@azure/arm-securityinsight package

Represents AAD (Azure Active Directory) requirements check request.

AAD (Azure Active Directory) requirements check properties.

Represents AAD (Azure Active Directory) data connector.

AAD (Azure Active Directory) data connector properties.

Represents ASC (Azure Security Center) requirements check request.

Represents ASC (Azure Security Center) data connector.

ASC (Azure Security Center) data connector properties.

Represents AATP (Azure Advanced Threat Protection) requirements check request.

AATP (Azure Advanced Threat Protection) requirements check properties.

Represents AATP (Azure Advanced Threat Protection) data connector.

AATP (Azure Advanced Threat Protection) data connector properties.

Represents an account entity.

Account entity property bag.

Action property bag base.

Action for alert rule.

Action property bag.

Action for alert rule.

Action property bag.

Interface representing a Actions.

Optional parameters.

Optional parameters.

Optional parameters.

List all the actions.

Optional parameters.

Optional parameters.

Represents Activity entity query.

The Activity query definitions

Represents Activity entity query.

Represents Activity entity query.

The Activity query definitions

Represents Activity timeline item.

Settings for how to dynamically override alert static details

Alert rule.

Alert rule template.

alert rule template data sources

Base alert rule template property bag.

Alert rule template with MITRE property bag.

Interface representing a AlertRuleTemplates.

Optional parameters.

List all the alert rule templates.

Optional parameters.

Optional parameters.

Interface representing a AlertRules.

Optional parameters.

Optional parameters.

Optional parameters.

List all the alert rules.

Optional parameters.

Optional parameters.

Alerts data type for data connectors.

Settings with single toggle.

Represents Anomaly Security ML Analytics Settings

Represents anomaly timeline item.

An azure resource object with an Etag property

Describes an automation rule action.

Describes an automation rule condition.

Describes an automation rule action to modify an object's properties

Describes an automation rule action to run a playbook

Describes automation rule triggering logic.

Interface representing a AutomationRules.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Connector Availability Status

Amazon Web Services CloudTrail requirements check request.

Represents Amazon Web Services CloudTrail data connector.

The available data types for Amazon Web Services CloudTrail data connector.

Logs data type.

Amazon Web Services S3 requirements check request.

Represents Amazon Web Services S3 data connector.

The available data types for Amazon Web Services S3 data connector.

Logs data type.

Resources created in Azure DevOps repository.

Represents an azure resource entity.

AzureResource entity property bag.

Represents a bookmark in Azure Security Insights.

Describes the entity mappings of a single entity

Optional parameters.

The parameters required to execute an expand operation on the given bookmark.

The entity expansion result operation response.

The expansion result values.

List all the bookmarks.

Interface representing a BookmarkOperations.

Interface representing a BookmarkRelations.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Represents bookmark timeline item.

Interface representing a Bookmarks.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Describes an automation rule condition that applies a boolean operator (e.g AND, OR) to conditions

Information on the client (user or application) that made some action

Represents a cloud application entity.

CloudApplication entity property bag.

Error response structure.

Error details.

Represents Codeless API Polling data connector.

Describe the authentication properties needed to successfully authenticate with the server

Config to describe the polling config for API poller connector

Describe the properties needed to make a pagination call

Describe the request properties needed to successfully pull from the server

Describes the response from the external server

Config to describe the instructions blade

Setting for the connector check connectivity

Data type for last data received

The graph query to show the current data status

Instruction steps to enable the connector

The sample queries for the connector

Represents Codeless UI data connector.

Expansion result connected entities

Setting for the connector check connectivity

Instruction step details

The mapping of content type to a repo path.

Specific entity query that supports put requests.

Customs permissions required for the connector

Customs permissions required for the connector

Data connector

Represents Codeless API Polling data connector.

Common field for data type in data connectors.

List all the data connectors.

Data connector requirements status.

Properties data connector on tenant level.

Data connector properties.

Interface representing a DataConnectors.

Data connector requirements properties.

