: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryCaseSettings - type: object nullable: true description: Returns a list of eDIscoverySettings objects in the case. x-ms-navigationProperty: true tags: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryReviewTag description: >- Returns a list of ediscoveryReviewTag objects associated to this case. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.security.ediscoveryCase' x-ms-discriminator-value: '#microsoft.graph.security.ediscoveryCase' microsoft.graph.security.siteSource: allOf: - $ref: '#/components/schemas/microsoft.graph.security.dataSource' - title: siteSource required: - '@odata.type' type: object properties: site: $ref: '#/components/schemas/microsoft.graph.site' '@odata.type': type: string default: '#microsoft.graph.security.siteSource' x-ms-discriminator-value: '#microsoft.graph.security.siteSource' microsoft.graph.site: allOf: - $ref: '#/components/schemas/microsoft.graph.baseItem' - title: site required: - '@odata.type' type: object properties: displayName: type: string description: The full title for the site. Read-only. nullable: true error: anyOf: - $ref: '#/components/schemas/microsoft.graph.publicError' - type: object nullable: true isPersonalSite: type: boolean description: Identifies whether the site is personal or not. Read-only. nullable: true root: anyOf: - $ref: '#/components/schemas/microsoft.graph.root' - type: object nullable: true description: >- If present, provides the root site in the site collection. Read-only. sharepointIds: anyOf: - $ref: '#/components/schemas/microsoft.graph.sharepointIds' - type: object nullable: true description: >- Returns identifiers useful for SharePoint REST compatibility. Read-only. siteCollection: anyOf: - $ref: '#/components/schemas/microsoft.graph.siteCollection' - type: object nullable: true description: >- Provides details about the site's site collection. Available only on the root site. Read-only. analytics: anyOf: - $ref: '#/components/schemas/microsoft.graph.itemAnalytics' - type: object nullable: true description: >- Analytics about the view activities that took place on this site. x-ms-navigationProperty: true columns: type: array items: $ref: '#/components/schemas/microsoft.graph.columnDefinition' description: >- The collection of column definitions reusable across lists under this site. x-ms-navigationProperty: true contentTypes: type: array items: $ref: '#/components/schemas/microsoft.graph.contentType' description: The collection of content types defined for this site. x-ms-navigationProperty: true drive: anyOf: - $ref: '#/components/schemas/microsoft.graph.drive' - type: object nullable: true description: The default drive (document library) for this site. x-ms-navigationProperty: true drives: type: array items: $ref: '#/components/schemas/microsoft.graph.drive' description: The collection of drives (document libraries) under this site. x-ms-navigationProperty: true externalColumns: type: array items: $ref: '#/components/schemas/microsoft.graph.columnDefinition' x-ms-navigationProperty: true items: type: array items: $ref: '#/components/schemas/microsoft.graph.baseItem' description: >- Used to address any item contained in this site. This collection can't be enumerated. x-ms-navigationProperty: true lists: type: array items: $ref: '#/components/schemas/microsoft.graph.list' description: The collection of lists under this site. x-ms-navigationProperty: true onenote: anyOf: - $ref: '#/components/schemas/microsoft.graph.onenote' - type: object nullable: true description: Calls the OneNote service for notebook related operations. x-ms-navigationProperty: true operations: type: array items: $ref: '#/components/schemas/microsoft.graph.richLongRunningOperation' description: The collection of long-running operations on the site. x-ms-navigationProperty: true pages: type: array items: $ref: '#/components/schemas/microsoft.graph.baseSitePage' description: The collection of pages in the baseSitePages list in this site. x-ms-navigationProperty: true permissions: type: array items: $ref: '#/components/schemas/microsoft.graph.permission' description: The permissions associated with the site. Nullable. x-ms-navigationProperty: true sites: type: array items: $ref: '#/components/schemas/microsoft.graph.site' description: The collection of the sub-sites under this site. x-ms-navigationProperty: true termStore: anyOf: - $ref: '#/components/schemas/microsoft.graph.termStore.store' - type: object nullable: true description: The default termStore under this site. x-ms-navigationProperty: true termStores: type: array items: $ref: '#/components/schemas/microsoft.graph.termStore.store' description: The collection of termStores under this site. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.site' x-ms-discriminator-value: '#microsoft.graph.site' microsoft.graph.security.unifiedGroupSource: allOf: - $ref: '#/components/schemas/microsoft.graph.security.dataSource' - title: unifiedGroupSource required: - '@odata.type' type: object properties: includedSources: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.sourceType' - type: object nullable: true description: >- Specifies which sources are included in this group. The possible values are: mailbox, site. group: $ref: '#/components/schemas/microsoft.graph.group' '@odata.type': type: string default: '#microsoft.graph.security.unifiedGroupSource' x-ms-discriminator-value: '#microsoft.graph.security.unifiedGroupSource' microsoft.graph.group: allOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - title: group required: - '@odata.type' type: object properties: allowExternalSenders: type: boolean description: >- Indicates if people external to the organization can send messages to the group. The default value is false. Returned only on $select. Supported only on the Get group API (GET /groups/{ID}). nullable: true assignedLabels: type: array items: $ref: '#/components/schemas/microsoft.graph.assignedLabel' description: >- The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group. Returned only on $select. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role. assignedLicenses: type: array items: $ref: '#/components/schemas/microsoft.graph.assignedLicense' description: >- The licenses that are assigned to the group. Returned only on $select. Supports $filter (eq). Read-only. autoSubscribeNewMembers: type: boolean description: >- Indicates if new members added to the group are autosubscribed to receive email notifications. You can set this property in a PATCH request for the group; don't set it in the initial POST request that creates the group. Default value is false. Returned only on $select. Supported only on the Get group API (GET /groups/{ID}). nullable: true classification: type: string description: >- Describes a classification for the group (such as low, medium, or high business impact). Valid values for this property are defined by creating a ClassificationList setting value, based on the template definition.Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith). nullable: true createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Timestamp of when the group was created. The value can't be modified and is automatically populated when the group is created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Read-only. format: date-time nullable: true description: type: string description: >- An optional description for the group. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith) and $search. nullable: true displayName: type: string description: >- The display name for the group. This property is required when a group is created and can't be cleared during updates. Maximum length is 256 characters. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values), $search, and $orderby. nullable: true expirationDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Timestamp of when the group is set to expire. It's null for security groups, but for Microsoft 365 groups, it represents when the group is set to expire as defined in the groupLifecyclePolicy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Supports $filter (eq, ne, not, ge, le, in). Read-only. format: date-time nullable: true groupTypes: type: array items: type: string description: >- Specifies the group type and its membership. If the collection contains Unified, the group is a Microsoft 365 group; otherwise, it's either a security group or a distribution group. For details, see groups overview.If the collection includes DynamicMembership, the group has dynamic membership; otherwise, membership is static. Returned by default. Supports $filter (eq, not). hasMembersWithLicenseErrors: type: boolean description: >- Indicates whether there are members in this group that have license errors from its group-based license assignment. This property is never returned on a GET operation. You can use it as a $filter argument to get groups that have members with license errors (that is, filter for this property being true). See an example. Supports $filter (eq). nullable: true hideFromAddressLists: type: boolean description: >- True if the group isn't displayed in certain parts of the Outlook UI: the Address Book, address lists for selecting message recipients, and the Browse Groups dialog for searching groups; otherwise, false. The default value is false. Returned only on $select. Supported only on the Get group API (GET /groups/{ID}). nullable: true hideFromOutlookClients: type: boolean description: >- True if the group isn't displayed in Outlook clients, such as Outlook for Windows and Outlook on the web; otherwise, false. The default value is false. Returned only on $select. Supported only on the Get group API (GET /groups/{ID}). nullable: true isArchived: type: boolean description: >- When a group is associated with a team, this property determines whether the team is in read-only mode.To read this property, use the /group/{groupId}/team endpoint or the Get team API. To update this property, use the archiveTeam and unarchiveTeam APIs. nullable: true isAssignableToRole: type: boolean description: >- Indicates whether this group can be assigned to a Microsoft Entra role. Optional. This property can only be set while creating the group and is immutable. If set to true, the securityEnabled property must also be set to true, visibility must be Hidden, and the group can't be a dynamic group (that is, groupTypes can't contain DynamicMembership). Only callers with at least the Privileged Role Administrator role can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups. For more, see Using a group to manage Microsoft Entra role assignmentsUsing this feature requires a Microsoft Entra ID P1 license. Returned by default. Supports $filter (eq, ne, not). nullable: true isManagementRestricted: type: boolean description: >- Indicates whether the group is a member of a restricted management administrative unit. If not set, the default value is null and the default behavior is false. Read-only. To manage a group member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Returned only on $select. nullable: true isSubscribedByMail: type: boolean description: >- Indicates whether the signed-in user is subscribed to receive email conversations. The default value is true. Returned only on $select. Supported only on the Get group API (GET /groups/{ID}). nullable: true licenseProcessingState: anyOf: - $ref: '#/components/schemas/microsoft.graph.licenseProcessingState' - type: object nullable: true description: >- Indicates the status of the group license assignment to all group members. The default value is false. Read-only. Possible values: QueuedForProcessing, ProcessingInProgress, and ProcessingComplete.Returned only on $select. Read-only. mail: type: string description: >- The SMTP address for the group, for example, 'serviceadmins@contoso.com'. Returned by default. Read-only. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true mailEnabled: type: boolean description: >- Specifies whether the group is mail-enabled. Required. Returned by default. Supports $filter (eq, ne, not). nullable: true mailNickname: type: string description: >- The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following characters: @ () / [] ' ; : <> , SPACE. Required. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true membershipRule: type: string description: >- The rule that determines members for this group if the group is a dynamic group (groupTypes contains DynamicMembership). For more information about the syntax of the membership rule, see Membership Rules syntax. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith). nullable: true membershipRuleProcessingState: type: string description: >- Indicates whether the dynamic membership processing is on or paused. Possible values are On or Paused. Returned by default. Supports $filter (eq, ne, not, in). nullable: true onPremisesDomainName: type: string description: >- Contains the on-premises domain FQDN, also called dnsDomainName synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect.Returned by default. Read-only. nullable: true onPremisesLastSyncDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Indicates the last time at which the group was synced with the on-premises directory. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Read-only. Supports $filter (eq, ne, not, ge, le, in). format: date-time nullable: true onPremisesNetBiosName: type: string description: >- Contains the on-premises netBios name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect.Returned by default. Read-only. nullable: true onPremisesProvisioningErrors: type: array items: $ref: >- #/components/schemas/microsoft.graph.onPremisesProvisioningError description: >- Errors when using Microsoft synchronization product during provisioning. Returned by default. Supports $filter (eq, not). onPremisesSamAccountName: type: string description: >- Contains the on-premises SAM account name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect.Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith). Read-only. nullable: true onPremisesSecurityIdentifier: type: string description: >- Contains the on-premises security identifier (SID) for the group synchronized from on-premises to the cloud. Read-only. Returned by default. Supports $filter (eq including on null values). nullable: true onPremisesSyncEnabled: type: boolean description: >- true if this group is synced from an on-premises directory; false if this group was originally synced from an on-premises directory but is no longer synced; null if this object has never synced from an on-premises directory (default). Returned by default. Read-only. Supports $filter (eq, ne, not, in, and eq on null values). nullable: true preferredDataLocation: type: string description: >- The preferred data location for the Microsoft 365 group. By default, the group inherits the group creator's preferred data location. To set this property, the calling app must be granted the Directory.ReadWrite.All permission and the user be assigned at least one of the following Microsoft Entra roles: User Account Administrator Directory Writer Exchange Administrator SharePoint Administrator For more information about this property, see OneDrive Online Multi-Geo. Nullable. Returned by default. nullable: true preferredLanguage: type: string description: >- The preferred language for a Microsoft 365 group. Should follow ISO 639-1 Code; for example, en-US. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true proxyAddresses: type: array items: type: string description: >- Email addresses for the group that direct to the same group mailbox. For example: ['SMTP: bob@contoso.com', 'smtp: bob@sales.contoso.com']. The any operator is required to filter expressions on multi-valued properties. Returned by default. Read-only. Not nullable. Supports $filter (eq, not, ge, le, startsWith, endsWith, /$count eq 0, /$count ne 0). renewedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Timestamp of when the group was last renewed. This value can't be modified directly and is only updated via the renew service action. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Supports $filter (eq, ne, not, ge, le, in). Read-only. format: date-time nullable: true securityEnabled: type: boolean description: >- Specifies whether the group is a security group. Required. Returned by default. Supports $filter (eq, ne, not, in). nullable: true securityIdentifier: type: string description: >- Security identifier of the group, used in Windows scenarios. Read-only. Returned by default. nullable: true serviceProvisioningErrors: type: array items: $ref: '#/components/schemas/microsoft.graph.serviceProvisioningError' description: >- Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a group object. Supports $filter (eq, not, for isResolved and serviceInstance). theme: type: string description: >- Specifies a Microsoft 365 group's color theme. Possible values are Teal, Purple, Green, Blue, Pink, Orange, or Red. Returned by default. nullable: true uniqueName: type: string description: >- The unique identifier that can be assigned to a group and used as an alternate key. Immutable. Read-only. nullable: true unseenCount: maximum: 2147483647 minimum: -2147483648 type: number description: >- Count of conversations that received new posts since the signed-in user last visited the group. Returned only on $select. Supported only on the Get group API (GET /groups/{ID}). format: int32 nullable: true visibility: type: string description: >- Specifies the group join policy and group content visibility for groups. The possible values are: Private, Public, or HiddenMembership. HiddenMembership can be set only for Microsoft 365 groups when the groups are created. It can't be updated later. Other values of visibility can be updated after group creation. If visibility value isn't specified during group creation on Microsoft Graph, a security group is created as Private by default, and the Microsoft 365 group is Public. Groups assignable to roles are always Private. To learn more, see group visibility options. Returned by default. Nullable. nullable: true acceptedSenders: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The list of users or groups allowed to create posts or calendar events in this group. If this list is nonempty, then only users or groups listed here are allowed to post. x-ms-navigationProperty: true appRoleAssignments: type: array items: $ref: '#/components/schemas/microsoft.graph.appRoleAssignment' description: >- Represents the app roles granted to a group for an application. Supports $expand. x-ms-navigationProperty: true calendar: anyOf: - $ref: '#/components/schemas/microsoft.graph.calendar' - type: object nullable: true description: The group's calendar. Read-only. x-ms-navigationProperty: true calendarView: type: array items: $ref: '#/components/schemas/microsoft.graph.event' description: The calendar view for the calendar. Read-only. x-ms-navigationProperty: true conversations: type: array items: $ref: '#/components/schemas/microsoft.graph.conversation' description: The group's conversations. x-ms-navigationProperty: true createdOnBehalfOf: anyOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - type: object nullable: true description: >- The user (or application) that created the group. NOTE: This property isn't set if the user is an administrator. Read-only. x-ms-navigationProperty: true drive: anyOf: - $ref: '#/components/schemas/microsoft.graph.drive' - type: object nullable: true description: The group's default drive. Read-only. x-ms-navigationProperty: true drives: type: array items: $ref: '#/components/schemas/microsoft.graph.drive' description: The group's drives. Read-only. x-ms-navigationProperty: true events: type: array items: $ref: '#/components/schemas/microsoft.graph.event' description: The group's calendar events. x-ms-navigationProperty: true extensions: type: array items: $ref: '#/components/schemas/microsoft.graph.extension' description: >- The collection of open extensions defined for the group. Read-only. Nullable. x-ms-navigationProperty: true groupLifecyclePolicies: type: array items: $ref: '#/components/schemas/microsoft.graph.groupLifecyclePolicy' description: >- The collection of lifecycle policies for this group. Read-only. Nullable. x-ms-navigationProperty: true memberOf: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- Groups that this group is a member of. HTTP Methods: GET (supported for all groups). Read-only. Nullable. Supports $expand. x-ms-navigationProperty: true members: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The members of this group, who can be users, devices, other groups, or service principals. Supports the List members, Add member, and Remove member operations. Nullable. Supports $expand including nested $select. For example, /groups?$filter=startsWith(displayName,'Role')&$select=id,displayName&$expand=members($select=id,userPrincipalName,displayName). x-ms-navigationProperty: true membersWithLicenseErrors: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- A list of group members with license errors from this group-based license assignment. Read-only. x-ms-navigationProperty: true onenote: anyOf: - $ref: '#/components/schemas/microsoft.graph.onenote' - type: object nullable: true x-ms-navigationProperty: true onPremisesSyncBehavior: anyOf: - $ref: '#/components/schemas/microsoft.graph.onPremisesSyncBehavior' - type: object nullable: true x-ms-navigationProperty: true owners: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The owners of the group who can be users or service principals. Limited to 100 owners. Nullable. If this property isn't specified when creating a Microsoft 365 group the calling user (admin or non-admin) is automatically assigned as the group owner. A non-admin user can't explicitly add themselves to this collection when they're creating the group. For more information, see the related known issue. For security groups, the admin user isn't automatically added to this collection. For more information, see the related known issue. Supports $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1); Supports $expand including nested $select. For example, /groups?$filter=startsWith(displayName,'Role')&$select=id,displayName&$expand=owners($select=id,userPrincipalName,displayName). x-ms-navigationProperty: true permissionGrants: type: array items: $ref: >- #/components/schemas/microsoft.graph.resourceSpecificPermissionGrant x-ms-navigationProperty: true photo: anyOf: - $ref: '#/components/schemas/microsoft.graph.profilePhoto' - type: object nullable: true description: The group's profile photo x-ms-navigationProperty: true photos: type: array items: $ref: '#/components/schemas/microsoft.graph.profilePhoto' description: The profile photos owned by the group. Read-only. Nullable. x-ms-navigationProperty: true planner: anyOf: - $ref: '#/components/schemas/microsoft.graph.plannerGroup' - type: object nullable: true description: >- Entry-point to Planner resource that might exist for a Unified Group. x-ms-navigationProperty: true rejectedSenders: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The list of users or groups not allowed to create posts or calendar events in this group. Nullable x-ms-navigationProperty: true settings: type: array items: $ref: '#/components/schemas/microsoft.graph.groupSetting' description: >- Settings that can govern this group's behavior, like whether members can invite guests to the group. Nullable. x-ms-navigationProperty: true sites: type: array items: $ref: '#/components/schemas/microsoft.graph.site' description: >- The list of SharePoint sites in this group. Access the default site with /sites/root. x-ms-navigationProperty: true team: anyOf: - $ref: '#/components/schemas/microsoft.graph.team' - type: object nullable: true description: The team associated with this group. x-ms-navigationProperty: true threads: type: array items: $ref: '#/components/schemas/microsoft.graph.conversationThread' description: The group's conversation threads. Nullable. x-ms-navigationProperty: true transitiveMemberOf: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The groups that a group is a member of, either directly or through nested membership. Nullable. x-ms-navigationProperty: true transitiveMembers: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: The direct and transitive members of a group. Nullable. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.group' description: Represents a Microsoft Entra group. x-ms-discriminator-value: '#microsoft.graph.group' microsoft.graph.security.userSource: allOf: - $ref: '#/components/schemas/microsoft.graph.security.dataSource' - title: userSource required: - '@odata.type' type: object properties: email: type: string description: Email address of the user's mailbox. includedSources: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.sourceType' - type: object nullable: true description: >- Specifies which sources are included in this group. The possible values are: mailbox, site. siteWebUrl: type: string description: The URL of the user's OneDrive for Business site. Read-only. nullable: true '@odata.type': type: string default: '#microsoft.graph.security.userSource' x-ms-discriminator-value: '#microsoft.graph.security.userSource' microsoft.graph.security.dataSource: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: dataSource required: - '@odata.type' type: object properties: createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user who created the dataSource. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date and time the dataSource was created. format: date-time nullable: true displayName: type: string description: >- The display name of the dataSource and is the name of the SharePoint site. nullable: true holdStatus: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.dataSourceHoldStatus - type: object nullable: true description: >- The hold status of the dataSource.The possible values are: notApplied, applied, applying, removing, partial '@odata.type': type: string discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.security.siteSource': '#/components/schemas/microsoft.graph.security.siteSource' '#microsoft.graph.security.unifiedGroupSource': '#/components/schemas/microsoft.graph.security.unifiedGroupSource' '#microsoft.graph.security.userSource': '#/components/schemas/microsoft.graph.security.userSource' microsoft.graph.security.caseOperation: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: caseOperation required: - '@odata.type' type: object properties: action: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.caseAction' - type: object nullable: true description: >- The type of action the operation represents. The possible values are: contentExport, applyTags, convertToPdf, index, estimateStatistics, addToReviewSet, holdUpdate, unknownFutureValue, purgeData, exportReport, exportResult, holdPolicySync. Use the Prefer: include-unknown-enum-members request header to get the following values from this evolvable enum: purgeData, exportReport, exportResult, holdPolicySync. completedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date and time the operation was completed. format: date-time nullable: true createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user that created the operation. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date and time the operation was created. format: date-time nullable: true percentProgress: maximum: 2147483647 minimum: -2147483648 type: number description: The progress of the operation. format: int32 nullable: true resultInfo: anyOf: - $ref: '#/components/schemas/microsoft.graph.resultInfo' - type: object nullable: true description: Contains success and failure-specific result information. status: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.caseOperationStatus - type: object nullable: true description: >- The status of the case operation. The possible values are: notStarted, submissionFailed, running, succeeded, partiallySucceeded, failed, unknownFutureValue. '@odata.type': type: string discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.security.ediscoveryAddToReviewSetOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryAddToReviewSetOperation '#microsoft.graph.security.ediscoveryEstimateOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryEstimateOperation '#microsoft.graph.security.ediscoveryExportOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryExportOperation '#microsoft.graph.security.ediscoveryHoldOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryHoldOperation '#microsoft.graph.security.ediscoveryHoldPolicySyncOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryHoldPolicySyncOperation '#microsoft.graph.security.ediscoveryIndexOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryIndexOperation '#microsoft.graph.security.ediscoveryPurgeDataOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryPurgeDataOperation '#microsoft.graph.security.ediscoverySearchExportOperation': >- #/components/schemas/microsoft.graph.security.ediscoverySearchExportOperation '#microsoft.graph.security.ediscoveryTagOperation': >- #/components/schemas/microsoft.graph.security.ediscoveryTagOperation microsoft.graph.security.ediscoverySearch: allOf: - $ref: '#/components/schemas/microsoft.graph.security.search' - title: ediscoverySearch required: - '@odata.type' type: object properties: dataSourceScopes: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.dataSourceScopes - type: object nullable: true description: >- When specified, the collection spans across a service for an entire workload. The possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources. additionalSources: type: array items: $ref: '#/components/schemas/microsoft.graph.security.dataSource' description: Adds an additional source to the eDiscovery search. x-ms-navigationProperty: true addToReviewSetOperation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryAddToReviewSetOperation - type: object nullable: true description: >- Adds the results of the eDiscovery search to the specified reviewSet. x-ms-navigationProperty: true custodianSources: type: array items: $ref: '#/components/schemas/microsoft.graph.security.dataSource' description: Custodian sources that are included in the eDiscovery search. x-ms-navigationProperty: true lastEstimateStatisticsOperation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryEstimateOperation - type: object nullable: true description: >- The last estimate operation associated with the eDiscovery search. x-ms-navigationProperty: true noncustodialSources: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.ediscoveryNoncustodialDataSource description: >- noncustodialDataSource sources that are included in the eDiscovery search x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.security.ediscoverySearch' x-ms-discriminator-value: '#microsoft.graph.security.ediscoverySearch' microsoft.graph.security.purgeType: title: purgeType enum: - recoverable - unknownFutureValue - permanentlyDelete type: string microsoft.graph.security.purgeAreas: title: purgeAreas enum: - mailboxes - teamsMessages - unknownFutureValue type: string x-ms-enum-flags: isFlags: true microsoft.graph.userActivityTypes: title: userActivityTypes enum: - none - uploadText - uploadFile - downloadText - downloadFile - unknownFutureValue type: string x-ms-enum-flags: isFlags: true microsoft.graph.policyLocation: title: policyLocation required: - '@odata.type' type: object properties: value: type: string description: >- The actual value representing the location. Location value is specific for concretetype of the policyLocation - policyLocationDomain, policyLocationUrl, or policyLocationApplication (for example, 'contoso.com', 'https://partner.contoso.com/upload', '83ef198a-0396-4893-9d4f-d36efbffcaaa'). '@odata.type': type: string discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.policyLocationApplication': '#/components/schemas/microsoft.graph.policyLocationApplication' '#microsoft.graph.policyLocationDomain': '#/components/schemas/microsoft.graph.policyLocationDomain' '#microsoft.graph.policyLocationUrl': '#/components/schemas/microsoft.graph.policyLocationUrl' microsoft.graph.policyPivotProperty: title: policyPivotProperty enum: - none - activity - location - unknownFutureValue type: string microsoft.graph.deviceMetadata: title: deviceMetadata required: - '@odata.type' type: object properties: deviceType: type: string description: >- Optional. The general type of the device (for example, 'Managed', 'Unmanaged'). nullable: true ipAddress: type: string description: The Internet Protocol (IP) address of the device. nullable: true operatingSystemSpecifications: anyOf: - $ref: >- #/components/schemas/microsoft.graph.operatingSystemSpecifications - type: object nullable: true description: Details about the operating system platform and version. '@odata.type': type: string microsoft.graph.sensitivityLabel: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: sensitivityLabel required: - '@odata.type' type: object properties: actionSource: anyOf: - $ref: '#/components/schemas/microsoft.graph.labelActionSource' - type: object nullable: true autoTooltip: type: string nullable: true description: type: string nullable: true displayName: type: string nullable: true isDefault: type: boolean nullable: true isEndpointProtectionEnabled: type: boolean nullable: true isScopedToUser: type: boolean nullable: true locale: type: string nullable: true name: type: string nullable: true priority: maximum: 2147483647 minimum: -2147483648 type: number format: int32 nullable: true toolTip: type: string nullable: true rights: anyOf: - $ref: '#/components/schemas/microsoft.graph.usageRightsIncluded' - type: object nullable: true x-ms-navigationProperty: true sublabels: type: array items: $ref: '#/components/schemas/microsoft.graph.sensitivityLabel' x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.sensitivityLabel' microsoft.graph.usageRightsIncluded: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: usageRightsIncluded required: - '@odata.type' type: object properties: ownerEmail: type: string description: The email of owner label rights. nullable: true userEmail: type: string description: The email of user with label user rights. nullable: true value: $ref: '#/components/schemas/microsoft.graph.usageRights' '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.usageRightsIncluded' microsoft.graph.protectedContent: title: protectedContent required: - '@odata.type' type: object properties: cid: type: string description: The content id nullable: true format: type: string description: The content format. nullable: true labelId: type: string description: >- The unique identifier for the sensitivity label applied to the content. '@odata.type': type: string microsoft.graph.security.identityContainer: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: identityContainer required: - '@odata.type' type: object properties: healthIssues: type: array items: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' description: >- Represents potential issues identified by Microsoft Defender for Identity within a customer's Microsoft Defender for Identity configuration. x-ms-navigationProperty: true identityAccounts: type: array items: $ref: '#/components/schemas/microsoft.graph.security.identityAccounts' description: >- Represents an identity's details in the context of Microsoft Defender for Identity. x-ms-navigationProperty: true sensorCandidateActivationConfiguration: $ref: >- #/components/schemas/microsoft.graph.security.sensorCandidateActivationConfiguration sensorCandidates: type: array items: $ref: '#/components/schemas/microsoft.graph.security.sensorCandidate' description: >- Represents Microsoft Defender for Identity sensors that are ready to be activated. x-ms-navigationProperty: true sensors: type: array items: $ref: '#/components/schemas/microsoft.graph.security.sensor' description: Represents a customer's Microsoft Defender for Identity sensors. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.identityContainer' microsoft.graph.security.healthIssue: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: healthIssue required: - '@odata.type' type: object properties: additionalInformation: type: array items: type: string description: >- Contains additional information about the issue, such as a list of items to fix. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the health issue was generated. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time description: type: string description: Contains more detailed information about the health issue. displayName: type: string description: The display name of the health issue. nullable: true domainNames: type: array items: type: string nullable: true description: >- A list of the fully qualified domain names of the domains or the sensors the health issue is related to. healthIssueType: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.healthIssueType - type: object nullable: true description: >- The type of the health issue. The possible values are: sensor, global, unknownFutureValue. For a list of all health issues and their identifiers, see Microsoft Defender for Identity health issues. issueTypeId: type: string description: >- The type identifier of the health issue. For a list of all health issues and their identifiers, see Microsoft Defender for Identity health issues. nullable: true lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the health issue was last updated. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time recommendations: type: array items: type: string description: >- A list of recommended actions that can be taken to resolve the issue effectively and efficiently. These actions might include instructions for further investigation and aren't limited to prewritten responses. recommendedActionCommands: type: array items: type: string description: >- A list of commands from the PowerShell module for the product that can be used to resolve the issue, if available. If no commands can be used to solve the issue, this property is empty. The commands, if present, provide a quick and efficient way to address the issue. These commands run in sequence for the single recommended fix. sensorDNSNames: type: array items: type: string nullable: true description: >- A list of the DNS names of the sensors the health issue is related to. severity: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.healthIssueSeverity - type: object nullable: true description: >- The severity of the health issue. The possible values are: low, medium, high, unknownFutureValue. status: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.healthIssueStatus - type: object nullable: true description: >- The status of the health issue. The possible values are: open, closed, suppressed, unknownFutureValue. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.healthIssue' microsoft.graph.security.identityAccounts: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: identityAccounts required: - '@odata.type' type: object properties: accounts: type: array items: $ref: '#/components/schemas/microsoft.graph.security.account' description: >- Collection of accounts of the identity in different identity providers. cloudSecurityIdentifier: type: string description: The cloud security identifier of the identityAccount. nullable: true displayName: type: string description: The Active Directory display name of the identityAccount. nullable: true domain: type: string description: The Active Directory domain name of the identityAccount. nullable: true isEnabled: type: boolean description: Boolean indicating if the identityAccounts is enabled. onPremisesSecurityIdentifier: type: string description: The on-premises security identifier of the identityAccount. nullable: true '@odata.type': type: string discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.security.user': '#/components/schemas/microsoft.graph.security.user' microsoft.graph.security.action: title: action enum: - disable - enable - forcePasswordReset - revokeAllSessions - requireUserToSignInAgain - markUserAsCompromised - unknownFutureValue type: string microsoft.graph.security.sensorCandidate: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: sensorCandidate required: - '@odata.type' type: object properties: computerDnsName: type: string description: The DNS name of the computer associated with the sensor. lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date and time when the sensor was last seen. format: date-time senseClientVersion: type: string description: >- The version of the Defender for Identity sensor client. Supports $filter (eq). '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.sensorCandidate' microsoft.graph.security.sensor: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: sensor required: - '@odata.type' type: object properties: createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the sensor was generated. The Timestamp represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time deploymentStatus: $ref: '#/components/schemas/microsoft.graph.security.deploymentStatus' displayName: type: string description: The display name of the sensor. domainName: type: string description: The fully qualified domain name of the sensor. healthStatus: $ref: '#/components/schemas/microsoft.graph.security.sensorHealthStatus' openHealthIssuesCount: type: number description: >- This field displays the count of health issues related to this sensor. format: int64 sensorType: $ref: '#/components/schemas/microsoft.graph.security.sensorType' settings: $ref: '#/components/schemas/microsoft.graph.security.sensorSettings' version: type: string description: The version of the sensor. healthIssues: type: array items: $ref: '#/components/schemas/microsoft.graph.security.healthIssue' description: >- Represents potential issues within a customer's Microsoft Defender for Identity configuration that Microsoft Defender for Identity identified related to the sensor. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.sensor' microsoft.graph.security.incident: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: incident required: - '@odata.type' type: object properties: assignedTo: type: string description: >- Owner of the incident, or null if no owner is assigned. Free editable text. nullable: true classification: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.alertClassification - type: object nullable: true description: >- The specification for the incident. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue. comments: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alertComment' description: >- Array of comments created by the Security Operations (SecOps) team when the incident is managed. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when the incident was first created. format: date-time customTags: type: array items: type: string nullable: true description: Array of custom tags associated with an incident. description: type: string description: Description of the incident. nullable: true determination: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.alertDetermination - type: object nullable: true description: >- Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue. displayName: type: string description: The incident name. nullable: true incidentWebUrl: type: string description: >- The URL for the incident page in the Microsoft 365 Defender portal. nullable: true lastModifiedBy: type: string description: The identity that last modified the incident. nullable: true lastUpdateDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when the incident was last updated. format: date-time redirectIncidentId: type: string description: >- Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected. nullable: true resolvingComment: type: string description: >- User input that explains the resolution of the incident and the classification choice. This property contains free editable text. nullable: true severity: $ref: '#/components/schemas/microsoft.graph.security.alertSeverity' status: $ref: '#/components/schemas/microsoft.graph.security.incidentStatus' summary: type: string description: >- The overview of an attack. When applicable, the summary contains details of what occurred, impacted assets, and the type of attack. nullable: true systemTags: type: array items: type: string nullable: true description: The system tags associated with the incident. tenantId: type: string description: The Microsoft Entra tenant in which the alert was created. nullable: true alerts: type: array items: $ref: '#/components/schemas/microsoft.graph.security.alert' description: The list of related alerts. Supports $expand. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.incident' microsoft.graph.security.labelsRoot: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: labelsRoot required: - '@odata.type' type: object properties: authorities: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.authorityTemplate description: >- Specifies the underlying authority that describes the type of content to be retained and its retention schedule. x-ms-navigationProperty: true categories: type: array items: $ref: '#/components/schemas/microsoft.graph.security.categoryTemplate' description: >- Specifies a group of similar types of content in a particular department. x-ms-navigationProperty: true citations: type: array items: $ref: '#/components/schemas/microsoft.graph.security.citationTemplate' description: >- The specific rule or regulation created by a jurisdiction used to determine whether certain labels and content should be retained or deleted. x-ms-navigationProperty: true departments: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.departmentTemplate description: >- Specifies the department or business unit of an organization to which a label belongs. x-ms-navigationProperty: true filePlanReferences: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate description: >- Specifies a unique alpha-numeric identifier for an organization’s retention schedule. x-ms-navigationProperty: true retentionLabels: type: array items: $ref: '#/components/schemas/microsoft.graph.security.retentionLabel' description: >- Represents how customers can manage their data, whether and for how long to retain or delete it. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.labelsRoot' microsoft.graph.security.authorityTemplate: allOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanDescriptorTemplate - title: authorityTemplate required: - '@odata.type' type: object properties: '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.authorityTemplate' microsoft.graph.security.categoryTemplate: allOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanDescriptorTemplate - title: categoryTemplate required: - '@odata.type' type: object properties: subcategories: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.subcategoryTemplate description: Represents all subcategories under a particular category. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.categoryTemplate' microsoft.graph.security.citationTemplate: allOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanDescriptorTemplate - title: citationTemplate required: - '@odata.type' type: object properties: citationJurisdiction: type: string description: >- Represents the jurisdiction or agency that published the citation. nullable: true citationUrl: type: string description: Represents the URL to the published citation. nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.citationTemplate' microsoft.graph.security.departmentTemplate: allOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanDescriptorTemplate - title: departmentTemplate required: - '@odata.type' type: object properties: '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.departmentTemplate' microsoft.graph.security.retentionLabel: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: retentionLabel required: - '@odata.type' type: object properties: actionAfterRetentionPeriod: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.actionAfterRetentionPeriod - type: object nullable: true description: >- Specifies the action to take on the labeled document after the period specified by the retentionDuration property expires. The possible values are: none, delete, startDispositionReview, unknownFutureValue. behaviorDuringRetentionPeriod: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.behaviorDuringRetentionPeriod - type: object nullable: true description: >- Specifies how the behavior of a document with this label should be during the retention period. The possible values are: doNotRetain, retain, retainAsRecord, retainAsRegulatoryRecord, unknownFutureValue. createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: Represents the user who created the retentionLabel. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Represents the date and time in which the retentionLabel is created. format: date-time nullable: true defaultRecordBehavior: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.defaultRecordBehavior - type: object nullable: true description: >- Specifies the locked or unlocked state of a record label when it is created.The possible values are: startLocked, startUnlocked, unknownFutureValue. descriptionForAdmins: type: string description: Provides label information for the admin. Optional. nullable: true descriptionForUsers: type: string description: Provides the label information for the user. Optional. nullable: true displayName: type: string description: Unique string that defines a label name. nullable: true isInUse: type: boolean description: Specifies whether the label is currently being used. nullable: true labelToBeApplied: type: string description: >- Specifies the replacement label to be applied automatically after the retention period of the current label ends. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user who last modified the retentionLabel. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The latest date time when the retentionLabel was modified. format: date-time nullable: true retentionDuration: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.retentionDuration - type: object nullable: true description: Specifies the number of days to retain the content. retentionTrigger: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.retentionTrigger - type: object nullable: true description: >- Specifies whether the retention duration is calculated from the content creation date, labeled date, or last modification date. The possible values are: dateLabeled, dateCreated, dateModified, dateOfEvent, unknownFutureValue. descriptors: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanDescriptor - type: object nullable: true description: >- Represents out-of-the-box values that provide more options to improve the manageability and organization of the content you need to label. x-ms-navigationProperty: true dispositionReviewStages: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.dispositionReviewStage description: >- When action at the end of retention is chosen as 'dispositionReview', dispositionReviewStages specifies a sequential set of stages with at least one reviewer in each stage. x-ms-navigationProperty: true retentionEventType: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType - type: object nullable: true description: Represents the type associated with a retention event. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.retentionLabel' microsoft.graph.security.filePlanDescriptor: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: filePlanDescriptor required: - '@odata.type' type: object properties: authority: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanAuthority - type: object nullable: true description: >- Represents the file plan descriptor of type authority applied to a particular retention label. category: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanAppliedCategory - type: object nullable: true citation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanCitation - type: object nullable: true description: >- Represents the file plan descriptor of type citation applied to a particular retention label. department: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanDepartment - type: object nullable: true description: >- Represents the file plan descriptor of type department applied to a particular retention label. filePlanReference: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanReference - type: object nullable: true description: >- Represents the file plan descriptor of type filePlanReference applied to a particular retention label. authorityTemplate: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.authorityTemplate - type: object nullable: true description: >- Specifies the underlying authority that describes the type of content to be retained and its retention schedule. x-ms-navigationProperty: true categoryTemplate: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.categoryTemplate - type: object nullable: true description: >- Specifies a group of similar types of content in a particular department. x-ms-navigationProperty: true citationTemplate: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.citationTemplate - type: object nullable: true description: >- The specific rule or regulation created by a jurisdiction used to determine whether certain labels and content should be retained or deleted. x-ms-navigationProperty: true departmentTemplate: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.departmentTemplate - type: object nullable: true description: >- Specifies the department or business unit of an organization to which a label belongs. x-ms-navigationProperty: true filePlanReferenceTemplate: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.filePlanReferenceTemplate - type: object nullable: true description: >- Specifies a unique alpha-numeric identifier for an organization’s retention schedule. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.filePlanDescriptor' microsoft.graph.secureScoreControlProfile: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: secureScoreControlProfile required: - '@odata.type' type: object properties: actionType: type: string description: Control action type (Config, Review, Behavior). nullable: true actionUrl: type: string description: URL to where the control can be actioned. nullable: true azureTenantId: type: string description: GUID string for tenant ID. complianceInformation: type: array items: $ref: '#/components/schemas/microsoft.graph.complianceInformation' description: >- The collection of compliance information associated with secure score control. Not implemented. Currently returns null. controlCategory: type: string description: >- Control action category (Identity, Data, Device, Apps, Infrastructure). nullable: true controlStateUpdates: type: array items: $ref: >- #/components/schemas/microsoft.graph.secureScoreControlStateUpdate description: >- Flag to indicate where the tenant has marked a control (ignored, thirdParty, reviewed) (supports update). deprecated: type: boolean description: Flag to indicate if a control is depreciated. nullable: true implementationCost: type: string description: Resource cost of implemmentating control (low, moderate, high). nullable: true lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Time at which the control profile entity was last modified. The Timestamp type represents date and time format: date-time nullable: true maxScore: oneOf: - type: number format: double nullable: true - type: string nullable: true - $ref: '#/components/schemas/ReferenceNumeric' description: max attainable score for the control. rank: maximum: 2147483647 minimum: -2147483648 type: number description: Microsoft's stack ranking of control. format: int32 nullable: true remediation: type: string description: Description of what the control will help remediate. nullable: true remediationImpact: type: string description: Description of the impact on users of the remediation. nullable: true service: type: string description: >- Service that owns the control (Exchange, Sharepoint, Microsoft Entra ID). nullable: true threats: type: array items: type: string nullable: true description: >- List of threats the control mitigates (accountBreach, dataDeletion, dataExfiltration, dataSpillage, elevationOfPrivilege, maliciousInsider, passwordCracking, phishingOrWhaling, spoofing). tier: type: string description: Control tier (Core, Defense in Depth, Advanced.) nullable: true title: type: string description: Title of the control. nullable: true userImpact: type: string description: User impact of implementing control (low, moderate, high). nullable: true vendorInformation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.securityVendorInformation - type: object nullable: true description: >- Complex type containing details about the security product/service vendor, provider, and subprovider (for example, vendor=Microsoft; provider=SecureScore). Required. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.secureScoreControlProfile' microsoft.graph.secureScore: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: secureScore required: - '@odata.type' type: object properties: activeUserCount: maximum: 2147483647 minimum: -2147483648 type: number description: Active user count of the given tenant. format: int32 nullable: true averageComparativeScores: type: array items: $ref: '#/components/schemas/microsoft.graph.averageComparativeScore' description: >- Average score by different scopes (for example, average by industry, average by seating) and control category (Identity, Data, Device, Apps, Infrastructure) within the scope. azureTenantId: type: string description: GUID string for tenant ID. controlScores: type: array items: $ref: '#/components/schemas/microsoft.graph.controlScore' description: Contains tenant scores for a set of controls. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: When the report was created. format: date-time nullable: true currentScore: oneOf: - type: number format: double nullable: true - type: string nullable: true - $ref: '#/components/schemas/ReferenceNumeric' description: Tenant current attained score on specified date. enabledServices: type: array items: type: string nullable: true description: >- Microsoft-provided services for the tenant (for example, Exchange online, Skype, Sharepoint). licensedUserCount: maximum: 2147483647 minimum: -2147483648 type: number description: Licensed user count of the given tenant. format: int32 nullable: true maxScore: oneOf: - type: number format: double nullable: true - type: string nullable: true - $ref: '#/components/schemas/ReferenceNumeric' description: Tenant maximum possible score on specified date. vendorInformation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.securityVendorInformation - type: object nullable: true description: >- Complex type containing details about the security product/service vendor, provider, and subprovider (for example, vendor=Microsoft; provider=SecureScore). Required. '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.secureScore' microsoft.graph.subjectRightsRequest: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: subjectRightsRequest required: - '@odata.type' type: object properties: assignedTo: anyOf: - $ref: '#/components/schemas/microsoft.graph.identity' - type: object nullable: true description: Identity that the request is assigned to. closedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the request was closed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true contentQuery: type: string description: >- KQL based content query that should be used for search. This property is defined only for APIs accessed using the /security query path and not the /privacy query path. nullable: true createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: Identity information for the entity that created the request. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the request was created. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true dataSubject: anyOf: - $ref: '#/components/schemas/microsoft.graph.dataSubject' - type: object nullable: true description: Information about the data subject. dataSubjectType: anyOf: - $ref: '#/components/schemas/microsoft.graph.dataSubjectType' - type: object nullable: true description: >- The type of the data subject. The possible values are: customer, currentEmployee, formerEmployee, prospectiveEmployee, student, teacher, faculty, other, unknownFutureValue. description: type: string description: Description for the request. nullable: true displayName: type: string description: The name of the request. nullable: true externalId: type: string description: >- The external ID for the request that is immutable after creation and is used for tracking the request for the external system. This property is defined only for APIs accessed using the /security query path and not the /privacy query path. nullable: true history: type: array items: $ref: >- #/components/schemas/microsoft.graph.subjectRightsRequestHistory description: Collection of history change events. includeAllVersions: type: boolean description: >- Include all versions of the documents. By default, the current copies of the documents are returned. If SharePoint sites have versioning enabled, including all versions includes the historical copies of the documents. This property is defined only for APIs accessed using the /security query path and not the /privacy query path. nullable: true includeAuthoredContent: type: boolean description: >- Include content authored by the data subject. This property is defined only for APIs accessed using the /security query path and not the /privacy query path. nullable: true insight: anyOf: - $ref: >- #/components/schemas/microsoft.graph.subjectRightsRequestDetail - type: object nullable: true description: Insight about the request. internalDueDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the request is internally due. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: >- Identity information for the entity that last modified the request. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the request was last modified. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true mailboxLocations: anyOf: - $ref: >- #/components/schemas/microsoft.graph.subjectRightsRequestMailboxLocation - type: object nullable: true description: >- The mailbox locations that should be searched. This property is defined only for APIs accessed using the /security query path and not the /privacy query path. pauseAfterEstimate: type: boolean description: >- Pause the request after estimate has finished. By default, the data estimate runs and then pauses, allowing you to preview results and then select the option to retrieve data in the UI. You can set this property to false if you want it to perform the estimate and then automatically begin with the retrieval of the content. This property is defined only for APIs accessed using the /security query path and not the /privacy query path. nullable: true regulations: type: array items: type: string nullable: true description: List of regulations that this request fulfill. siteLocations: anyOf: - $ref: >- #/components/schemas/microsoft.graph.subjectRightsRequestSiteLocation - type: object nullable: true description: >- The SharePoint and OneDrive site locations that should be searched. This property is defined only for APIs accessed using the /security query path and not the /privacy query path. stages: type: array items: $ref: >- #/components/schemas/microsoft.graph.subjectRightsRequestStageDetail description: Information about the different stages for the request. status: anyOf: - $ref: >- #/components/schemas/microsoft.graph.subjectRightsRequestStatus - type: object nullable: true description: >- The status of the request. The possible values are: active, closed, unknownFutureValue. type: anyOf: - $ref: >- #/components/schemas/microsoft.graph.subjectRightsRequestType - type: object nullable: true description: >- The type of the request. The possible values are: export, delete, access, tagForAction, unknownFutureValue. approvers: type: array items: $ref: '#/components/schemas/microsoft.graph.user' description: >- Collection of users who can approve the request. Currently only supported for requests of type delete. x-ms-navigationProperty: true collaborators: type: array items: $ref: '#/components/schemas/microsoft.graph.user' description: Collection of users who can collaborate on the request. x-ms-navigationProperty: true notes: type: array items: $ref: '#/components/schemas/microsoft.graph.authoredNote' description: List of notes associated with the request. x-ms-navigationProperty: true team: anyOf: - $ref: '#/components/schemas/microsoft.graph.team' - type: object nullable: true description: >- Information about the Microsoft Teams team that was created for the request. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.subjectRightsRequest' microsoft.graph.user: allOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - title: user required: - '@odata.type' type: object properties: aboutMe: type: string description: >- A freeform text entry field for the user to describe themselves. Returned only on $select. nullable: true accountEnabled: type: boolean description: >- true if the account is enabled; otherwise, false. This property is required when a user is created. Returned only on $select. Supports $filter (eq, ne, not, and in). nullable: true ageGroup: type: string description: >- Sets the age group of the user. Allowed values: null, Minor, NotAdult, and Adult. For more information, see legal age group property definitions. Returned only on $select. Supports $filter (eq, ne, not, and in). nullable: true assignedLicenses: type: array items: $ref: '#/components/schemas/microsoft.graph.assignedLicense' description: >- The licenses that are assigned to the user, including inherited (group-based) licenses. This property doesn't differentiate between directly assigned and inherited licenses. Use the licenseAssignmentStates property to identify the directly assigned and inherited licenses. Not nullable. Returned only on $select. Supports $filter (eq, not, /$count eq 0, /$count ne 0). assignedPlans: type: array items: $ref: '#/components/schemas/microsoft.graph.assignedPlan' description: >- The plans that are assigned to the user. Read-only. Not nullable. Returned only on $select. Supports $filter (eq and not). authorizationInfo: anyOf: - $ref: '#/components/schemas/microsoft.graph.authorizationInfo' - type: object nullable: true birthday: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The birthday of the user. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. Returned only on $select. format: date-time businessPhones: type: array items: type: string description: >- The telephone numbers for the user. NOTE: Although it's a string collection, only one number can be set for this property. Read-only for users synced from the on-premises directory. Returned by default. Supports $filter (eq, not, ge, le, startsWith). city: type: string description: >- The city where the user is located. Maximum length is 128 characters. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true companyName: type: string description: >- The name of the company that the user is associated with. This property can be useful for describing the company that a guest comes from. The maximum length is 64 characters.Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true consentProvidedForMinor: type: string description: >- Sets whether consent was obtained for minors. Allowed values: null, Granted, Denied, and NotRequired. For more information, see legal age group property definitions. Returned only on $select. Supports $filter (eq, ne, not, and in). nullable: true country: type: string description: >- The country or region where the user is located; for example, US or UK. Maximum length is 128 characters. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time the user was created, in ISO 8601 format and UTC. The value can't be modified and is automatically populated when the entity is created. Nullable. For on-premises users, the value represents when they were first created in Microsoft Entra ID. Property is null for some users created before June 2018 and on-premises users that were synced to Microsoft Entra ID before June 2018. Read-only. Returned only on $select. Supports $filter (eq, ne, not , ge, le, in). format: date-time nullable: true creationType: type: string description: >- Indicates whether the user account was created through one of the following methods: As a regular school or work account (null). As an external account (Invitation). As a local account for an Azure Active Directory B2C tenant (LocalAccount). Through self-service sign-up by an internal user using email verification (EmailVerified). Through self-service sign-up by a guest signing up through a link that is part of a user flow (SelfServiceSignUp). Read-only.Returned only on $select. Supports $filter (eq, ne, not, in). nullable: true customSecurityAttributes: anyOf: - $ref: >- #/components/schemas/microsoft.graph.customSecurityAttributeValue - type: object nullable: true description: >- An open complex type that holds the value of a custom security attribute that is assigned to a directory object. Nullable. Returned only on $select. Supports $filter (eq, ne, not, startsWith). The filter value is case-sensitive. To read this property, the calling app must be assigned the CustomSecAttributeAssignment.Read.All permission. To write this property, the calling app must be assigned the CustomSecAttributeAssignment.ReadWrite.All permissions. To read or write this property in delegated scenarios, the admin must be assigned the Attribute Assignment Administrator role. department: type: string description: >- The name of the department in which the user works. Maximum length is 64 characters. Returned only on $select. Supports $filter (eq, ne, not , ge, le, in, and eq on null values). nullable: true deviceEnrollmentLimit: maximum: 2147483647 minimum: -2147483648 type: number description: >- The limit on the maximum number of devices that the user is permitted to enroll. Allowed values are 5 or 1000. format: int32 displayName: type: string description: >- The name displayed in the address book for the user. This value is usually the combination of the user's first name, middle initial, and family name. This property is required when a user is created and it can't be cleared during updates. Maximum length is 256 characters. Returned by default. Supports $filter (eq, ne, not , ge, le, in, startsWith, and eq on null values), $orderby, and $search. nullable: true employeeHireDate: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the user was hired or will start work in a future hire. Returned only on $select. Supports $filter (eq, ne, not , ge, le, in). format: date-time nullable: true employeeId: type: string description: >- The employee identifier assigned to the user by the organization. The maximum length is 16 characters. Returned only on $select. Supports $filter (eq, ne, not , ge, le, in, startsWith, and eq on null values). nullable: true employeeLeaveDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the user left or will leave the organization. To read this property, the calling app must be assigned the User-LifeCycleInfo.Read.All permission. To write this property, the calling app must be assigned the User.Read.All and User-LifeCycleInfo.ReadWrite.All permissions. To read this property in delegated scenarios, the admin needs at least one of the following Microsoft Entra roles: Lifecycle Workflows Administrator (least privilege), Global Reader. To write this property in delegated scenarios, the admin needs the Global Administrator role. Supports $filter (eq, ne, not , ge, le, in). For more information, see Configure the employeeLeaveDateTime property for a user. format: date-time nullable: true employeeOrgData: anyOf: - $ref: '#/components/schemas/microsoft.graph.employeeOrgData' - type: object nullable: true description: >- Represents organization data (for example, division and costCenter) associated with a user. Returned only on $select. Supports $filter (eq, ne, not , ge, le, in). employeeType: type: string description: >- Captures enterprise worker type. For example, Employee, Contractor, Consultant, or Vendor. Returned only on $select. Supports $filter (eq, ne, not , ge, le, in, startsWith). nullable: true externalUserState: type: string description: >- For a guest invited to the tenant using the invitation API, this property represents the invited user's invitation status. For invited users, the state can be PendingAcceptance or Accepted, or null for all other users. Returned only on $select. Supports $filter (eq, ne, not , in). nullable: true externalUserStateChangeDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Shows the timestamp for the latest change to the externalUserState property. Returned only on $select. Supports $filter (eq, ne, not , in). format: date-time nullable: true faxNumber: type: string description: >- The fax number of the user. Returned only on $select. Supports $filter (eq, ne, not , ge, le, in, startsWith, and eq on null values). nullable: true givenName: type: string description: >- The given name (first name) of the user. Maximum length is 64 characters. Returned by default. Supports $filter (eq, ne, not , ge, le, in, startsWith, and eq on null values). nullable: true hireDate: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The hire date of the user. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. Returned only on $select. Note: This property is specific to SharePoint in Microsoft 365. We recommend using the native employeeHireDate property to set and update hire date values using Microsoft Graph APIs. format: date-time identities: type: array items: $ref: '#/components/schemas/microsoft.graph.objectIdentity' description: >- Represents the identities that can be used to sign in to this user account. Microsoft (also known as a local account), organizations, or social identity providers such as Facebook, Google, and Microsoft can provide identity and tie it to a user account. It might contain multiple items with the same signInType value. Returned only on $select. Supports $filter (eq) with limitations. imAddresses: type: array items: type: string nullable: true description: >- The instant message voice-over IP (VOIP) session initiation protocol (SIP) addresses for the user. Read-only. Returned only on $select. Supports $filter (eq, not, ge, le, startsWith). interests: type: array items: type: string nullable: true description: >- A list for the user to describe their interests. Returned only on $select. isManagementRestricted: type: boolean description: >- true if the user is a member of a restricted management administrative unit. If not set, the default value is null and the default behavior is false. Read-only. To manage a user who is a member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Returned only on $select. nullable: true isResourceAccount: type: boolean description: Don't use – reserved for future use. nullable: true jobTitle: type: string description: >- The user's job title. Maximum length is 128 characters. Returned by default. Supports $filter (eq, ne, not , ge, le, in, startsWith, and eq on null values). nullable: true lastPasswordChangeDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The time when this Microsoft Entra user last changed their password or when their password was created, whichever date the latest action was performed. The date and time information uses ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Returned only on $select. format: date-time nullable: true legalAgeGroupClassification: type: string description: >- Used by enterprise applications to determine the legal age group of the user. This property is read-only and calculated based on ageGroup and consentProvidedForMinor properties. Allowed values: null, Undefined, MinorWithOutParentalConsent, MinorWithParentalConsent, MinorNoParentalConsentRequired, NotAdult, and Adult. For more information, see legal age group property definitions. Returned only on $select. nullable: true licenseAssignmentStates: type: array items: $ref: '#/components/schemas/microsoft.graph.licenseAssignmentState' description: >- State of license assignments for this user. Also indicates licenses that are directly assigned or the user inherited through group memberships. Read-only. Returned only on $select. mail: type: string description: >- The SMTP address for the user, for example, jeff@contoso.com. Changes to this property update the user's proxyAddresses collection to include the value as an SMTP address. This property can't contain accent characters. NOTE: We don't recommend updating this property for Azure AD B2C user profiles. Use the otherMails property instead. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, endsWith, and eq on null values). nullable: true mailboxSettings: anyOf: - $ref: '#/components/schemas/microsoft.graph.mailboxSettings' - type: object nullable: true description: >- Settings for the primary mailbox of the signed-in user. You can get or update settings for sending automatic replies to incoming messages, locale, and time zone. Returned only on $select. mailNickname: type: string description: >- The mail alias for the user. This property must be specified when a user is created. Maximum length is 64 characters. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true mobilePhone: type: string description: >- The primary cellular telephone number for the user. Read-only for users synced from the on-premises directory. Maximum length is 64 characters. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values) and $search. nullable: true mySite: type: string description: The URL for the user's site. Returned only on $select. nullable: true officeLocation: type: string description: >- The office location in the user's place of business. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true onPremisesDistinguishedName: type: string description: >- Contains the on-premises Active Directory distinguished name or DN. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on $select. nullable: true onPremisesDomainName: type: string description: >- Contains the on-premises domainFQDN, also called dnsDomainName synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on $select. nullable: true onPremisesExtensionAttributes: anyOf: - $ref: >- #/components/schemas/microsoft.graph.onPremisesExtensionAttributes - type: object nullable: true description: >- Contains extensionAttributes1-15 for the user. These extension attributes are also known as Exchange custom attributes 1-15. Each attribute can store up to 1024 characters. For an onPremisesSyncEnabled user, the source of authority for this set of properties is the on-premises and is read-only. For a cloud-only user (where onPremisesSyncEnabled is false), these properties can be set during the creation or update of a user object. For a cloud-only user previously synced from on-premises Active Directory, these properties are read-only in Microsoft Graph but can be fully managed through the Exchange Admin Center or the Exchange Online V2 module in PowerShell. Returned only on $select. Supports $filter (eq, ne, not, in). onPremisesImmutableId: type: string description: >- This property is used to associate an on-premises Active Directory user account to their Microsoft Entra user object. This property must be specified when creating a new user account in the Graph if you're using a federated domain for the user's userPrincipalName (UPN) property. NOTE: The $ and _ characters can't be used when specifying this property. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in). nullable: true onPremisesLastSyncDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Indicates the last time at which the object was synced with the on-premises directory; for example: 2013-02-16T03:04:54Z. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in). format: date-time nullable: true onPremisesProvisioningErrors: type: array items: $ref: >- #/components/schemas/microsoft.graph.onPremisesProvisioningError description: >- Errors when using Microsoft synchronization product during provisioning. Returned only on $select. Supports $filter (eq, not, ge, le). onPremisesSamAccountName: type: string description: >- Contains the on-premises samAccountName synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith). nullable: true onPremisesSecurityIdentifier: type: string description: >- Contains the on-premises security identifier (SID) for the user that was synchronized from on-premises to the cloud. Read-only. Returned only on $select. Supports $filter (eq including on null values). nullable: true onPremisesSyncEnabled: type: boolean description: >- true if this user object is currently being synced from an on-premises Active Directory (AD); otherwise the user isn't being synced and can be managed in Microsoft Entra ID. Read-only. Returned only on $select. Supports $filter (eq, ne, not, in, and eq on null values). nullable: true onPremisesUserPrincipalName: type: string description: >- Contains the on-premises userPrincipalName synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith). nullable: true otherMails: type: array items: type: string description: >- A list of other email addresses for the user; for example: ['bob@contoso.com', 'Robert@fabrikam.com']. Can store up to 250 values, each with a limit of 250 characters. NOTE: This property can't contain accent characters. Returned only on $select. Supports $filter (eq, not, ge, le, in, startsWith, endsWith, /$count eq 0, /$count ne 0). passwordPolicies: type: string description: >- Specifies password policies for the user. This value is an enumeration with one possible value being DisableStrongPassword, which allows weaker passwords than the default policy to be specified. DisablePasswordExpiration can also be specified. The two might be specified together; for example: DisablePasswordExpiration, DisableStrongPassword. Returned only on $select. For more information on the default password policies, see Microsoft Entra password policies. Supports $filter (ne, not, and eq on null values). nullable: true passwordProfile: anyOf: - $ref: '#/components/schemas/microsoft.graph.passwordProfile' - type: object nullable: true description: >- Specifies the password profile for the user. The profile contains the user's password. This property is required when a user is created. The password in the profile must satisfy minimum requirements as specified by the passwordPolicies property. By default, a strong password is required. Returned only on $select. Supports $filter (eq, ne, not, in, and eq on null values). To update this property: User-PasswordProfile.ReadWrite.All is the least privileged permission to update this property. In delegated scenarios, the User Administrator Microsoft Entra role is the least privileged admin role supported to update this property for nonadmin users. Privileged Authentication Administrator is the least privileged role that's allowed to update this property for all administrators in the tenant. In general, the signed-in user must have a higher privileged administrator role as indicated in Who can reset passwords. In app-only scenarios, the calling app must be assigned a supported permission and at least the User Administrator Microsoft Entra role. pastProjects: type: array items: type: string nullable: true description: >- A list for the user to enumerate their past projects. Returned only on $select. postalCode: type: string description: >- The postal code for the user's postal address. The postal code is specific to the user's country or region. In the United States of America, this attribute contains the ZIP code. Maximum length is 40 characters. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true preferredDataLocation: type: string description: >- The preferred data location for the user. For more information, see OneDrive Online Multi-Geo. nullable: true preferredLanguage: type: string description: >- The preferred language for the user. The preferred language format is based on RFC 4646. The name is a combination of an ISO 639 two-letter lowercase culture code associated with the language, and an ISO 3166 two-letter uppercase subculture code associated with the country or region. Example: 'en-US', or 'es-ES'. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values) nullable: true preferredName: type: string description: >- The preferred name for the user. Not Supported. This attribute returns an empty string.Returned only on $select. nullable: true print: anyOf: - $ref: '#/components/schemas/microsoft.graph.userPrint' - type: object nullable: true provisionedPlans: type: array items: $ref: '#/components/schemas/microsoft.graph.provisionedPlan' description: >- The plans that are provisioned for the user. Read-only. Not nullable. Returned only on $select. Supports $filter (eq, not, ge, le). proxyAddresses: type: array items: type: string description: >- For example: ['SMTP: bob@contoso.com', 'smtp: bob@sales.contoso.com']. Changes to the mail property update this collection to include the value as an SMTP address. For more information, see mail and proxyAddresses properties. The proxy address prefixed with SMTP (capitalized) is the primary proxy address, while those addresses prefixed with smtp are the secondary proxy addresses. For Azure AD B2C accounts, this property has a limit of 10 unique addresses. Read-only in Microsoft Graph; you can update this property only through the Microsoft 365 admin center. Not nullable. Returned only on $select. Supports $filter (eq, not, ge, le, startsWith, endsWith, /$count eq 0, /$count ne 0). responsibilities: type: array items: type: string nullable: true description: >- A list for the user to enumerate their responsibilities. Returned only on $select. schools: type: array items: type: string nullable: true description: >- A list for the user to enumerate the schools they attended. Returned only on $select. securityIdentifier: type: string description: >- Security identifier (SID) of the user, used in Windows scenarios. Read-only. Returned by default. Supports $select and $filter (eq, not, ge, le, startsWith). nullable: true serviceProvisioningErrors: type: array items: $ref: '#/components/schemas/microsoft.graph.serviceProvisioningError' description: >- Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a user object. Supports $filter (eq, not, for isResolved and serviceInstance). showInAddressList: type: boolean description: >- Do not use in Microsoft Graph. Manage this property through the Microsoft 365 admin center instead. Represents whether the user should be included in the Outlook global address list. See Known issue. nullable: true signInActivity: anyOf: - $ref: '#/components/schemas/microsoft.graph.signInActivity' - type: object nullable: true description: >- Get the last signed-in date and request ID of the sign-in for a given user. Read-only.Returned only on $select. Supports $filter (eq, ne, not, ge, le) but not with any other filterable properties. Note: Details for this property require a Microsoft Entra ID P1 or P2 license and the AuditLog.Read.All permission.This property isn't returned for a user who never signed in or last signed in before April 2020. signInSessionsValidFromDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- Any refresh tokens or session tokens (session cookies) issued before this time are invalid. Applications get an error when using an invalid refresh or session token to acquire a delegated access token (to access APIs such as Microsoft Graph). If this happens, the application needs to acquire a new refresh token by requesting the authorized endpoint. Read-only. Use revokeSignInSessions to reset. Returned only on $select. format: date-time nullable: true skills: type: array items: type: string nullable: true description: >- A list for the user to enumerate their skills. Returned only on $select. state: type: string description: >- The state or province in the user's address. Maximum length is 128 characters. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true streetAddress: type: string description: >- The street address of the user's place of business. Maximum length is 1,024 characters. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true surname: type: string description: >- The user's surname (family name or last name). Maximum length is 64 characters. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true usageLocation: type: string description: >- A two-letter country code (ISO standard 3166). Required for users that are assigned licenses due to legal requirements to check for availability of services in countries/regions. Examples include: US, JP, and GB. Not nullable. Returned only on $select. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values). nullable: true userPrincipalName: type: string description: >- The user principal name (UPN) of the user. The UPN is an Internet-style sign-in name for the user based on the Internet standard RFC 822. By convention, this value should map to the user's email name. The general format is alias@domain, where the domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization.NOTE: This property can't contain accent characters. Only the following characters are allowed A - Z, a - z, 0 - 9, ' . - _ ! # ^ ~. For the complete list of allowed characters, see username policies. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, endsWith) and $orderby. nullable: true userType: type: string description: >- A string value that can be used to classify user types in your directory. The possible values are Member and Guest. Returned only on $select. Supports $filter (eq, ne, not, in, and eq on null values). NOTE: For more information about the permissions for members and guests, see What are the default user permissions in Microsoft Entra ID? nullable: true activities: type: array items: $ref: '#/components/schemas/microsoft.graph.userActivity' description: The user's activities across devices. Read-only. Nullable. x-ms-navigationProperty: true agreementAcceptances: type: array items: $ref: '#/components/schemas/microsoft.graph.agreementAcceptance' description: >- The user's terms of use acceptance statuses. Read-only. Nullable. x-ms-navigationProperty: true appRoleAssignments: type: array items: $ref: '#/components/schemas/microsoft.graph.appRoleAssignment' description: >- Represents the app roles a user is granted for an application. Supports $expand. x-ms-navigationProperty: true authentication: anyOf: - $ref: '#/components/schemas/microsoft.graph.authentication' - type: object nullable: true description: The authentication methods that are supported for the user. x-ms-navigationProperty: true calendar: anyOf: - $ref: '#/components/schemas/microsoft.graph.calendar' - type: object nullable: true description: The user's primary calendar. Read-only. x-ms-navigationProperty: true calendarGroups: type: array items: $ref: '#/components/schemas/microsoft.graph.calendarGroup' description: The user's calendar groups. Read-only. Nullable. x-ms-navigationProperty: true calendars: type: array items: $ref: '#/components/schemas/microsoft.graph.calendar' description: The user's calendars. Read-only. Nullable. x-ms-navigationProperty: true calendarView: type: array items: $ref: '#/components/schemas/microsoft.graph.event' description: The calendar view for the calendar. Read-only. Nullable. x-ms-navigationProperty: true chats: type: array items: $ref: '#/components/schemas/microsoft.graph.chat' x-ms-navigationProperty: true cloudClipboard: anyOf: - $ref: '#/components/schemas/microsoft.graph.cloudClipboardRoot' - type: object nullable: true x-ms-navigationProperty: true cloudPCs: type: array items: $ref: '#/components/schemas/microsoft.graph.cloudPC' description: The user's Cloud PCs. Read-only. Nullable. x-ms-navigationProperty: true contactFolders: type: array items: $ref: '#/components/schemas/microsoft.graph.contactFolder' description: The user's contacts folders. Read-only. Nullable. x-ms-navigationProperty: true contacts: type: array items: $ref: '#/components/schemas/microsoft.graph.contact' description: The user's contacts. Read-only. Nullable. x-ms-navigationProperty: true createdObjects: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: Directory objects that the user created. Read-only. Nullable. x-ms-navigationProperty: true dataSecurityAndGovernance: anyOf: - $ref: >- #/components/schemas/microsoft.graph.userDataSecurityAndGovernance - type: object nullable: true description: >- The data security and governance settings for the user. Read-only. Nullable. x-ms-navigationProperty: true deviceManagementTroubleshootingEvents: type: array items: $ref: >- #/components/schemas/microsoft.graph.deviceManagementTroubleshootingEvent description: The list of troubleshooting events for this user. x-ms-navigationProperty: true directReports: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The users and contacts that report to the user. (The users and contacts that have their manager property set to this user.) Read-only. Nullable. Supports $expand. x-ms-navigationProperty: true drive: anyOf: - $ref: '#/components/schemas/microsoft.graph.drive' - type: object nullable: true description: The user's OneDrive. Read-only. x-ms-navigationProperty: true drives: type: array items: $ref: '#/components/schemas/microsoft.graph.drive' description: A collection of drives available for this user. Read-only. x-ms-navigationProperty: true employeeExperience: anyOf: - $ref: '#/components/schemas/microsoft.graph.employeeExperienceUser' - type: object nullable: true x-ms-navigationProperty: true events: type: array items: $ref: '#/components/schemas/microsoft.graph.event' description: >- The user's events. Default is to show Events under the Default Calendar. Read-only. Nullable. x-ms-navigationProperty: true extensions: type: array items: $ref: '#/components/schemas/microsoft.graph.extension' description: >- The collection of open extensions defined for the user. Read-only. Supports $expand. Nullable. x-ms-navigationProperty: true followedSites: type: array items: $ref: '#/components/schemas/microsoft.graph.site' x-ms-navigationProperty: true inferenceClassification: anyOf: - $ref: '#/components/schemas/microsoft.graph.inferenceClassification' - type: object nullable: true description: >- Relevance classification of the user's messages based on explicit designations that override inferred relevance or importance. x-ms-navigationProperty: true insights: anyOf: - $ref: '#/components/schemas/microsoft.graph.itemInsights' - type: object nullable: true description: >- Represents relationships between a user and items such as OneDrive for work or school documents, calculated using advanced analytics and machine learning techniques. Read-only. Nullable. x-ms-navigationProperty: true joinedTeams: type: array items: $ref: '#/components/schemas/microsoft.graph.team' x-ms-navigationProperty: true licenseDetails: type: array items: $ref: '#/components/schemas/microsoft.graph.licenseDetails' description: A collection of this user's license details. Read-only. x-ms-navigationProperty: true mailFolders: type: array items: $ref: '#/components/schemas/microsoft.graph.mailFolder' description: The user's mail folders. Read-only. Nullable. x-ms-navigationProperty: true managedAppRegistrations: type: array items: $ref: '#/components/schemas/microsoft.graph.managedAppRegistration' description: Zero or more managed app registrations that belong to the user. x-ms-navigationProperty: true managedDevices: type: array items: $ref: '#/components/schemas/microsoft.graph.managedDevice' description: The managed devices associated with the user. x-ms-navigationProperty: true manager: anyOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - type: object nullable: true description: >- The user or contact that is this user's manager. Read-only. Supports $expand. x-ms-navigationProperty: true memberOf: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The groups and directory roles that the user is a member of. Read-only. Nullable. Supports $expand. x-ms-navigationProperty: true messages: type: array items: $ref: '#/components/schemas/microsoft.graph.message' description: The messages in a mailbox or folder. Read-only. Nullable. x-ms-navigationProperty: true oauth2PermissionGrants: type: array items: $ref: '#/components/schemas/microsoft.graph.oAuth2PermissionGrant' x-ms-navigationProperty: true onenote: anyOf: - $ref: '#/components/schemas/microsoft.graph.onenote' - type: object nullable: true x-ms-navigationProperty: true onlineMeetings: type: array items: $ref: '#/components/schemas/microsoft.graph.onlineMeeting' description: >- Information about a meeting, including the URL used to join a meeting, the attendees list, and the description. x-ms-navigationProperty: true outlook: anyOf: - $ref: '#/components/schemas/microsoft.graph.outlookUser' - type: object nullable: true x-ms-navigationProperty: true ownedDevices: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- Devices the user owns. Read-only. Nullable. Supports $expand and $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1). x-ms-navigationProperty: true ownedObjects: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- Directory objects the user owns. Read-only. Nullable. Supports $expand, $select nested in $expand, and $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1). x-ms-navigationProperty: true people: type: array items: $ref: '#/components/schemas/microsoft.graph.person' description: People that are relevant to the user. Read-only. Nullable. x-ms-navigationProperty: true permissionGrants: type: array items: $ref: >- #/components/schemas/microsoft.graph.resourceSpecificPermissionGrant description: List all resource-specific permission grants of a user. x-ms-navigationProperty: true photo: anyOf: - $ref: '#/components/schemas/microsoft.graph.profilePhoto' - type: object nullable: true description: The user's profile photo. Read-only. x-ms-navigationProperty: true photos: type: array items: $ref: '#/components/schemas/microsoft.graph.profilePhoto' description: >- The collection of the user's profile photos in different sizes. Read-only. x-ms-navigationProperty: true planner: anyOf: - $ref: '#/components/schemas/microsoft.graph.plannerUser' - type: object nullable: true description: >- Entry-point to the Planner resource that might exist for a user. Read-only. x-ms-navigationProperty: true presence: anyOf: - $ref: '#/components/schemas/microsoft.graph.presence' - type: object nullable: true x-ms-navigationProperty: true registeredDevices: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- Devices that are registered for the user. Read-only. Nullable. Supports $expand and returns up to 100 objects. x-ms-navigationProperty: true scopedRoleMemberOf: type: array items: $ref: '#/components/schemas/microsoft.graph.scopedRoleMembership' x-ms-navigationProperty: true settings: anyOf: - $ref: '#/components/schemas/microsoft.graph.userSettings' - type: object nullable: true x-ms-navigationProperty: true solutions: anyOf: - $ref: '#/components/schemas/microsoft.graph.userSolutionRoot' - type: object nullable: true description: >- The identifier that relates the user to the working time schedule triggers. Read-Only. Nullable x-ms-navigationProperty: true sponsors: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The users and groups responsible for this guest's privileges in the tenant and keeping the guest's information and access updated. (HTTP Methods: GET, POST, DELETE.). Supports $expand. x-ms-navigationProperty: true teamwork: anyOf: - $ref: '#/components/schemas/microsoft.graph.userTeamwork' - type: object nullable: true description: >- A container for Microsoft Teams features available for the user. Read-only. Nullable. x-ms-navigationProperty: true todo: anyOf: - $ref: '#/components/schemas/microsoft.graph.todo' - type: object nullable: true description: Represents the To Do services available to a user. x-ms-navigationProperty: true transitiveMemberOf: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: >- The groups, including nested groups, and directory roles that a user is a member of. Nullable. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.user' description: Represents a Microsoft Entra user account. x-ms-discriminator-value: '#microsoft.graph.user' microsoft.graph.mailboxSettings: title: mailboxSettings required: - '@odata.type' type: object properties: archiveFolder: type: string description: Folder ID of an archive folder for the user. nullable: true automaticRepliesSetting: anyOf: - $ref: '#/components/schemas/microsoft.graph.automaticRepliesSetting' - type: object nullable: true description: >- Configuration settings to automatically notify the sender of an incoming email with a message from the signed-in user. dateFormat: type: string description: The date format for the user's mailbox. nullable: true delegateMeetingMessageDeliveryOptions: anyOf: - $ref: >- #/components/schemas/microsoft.graph.delegateMeetingMessageDeliveryOptions - type: object nullable: true description: >- If the user has a calendar delegate, this specifies whether the delegate, mailbox owner, or both receive meeting messages and meeting responses. The possible values are: sendToDelegateAndInformationToPrincipal, sendToDelegateAndPrincipal, sendToDelegateOnly. language: anyOf: - $ref: '#/components/schemas/microsoft.graph.localeInfo' - type: object nullable: true description: >- The locale information for the user, including the preferred language and country/region. timeFormat: type: string description: The time format for the user's mailbox. nullable: true timeZone: type: string description: The default time zone for the user's mailbox. nullable: true userPurpose: anyOf: - $ref: '#/components/schemas/microsoft.graph.userPurpose' - type: object nullable: true description: >- The purpose of the mailbox. Differentiates a mailbox for a single user from a shared mailbox and equipment mailbox in Exchange Online. The possible values are: user, linked, shared, room, equipment, others, unknownFutureValue. Read-only. workingHours: anyOf: - $ref: '#/components/schemas/microsoft.graph.workingHours' - type: object nullable: true description: >- The days of the week and hours in a specific time zone that the user works. '@odata.type': type: string microsoft.graph.authoredNote: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: authoredNote required: - '@odata.type' type: object properties: author: anyOf: - $ref: '#/components/schemas/microsoft.graph.identity' - type: object nullable: true description: Identity information about the note's author. content: anyOf: - $ref: '#/components/schemas/microsoft.graph.itemBody' - type: object nullable: true description: The content of the note. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.authoredNote' microsoft.graph.team: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: team required: - '@odata.type' type: object properties: classification: type: string description: >- An optional label. Typically describes the data or business sensitivity of the team. Must match one of a preconfigured set in the tenant's directory. nullable: true createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Timestamp at which the team was created. format: date-time nullable: true description: type: string description: >- An optional description for the team. Maximum length: 1,024 characters. nullable: true displayName: type: string description: The name of the team. nullable: true firstChannelName: type: string description: >- The name of the first channel in the team. This is an optional property, only used during team creation and isn't returned in methods to get and list teams. nullable: true funSettings: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamFunSettings' - type: object nullable: true description: >- Settings to configure use of Giphy, memes, and stickers in the team. guestSettings: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamGuestSettings' - type: object nullable: true description: >- Settings to configure whether guests can create, update, or delete channels in the team. internalId: type: string description: >- A unique ID for the team that was used in a few places such as the audit log/Office 365 Management Activity API. nullable: true isArchived: type: boolean description: Whether this team is in read-only mode. nullable: true memberSettings: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamMemberSettings' - type: object nullable: true description: >- Settings to configure whether members can perform certain actions, for example, create channels and add bots, in the team. messagingSettings: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamMessagingSettings' - type: object nullable: true description: Settings to configure messaging and mentions in the team. specialization: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamSpecialization' - type: object nullable: true description: >- Optional. Indicates whether the team is intended for a particular use case. Each team specialization has access to unique behaviors and experiences targeted to its use case. summary: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamSummary' - type: object nullable: true description: >- Contains summary information about the team, including number of owners, members, and guests. tenantId: type: string description: The ID of the Microsoft Entra tenant. nullable: true visibility: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamVisibilityType' - type: object nullable: true description: The visibility of the group and team. Defaults to Public. webUrl: type: string description: >- A hyperlink that goes to the team in the Microsoft Teams client. You get this URL when you right-click a team in the Microsoft Teams client and select Get link to team. This URL should be treated as an opaque blob, and not parsed. nullable: true allChannels: type: array items: $ref: '#/components/schemas/microsoft.graph.channel' description: >- List of channels either hosted in or shared with the team (incoming channels). x-ms-navigationProperty: true channels: type: array items: $ref: '#/components/schemas/microsoft.graph.channel' description: >- The collection of channels and messages associated with the team. x-ms-navigationProperty: true group: anyOf: - $ref: '#/components/schemas/microsoft.graph.group' - type: object nullable: true x-ms-navigationProperty: true incomingChannels: type: array items: $ref: '#/components/schemas/microsoft.graph.channel' description: List of channels shared with the team. x-ms-navigationProperty: true installedApps: type: array items: $ref: '#/components/schemas/microsoft.graph.teamsAppInstallation' description: The apps installed in this team. x-ms-navigationProperty: true members: type: array items: $ref: '#/components/schemas/microsoft.graph.conversationMember' description: Members and owners of the team. x-ms-navigationProperty: true operations: type: array items: $ref: '#/components/schemas/microsoft.graph.teamsAsyncOperation' description: The async operations that ran or are running on this team. x-ms-navigationProperty: true permissionGrants: type: array items: $ref: >- #/components/schemas/microsoft.graph.resourceSpecificPermissionGrant description: A collection of permissions granted to apps to access the team. x-ms-navigationProperty: true photo: anyOf: - $ref: '#/components/schemas/microsoft.graph.profilePhoto' - type: object nullable: true description: The profile photo for the team. x-ms-navigationProperty: true primaryChannel: anyOf: - $ref: '#/components/schemas/microsoft.graph.channel' - type: object nullable: true description: The general channel for the team. x-ms-navigationProperty: true schedule: anyOf: - $ref: '#/components/schemas/microsoft.graph.schedule' - type: object nullable: true description: The schedule of shifts for this team. x-ms-navigationProperty: true tags: type: array items: $ref: '#/components/schemas/microsoft.graph.teamworkTag' description: The tags associated with the team. x-ms-navigationProperty: true template: anyOf: - $ref: '#/components/schemas/microsoft.graph.teamsTemplate' - type: object nullable: true description: >- The template this team was created from. See available templates. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.team' microsoft.graph.security.threatIntelligence: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: threatIntelligence required: - '@odata.type' type: object properties: articleIndicators: type: array items: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' description: >- Refers to indicators of threat or compromise highlighted in an article.Note: List retrieval is not yet supported. x-ms-navigationProperty: true articles: type: array items: $ref: '#/components/schemas/microsoft.graph.security.article' description: A list of article objects. x-ms-navigationProperty: true hostComponents: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' description: >- Retrieve details about hostComponent objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true hostCookies: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' description: >- Retrieve details about hostCookie objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true hostPairs: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostPair' description: >- Retrieve details about hostTracker objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true hostPorts: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostPort' description: >- Retrieve details about hostPort objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true hosts: type: array items: $ref: '#/components/schemas/microsoft.graph.security.host' description: >- Refers to host objects that Microsoft Threat Intelligence has observed.Note: List retrieval is not yet supported. x-ms-navigationProperty: true hostSslCertificates: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.hostSslCertificate description: >- Retrieve details about hostSslCertificate objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true hostTrackers: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' description: >- Retrieve details about hostTracker objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true intelligenceProfileIndicators: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfileIndicator x-ms-navigationProperty: true intelProfiles: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.intelligenceProfile description: A list of intelligenceProfile objects. x-ms-navigationProperty: true passiveDnsRecords: type: array items: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' description: >- Retrieve details about passiveDnsRecord objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true sslCertificates: type: array items: $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' description: >- Retrieve details about sslCertificate objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true subdomains: type: array items: $ref: '#/components/schemas/microsoft.graph.security.subdomain' description: >- Retrieve details about the subdomain.Note: List retrieval is not yet supported. x-ms-navigationProperty: true vulnerabilities: type: array items: $ref: '#/components/schemas/microsoft.graph.security.vulnerability' description: >- Retrieve details about vulnerabilities.Note: List retrieval is not yet supported. x-ms-navigationProperty: true whoisHistoryRecords: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.whoisHistoryRecord description: >- Retrieve details about whoisHistoryRecord objects.Note: List retrieval is not yet supported. x-ms-navigationProperty: true whoisRecords: type: array items: $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' description: A list of whoisRecord objects. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.threatIntelligence' microsoft.graph.security.articleIndicator: allOf: - $ref: '#/components/schemas/microsoft.graph.security.indicator' - title: articleIndicator required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.security.articleIndicator' x-ms-discriminator-value: '#microsoft.graph.security.articleIndicator' microsoft.graph.security.artifact: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: artifact required: - '@odata.type' type: object properties: '@odata.type': type: string discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.security.host': '#/components/schemas/microsoft.graph.security.host' '#microsoft.graph.security.hostname': '#/components/schemas/microsoft.graph.security.hostname' '#microsoft.graph.security.ipAddress': '#/components/schemas/microsoft.graph.security.ipAddress' '#microsoft.graph.security.hostComponent': '#/components/schemas/microsoft.graph.security.hostComponent' '#microsoft.graph.security.hostCookie': '#/components/schemas/microsoft.graph.security.hostCookie' '#microsoft.graph.security.hostSslCertificate': '#/components/schemas/microsoft.graph.security.hostSslCertificate' '#microsoft.graph.security.hostTracker': '#/components/schemas/microsoft.graph.security.hostTracker' '#microsoft.graph.security.passiveDnsRecord': '#/components/schemas/microsoft.graph.security.passiveDnsRecord' '#microsoft.graph.security.sslCertificate': '#/components/schemas/microsoft.graph.security.sslCertificate' '#microsoft.graph.security.unclassifiedArtifact': >- #/components/schemas/microsoft.graph.security.unclassifiedArtifact microsoft.graph.security.article: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: article required: - '@odata.type' type: object properties: body: $ref: '#/components/schemas/microsoft.graph.security.formattedContent' createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when this article was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time imageUrl: type: string description: >- URL of the header image for this article, used for display purposes. nullable: true isFeatured: type: boolean description: >- Indicates whether this article is currently featured by Microsoft. lastUpdatedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The most recent date and time when this article was updated. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time summary: $ref: '#/components/schemas/microsoft.graph.security.formattedContent' tags: type: array items: type: string nullable: true description: Tags for this article, communicating keywords, or key concepts. title: type: string description: The title of this article. indicators: type: array items: $ref: '#/components/schemas/microsoft.graph.security.articleIndicator' description: Indicators related to this article. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.article' microsoft.graph.security.hostComponent: allOf: - $ref: '#/components/schemas/microsoft.graph.security.artifact' - title: hostComponent required: - '@odata.type' type: object properties: category: type: string description: >- The type of component that was detected (for example, Operating System, Framework, Remote Access, or Server). nullable: true firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The first date and time when Microsoft Defender Threat Intelligence observed this web component. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The most recent date and time when Microsoft Defender Threat Intelligence observed this web component. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time name: type: string description: A name running on the artifact, for example, Microsoft IIS. version: type: string description: >- The component version running on the artifact, for example, v8.5. This shouldn't be assumed to be strictly numerical. nullable: true host: $ref: '#/components/schemas/microsoft.graph.security.host' '@odata.type': type: string default: '#microsoft.graph.security.hostComponent' x-ms-discriminator-value: '#microsoft.graph.security.hostComponent' microsoft.graph.security.host: allOf: - $ref: '#/components/schemas/microsoft.graph.security.artifact' - title: host required: - '@odata.type' type: object properties: firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The first date and time when this host was observed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The most recent date and time when this host was observed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true childHostPairs: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostPair' description: >- The hostPairs that are resources associated with a host, where that host is the parentHost and has an outgoing pairing to a childHost. x-ms-navigationProperty: true components: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostComponent' description: The hostComponents that are associated with this host. x-ms-navigationProperty: true cookies: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostCookie' description: The hostCookies that are associated with this host. x-ms-navigationProperty: true hostPairs: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostPair' description: >- The hostPairs that are associated with this host, where this host is either the parentHost or childHost. x-ms-navigationProperty: true parentHostPairs: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostPair' description: >- The hostPairs that are associated with a host, where that host is the childHost and has an incoming pairing with a parentHost. x-ms-navigationProperty: true passiveDns: type: array items: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' description: Passive DNS retrieval about this host. x-ms-navigationProperty: true passiveDnsReverse: type: array items: $ref: '#/components/schemas/microsoft.graph.security.passiveDnsRecord' description: Reverse passive DNS retrieval about this host. x-ms-navigationProperty: true ports: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostPort' description: The hostPorts associated with a host. x-ms-navigationProperty: true reputation: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.hostReputation' - type: object nullable: true description: Represents a calculated reputation of this host. x-ms-navigationProperty: true sslCertificates: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.hostSslCertificate description: The hostSslCertificates that are associated with this host. x-ms-navigationProperty: true subdomains: type: array items: $ref: '#/components/schemas/microsoft.graph.security.subdomain' description: The subdomains that are associated with this host. x-ms-navigationProperty: true trackers: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostTracker' description: The hostTrackers that are associated with this host. x-ms-navigationProperty: true whois: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.whoisRecord' - type: object nullable: true description: The most recent whoisRecord for this host. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.security.host' discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.security.hostname': '#/components/schemas/microsoft.graph.security.hostname' '#microsoft.graph.security.ipAddress': '#/components/schemas/microsoft.graph.security.ipAddress' microsoft.graph.security.hostCookie: allOf: - $ref: '#/components/schemas/microsoft.graph.security.artifact' - title: hostCookie required: - '@odata.type' type: object properties: domain: type: string description: The URI for which the cookie is valid. firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The first date and time when this hostCookie was observed by Microsoft Defender Threat Intelligence. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The most recent date and time when this hostCookie was observed by Microsoft Defender Threat Intelligence. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time name: type: string description: >- The name of the cookie, for example, JSESSIONID or SEARCH_NAMESITE. host: $ref: '#/components/schemas/microsoft.graph.security.host' '@odata.type': type: string default: '#microsoft.graph.security.hostCookie' x-ms-discriminator-value: '#microsoft.graph.security.hostCookie' microsoft.graph.security.hostPair: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: hostPair required: - '@odata.type' type: object properties: firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when Microsoft Defender Threat Intelligence first observed the hostPair. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when Microsoft Defender Threat Intelligence last observed the hostPair. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true linkKind: type: string description: The reason that two hosts are identified as hostPair. nullable: true childHost: $ref: '#/components/schemas/microsoft.graph.security.host' parentHost: $ref: '#/components/schemas/microsoft.graph.security.host' '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.hostPair' microsoft.graph.security.hostPort: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: hostPort required: - '@odata.type' type: object properties: banners: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hostPortBanner' description: The hostPortBanners retrieved from scanning the port. firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The first date and time when Microsoft Defender Threat Intelligence observed the hostPort. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time nullable: true lastScanDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The last date and time when Microsoft Defender Threat Intelligence scanned the hostPort. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time nullable: true lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The last date and time when Microsoft Defender Threat Intelligence observed the hostPort. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time nullable: true port: maximum: 2147483647 minimum: -2147483648 type: number description: >- The numerical identifier of the port which is standardized across the internet. format: int32 protocol: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.hostPortProtocol - type: object nullable: true description: >- The general protocol used to scan the port. The possible values are: tcp, udp, unknownFutureValue. services: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.hostPortComponent description: The hostPortComponents retrieved from scanning the port. status: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.hostPortStatus' - type: object nullable: true description: >- The status of the port. The possible values are: open, filtered, closed, unknownFutureValue. timesObserved: maximum: 2147483647 minimum: -2147483648 type: number description: >- The total amount of times that Microsoft Defender Threat Intelligence has observed the hostPort in all its scans. format: int32 nullable: true host: $ref: '#/components/schemas/microsoft.graph.security.host' mostRecentSslCertificate: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' - type: object nullable: true description: The most recent sslCertificate used to communicate on the port. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.hostPort' microsoft.graph.security.sslCertificate: allOf: - $ref: '#/components/schemas/microsoft.graph.security.artifact' - title: sslCertificate required: - '@odata.type' type: object properties: expirationDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when a certificate expires. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true fingerprint: type: string description: A hash of the certificate calculated on the data and signature. nullable: true firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The first date and time when this sslCertificate was observed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true issueDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when a certificate was issued. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true issuer: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.sslCertificateEntity - type: object nullable: true description: The entity that grants this certificate. lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The most recent date and time when this sslCertificate was observed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true serialNumber: type: string description: The serial number associated with an SSL certificate. nullable: true sha1: type: string description: >- A SHA-1 hash of the certificate. Note: This is not the signature. nullable: true subject: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.sslCertificateEntity - type: object nullable: true description: The person, site, machine, and so on, this certificate is for. relatedHosts: type: array items: $ref: '#/components/schemas/microsoft.graph.security.host' description: The host resources related with this sslCertificate. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.security.sslCertificate' x-ms-discriminator-value: '#microsoft.graph.security.sslCertificate' microsoft.graph.security.passiveDnsRecord: allOf: - $ref: '#/components/schemas/microsoft.graph.security.artifact' - title: passiveDnsRecord required: - '@odata.type' type: object properties: collectedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time that this passiveDnsRecord entry was collected by Microsoft. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when this passiveDnsRecord entry was first seen. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when this passiveDnsRecord entry was most recently seen. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time recordType: type: string description: The DNS record type for this passiveDnsRecord entry. artifact: $ref: '#/components/schemas/microsoft.graph.security.artifact' parentHost: $ref: '#/components/schemas/microsoft.graph.security.host' '@odata.type': type: string default: '#microsoft.graph.security.passiveDnsRecord' x-ms-discriminator-value: '#microsoft.graph.security.passiveDnsRecord' microsoft.graph.security.hostReputation: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: hostReputation required: - '@odata.type' type: object properties: classification: $ref: >- #/components/schemas/microsoft.graph.security.hostReputationClassification rules: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.hostReputationRule description: >- A collection of rules that have been used to calculate the classification and score. score: maximum: 2147483647 minimum: -2147483648 type: number description: >- The calculated score (0-100) of the requested host. A higher value indicates that this host is more likely to be suspicious or malicious. format: int32 '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.hostReputation' microsoft.graph.security.subdomain: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: subdomain required: - '@odata.type' type: object properties: firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when Microsoft Defender Threat Intelligence first observed the subdomain. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true host: $ref: '#/components/schemas/microsoft.graph.security.host' '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.subdomain' microsoft.graph.security.hostTracker: allOf: - $ref: '#/components/schemas/microsoft.graph.security.artifact' - title: hostTracker required: - '@odata.type' type: object properties: firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The first date and time when this hostTracker was observed by Microsoft Defender Threat Intelligence. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time kind: type: string description: >- The kind of hostTracker that was detected. For example, GoogleAnalyticsID or JarmHash. lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The most recent date and time when this hostTracker was observed by Microsoft Defender Threat Intelligence. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z. format: date-time value: type: string description: The identification value for the hostTracker. host: $ref: '#/components/schemas/microsoft.graph.security.host' '@odata.type': type: string default: '#microsoft.graph.security.hostTracker' x-ms-discriminator-value: '#microsoft.graph.security.hostTracker' microsoft.graph.security.whoisRecord: allOf: - $ref: '#/components/schemas/microsoft.graph.security.whoisBaseRecord' - title: whoisRecord required: - '@odata.type' type: object properties: history: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.whoisHistoryRecord description: >- The collection of historical records associated to this WHOIS object. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.security.whoisRecord' x-ms-discriminator-value: '#microsoft.graph.security.whoisRecord' microsoft.graph.security.hostSslCertificate: allOf: - $ref: '#/components/schemas/microsoft.graph.security.artifact' - title: hostSslCertificate required: - '@odata.type' type: object properties: firstSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The first date and time when this hostSslCertificate was observed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true lastSeenDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The most recent date and time when this hostSslCertificate was observed. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time nullable: true ports: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.hostSslCertificatePort description: The ports related with this hostSslCertificate. host: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.host' - type: object nullable: true description: The host for this hostSslCertificate. x-ms-navigationProperty: true sslCertificate: anyOf: - $ref: '#/components/schemas/microsoft.graph.security.sslCertificate' - type: object nullable: true description: The sslCertificate for this hostSslCertificate. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.security.hostSslCertificate' x-ms-discriminator-value: '#microsoft.graph.security.hostSslCertificate' microsoft.graph.security.vulnerability: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: vulnerability required: - '@odata.type' type: object properties: activeExploitsObserved: type: boolean description: >- Indicates whether this vulnerability has any known exploits associated to known bad actors. commonWeaknessEnumerationIds: type: array items: type: string description: Community-defined common weakness enumerations (CWE). createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when this vulnerability article was first created. format: date-time cvss2Summary: $ref: '#/components/schemas/microsoft.graph.security.cvssSummary' cvss3Summary: $ref: '#/components/schemas/microsoft.graph.security.cvssSummary' description: $ref: '#/components/schemas/microsoft.graph.security.formattedContent' exploits: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hyperlink' description: Known exploits for this vulnerability. exploitsAvailable: type: boolean description: >- Indicates whether this vulnerability has exploits in public sources (such as Packetstorm or Exploit-DB) online. hasChatter: type: boolean description: >- Indicates whether chatter about this vulnerability has been discovered online. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: >- The date and time when this vulnerability article was most recently updated. format: date-time priorityScore: maximum: 2147483647 minimum: -2147483648 type: number description: >- A unique algorithm that reflects the priority of a vulnerability based on the CVSS score, exploits, chatter, and linkage to malware. This property also evaluates the recency of these components so users can understand which vulnerability should be remediated first. format: int32 publishedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date and time when this vulnerability article was published. format: date-time references: type: array items: $ref: '#/components/schemas/microsoft.graph.security.hyperlink' description: >- Reference links where further information can be learned about this vulnerability. remediation: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.formattedContent - type: object nullable: true description: Any known remediation steps. severity: $ref: >- #/components/schemas/microsoft.graph.security.vulnerabilitySeverity articles: type: array items: $ref: '#/components/schemas/microsoft.graph.security.article' description: Articles related to this vulnerability. x-ms-navigationProperty: true components: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.vulnerabilityComponent description: Components related to this vulnerability article. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.vulnerability' microsoft.graph.security.whoisHistoryRecord: allOf: - $ref: '#/components/schemas/microsoft.graph.security.whoisBaseRecord' - title: whoisHistoryRecord required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.security.whoisHistoryRecord' x-ms-discriminator-value: '#microsoft.graph.security.whoisHistoryRecord' microsoft.graph.security.triggersRoot: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: triggersRoot required: - '@odata.type' type: object properties: retentionEvents: type: array items: $ref: '#/components/schemas/microsoft.graph.security.retentionEvent' x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.triggersRoot' microsoft.graph.security.retentionEvent: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: retentionEvent required: - '@odata.type' type: object properties: createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user who created the retentionEvent. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date time when the retentionEvent was created. format: date-time nullable: true description: type: string description: Optional information about the event. nullable: true displayName: type: string description: Name of the event. nullable: true eventPropagationResults: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.eventPropagationResult description: >- Represents the success status of a created event and additional information. eventQueries: type: array items: $ref: '#/components/schemas/microsoft.graph.security.eventQuery' description: >- Represents the workload (SharePoint Online, OneDrive for Business, Exchange Online) and identification information associated with a retention event. eventStatus: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.retentionEventStatus - type: object nullable: true description: >- Status of event propogation to the scoped locations after the event has been created. eventTriggerDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Optional time when the event should be triggered. format: date-time nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user who last modified the retentionEvent. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The latest date time when the retentionEvent was modified. format: date-time nullable: true lastStatusUpdateDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Last time the status of the event was updated. format: date-time nullable: true retentionEventType: anyOf: - $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType - type: object nullable: true description: >- Specifies the event that will start the retention period for labels that use this event type when an event is created. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.retentionEvent' microsoft.graph.security.triggerTypesRoot: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: triggerTypesRoot required: - '@odata.type' type: object properties: retentionEventTypes: type: array items: $ref: >- #/components/schemas/microsoft.graph.security.retentionEventType x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.triggerTypesRoot' microsoft.graph.security.retentionEventType: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: retentionEventType required: - '@odata.type' type: object properties: createdBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user who created the retentionEventType. createdDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date time when the retentionEventType was created. format: date-time nullable: true description: type: string description: Optional information about the event type. nullable: true displayName: type: string description: Name of the event type. nullable: true lastModifiedBy: anyOf: - $ref: '#/components/schemas/microsoft.graph.identitySet' - type: object nullable: true description: The user who last modified the retentionEventType. lastModifiedDateTime: pattern: >- ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The latest date time when the retentionEventType was modified. format: date-time nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.security.retentionEventType' parameters: top: name: $top in: query description: Show only the first n items style: form explode: false schema: minimum: 0 type: integer example: 50 skip: name: $skip in: query description: Skip the first n items style: form explode: false schema: minimum: 0 type: integer search: name: $search in: query description: Search items by search phrases style: form explode: false schema: type: string filter: name: $filter in: query description: Filter items by property values style: form explode: false schema: type: string count: name: $count in: query description: Include count of items style: form explode: false schema: type: boolean examples: {} responses: error: description: error content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.ODataErrors.ODataError' microsoft.graph.alertCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.alertCollectionResponse' ODataCountResponse: description: The count of the resource content: text/plain: schema: $ref: '#/components/schemas/ODataCountResponse' microsoft.graph.landingPageCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.landingPageCollectionResponse' microsoft.graph.loginPageCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.loginPageCollectionResponse' microsoft.graph.payloadCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.payloadCollectionResponse' microsoft.graph.simulationCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.simulationCollectionResponse' microsoft.graph.trainingCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.trainingCollectionResponse' microsoft.graph.secureScoreCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.secureScoreCollectionResponse' microsoft.graph.userCollectionResponse: description: Retrieved collection content: application/json: schema: $ref: '#/components/schemas/microsoft.graph.userCollectionResponse' tags: - name: reports.securityReportsRoot - name: Security.alert - name: security.attackSimulationRoot - name: security.casesRoot - name: security.identityContainer - name: Security.incident - name: security.labelsRoot - name: security.secureScore - name: security.secureScoreControlProfile - name: Security.security - name: security.security.Actions - name: security.subjectRightsRequest - name: security.tenantDataSecurityAndGovernance - name: security.threatIntelligence - name: security.triggersRoot - name: security.triggerTypesRoot