Interface representing a DataConnectorsCheckRequirementsOperations.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

The data type definition

Description about a deployment.

Information regarding a deployment.

Represents a dns entity.

Dns entity property bag.

Interface representing a DomainWhois.

Optional parameters.

Represents Dynamics365 requirements check request.

Dynamics365 requirements check properties.

Represents Dynamics365 data connector.

The available data types for Dynamics365 data connector.

Common Data Service data type connection.

Dynamics365 data connector properties.

Whois information for a given domain and associated metadata

An individual contact associated with this domain

The set of contacts associated with this domain

The whois record for a given domain

The registrar associated with this domain

Geodata information for a given IP address

Interface representing a Entities.

Optional parameters.

Optional parameters.

Optional parameters.

Interface representing a EntitiesGetTimeline.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Interface representing a EntitiesRelations.

Optional parameters.

Optional parameters.

Specific entity.

Settings with single toggle.

Entity common property bag.

The edge that connects the entity to the other entity.

The parameters required to execute an expand operation on the given entity.

The entity expansion result operation response.

The expansion result values.

Map identifiers of a single entity

The parameters required to execute insights operation on the given entity.

The Get Insights result operation response.

Entity insight Item.

The Time interval that the query actually executed on.

List of all the entities.

Single entity mapping for the alert rule

Interface representing a EntityQueries.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Specific entity query.

An abstract Query item for entity

An properties abstract Query item for entity

List of all the entity queries.

Specific entity query template.

List of all the entity query templates.

Interface representing a EntityQueryTemplates.

Optional parameters.

Optional parameters.

Optional parameters.

Interface representing a EntityRelations.

Optional parameters.

Entity timeline Item.

The parameters required to execute s timeline operation on the given entity.

The entity timeline result operation response.

Event grouping settings property bag.

Represents Expansion entity query.

Information of a specific aggregation in the expansion result.

Expansion result metadata.

Settings with single toggle.

A single field mapping of the mapped entity

Represents a file entity.

File entity property bag.

Represents a file hash entity.

FileHash entity property bag.

Represents a file import in Azure Security Insights.

List all the file imports.

Interface representing a FileImports.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Represents a file.

Represents Fusion alert rule.

Represents Fusion alert rule template.

Represents a Fusion scenario exclusion patterns in Fusion detection.

Represents a supported source signal configuration in Fusion detection.

Represents a supported source subtype configuration under a source signal in Fusion detection.

Represents severity configuration for a source subtype consumed in Fusion detection.

Represents a Severity filter setting for a given source subtype consumed in Fusion detection.

Represents a source signal consumed in Fusion detection.

Represents a source subtype under a source signal consumed in Fusion detection.

Represents severity configurations available for a source subtype consumed in Fusion detection.

The geo-location context attached to the ip entity

GetInsights Query Errors.

Get Insights result metadata.

Retrieve queries for entity result operation response.

Resources created in GitHub repository.

The graph query to show the current data status

Grouping configuration property bag.

Represents a host entity.

Host entity property bag.

Represents a Hunting bookmark entity.

Describes bookmark properties

Interface representing a IPGeodata.

Optional parameters.

Represents an incident in Azure Security Insights.

Incident additional data property bag.

List of incident alerts.

List of incident bookmarks.

Represents an incident comment

List of incident comments.

Interface representing a IncidentComments.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Incident Configuration property bag.

The incident related entities response.

Information of a specific aggregation in the incident related entities result.

Describes related incident information for the bookmark

Represents an incident label

List all the incidents.

Information on the user an incident is assigned to

Interface representing a IncidentRelations.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Interface representing a Incidents.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Represents Insight Query.

Represents Insight Query.

The activity query definitions.

The insight chart query.

The insight chart query.

The insight table query.

Query results for table insights query.

Instruction steps to enable the connector

Instruction step details

Represents IoT requirements check request.

Represents IoT data connector.

IoT data connector properties.

Represents an IoT device entity.

IoTDevice entity property bag.

Represents an ip entity.

Ip entity property bag.

Data type for last data received

Represents MLBehaviorAnalytics alert rule.

Represents MLBehaviorAnalytics alert rule template.

MLBehaviorAnalytics alert rule template properties.

MTP (Microsoft Threat Protection) requirements check properties.

Represents MTP (Microsoft Threat Protection) data connector.

The available data types for Microsoft Threat Protection Platforms data connector.

Data type for Microsoft Threat Protection Platforms data connector.

MTP (Microsoft Threat Protection) data connector properties.

Represents a mail cluster entity.

Mail cluster entity property bag.

Represents a mail message entity.

Mail message entity property bag.

Represents a mailbox entity.

Mailbox entity property bag.

Represents a malware entity.

Malware entity property bag.

Represents MCAS (Microsoft Cloud App Security) requirements check request.

MCAS (Microsoft Cloud App Security) requirements check properties.

Represents MCAS (Microsoft Cloud App Security) data connector.

The available data types for MCAS (Microsoft Cloud App Security) data connector.

MCAS (Microsoft Cloud App Security) data connector properties.

Represents MDATP (Microsoft Defender Advanced Threat Protection) requirements check request.

MDATP (Microsoft Defender Advanced Threat Protection) requirements check properties.

Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.

MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.

Interface representing a Metadata.

Publisher or creator of the content item.

ies for the solution content item

Optional parameters.

Optional parameters.

Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.

Optional parameters.

List of all the metadata.

Optional parameters.

Optional parameters.

Metadata resource definition.

Metadata patch request body.

The original source of the content item, where it comes from.

Support information for the content item.

Optional parameters.

Represents MicrosoftSecurityIncidentCreation rule.

MicrosoftSecurityIncidentCreation rule common property bag.

MicrosoftSecurityIncidentCreation rule property bag.

Represents MicrosoftSecurityIncidentCreation rule template.

MicrosoftSecurityIncidentCreation rule template properties

Represents Microsoft Threat Intelligence requirements check request.

Microsoft Threat Intelligence requirements check properties.

Represents Microsoft Threat Intelligence data connector.

The available data types for Microsoft Threat Intelligence Platforms data connector.

Data type for Microsoft Threat Intelligence Platforms data connector.

Data type for Microsoft Threat Intelligence Platforms data connector.

Microsoft Threat Intelligence data connector properties.

Represents MTP (Microsoft Threat Protection) requirements check request.

Represents an network interface entity.

Nic entity property bag.

Represents NRT alert rule.

Represents NRT alert rule template.

NRT alert rule template properties

Represents Office365 Project requirements check request.

Office365 Project requirements check properties.

The available data types for Office Microsoft Project data connector.

Logs data type.

Represents Office Microsoft Project data connector.

Office Microsoft Project data connector properties.

Represents OfficeATP (Office 365 Advanced Threat Protection) requirements check request.

OfficeATP (Office 365 Advanced Threat Protection) requirements check properties.

Represents OfficeATP (Office 365 Advanced Threat Protection) data connector.

OfficeATP (Office 365 Advanced Threat Protection) data connector properties.

Consent for Office365 tenant that already made.

List of all the office365 consents.

Interface representing a OfficeConsents.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Represents office data connector.

The available data types for office data connector.

Exchange data type connection.

SharePoint data type connection.

Teams data type connection.

Office data connector properties.

Represents OfficeIRM (Microsoft Insider Risk Management) requirements check request.

OfficeIRM (Microsoft Insider Risk Management) requirements check properties.

Represents OfficeIRM (Microsoft Insider Risk Management) data connector.

OfficeIRM (Microsoft Insider Risk Management) data connector properties.

Represents Office PowerBI requirements check request.

Office PowerBI requirements check properties.

The available data types for Office Microsoft PowerBI data connector.

Logs data type.

Represents Office Microsoft PowerBI data connector.

Office Microsoft PowerBI data connector properties.

Operation provided by provider

Properties of the operation

Interface representing a Operations.

Lists the operations available in the SecurityInsights RP.

Optional parameters.

Optional parameters.

Permissions required for the connector

Customs permissions required for the connector

Resource provider permissions required for the connector

Represents a process entity.

Process entity property bag.

Interface representing a ProductSettings.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Describes an automation rule condition that evaluates an array property's value change

Describes an automation rule condition that evaluates an array property's value

Describes an automation rule condition that evaluates a property's value change

Describes an automation rule condition that evaluates a property's value

Query based alert rule template base property bag.

Represents a registry key entity.

RegistryKey entity property bag.

Represents a registry value entity.

RegistryValue entity property bag.

Represents a relation between two resources

List of relations.

Represents a repository.

List all the source controls.

metadata of a repository.

Resources created in user's repository for the source-control.

Required permissions for the connector

Common fields that are returned in the response for all Azure Resource Manager resources

Resource provider permissions required for the connector

An azure resource object with an Etag property

The sample queries for the connector

Represents scheduled alert rule.

Scheduled alert rule template property bag.

Scheduled alert rule base property bag.

Represents scheduled alert rule template.

Represents a security alert entity.

SecurityAlert entity property bag.

confidence reason item

Represents security alert timeline item.

Represents a security group entity.

SecurityGroup entity property bag.

Optional parameters.

Security ML Analytics Setting

Interface representing a SecurityMLAnalyticsSettings.

Optional parameters.

security ml analytics settings data sources

Optional parameters.

Optional parameters.

List all the SecurityMLAnalyticsSettings

Optional parameters.

Optional parameters.

Sentinel onboarding state

Interface representing a SentinelOnboardingStates.

Optional parameters.

Optional parameters.

Optional parameters.

List of the Sentinel onboarding states

Optional parameters.

List of all the settings.

The Setting.

Represents a SourceControl in Azure Security Insights.

List all the source controls.

Optional parameters.

Optional parameters.

Interface representing a SourceControlOperations.

Interface representing a SourceControls.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Represents a submission mail entity.

Submission mail entity property bag.

Metadata pertaining to creation and last modification of the resource.

Threat Intelligence Platforms data connector check requirements

Threat Intelligence Platforms data connector required properties.

Represents threat intelligence data connector.

The available data types for TI (Threat Intelligence) data connector.

Data type for indicators connection.

TI (Threat Intelligence) data connector properties.

Describes team information

Describes team properties

ThreatIntelligence property bag.

Represents Threat Intelligence alert rule.

Represents Threat Intelligence alert rule template.

Threat Intelligence alert rule template properties

Array of tags to be appended to the threat intelligence indicator.

Describes external reference

Filtering criteria for querying threat intelligence indicators.

Describes threat granular marking model entity

Interface representing a ThreatIntelligenceIndicator.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Interface representing a ThreatIntelligenceIndicatorMetrics.

Optional parameters.

Threat intelligence indicator entity.

Describes threat intelligence entity properties

Optional parameters.

Optional parameters.

Optional parameters.

Interface representing a ThreatIntelligenceIndicators.

Optional parameters.

Optional parameters.

Threat intelligence information object.

List of all the threat intelligence information objects.

Describes threat kill chain phase entity

Describes threat intelligence metric

Describes threat intelligence metric entity

Threat intelligence metrics.

List of all the threat intelligence metric fields (type/threat type/source).

Describes parsed pattern entity

Describes threat kill chain phase entity

List of available columns for sorting

Threat Intelligence TAXII data connector check requirements

Threat Intelligence TAXII data connector required properties.

Data connector to pull Threat intelligence data from TAXII 2.0/2.1 server

The available data types for Threat Intelligence TAXII data connector.

Data type for TAXII connector.

Threat Intelligence TAXII data connector properties.

timeline aggregation information per kind

Timeline Query Errors.

Expansion result metadata.

Settings with single toggle.

Represents a url entity.

Url entity property bag.

User information that made some action

Describes an error encountered in the file during validation.

Represents a Watchlist in Azure Security Insights.

Represents a Watchlist item in Azure Security Insights.

List all the watchlist items.

Interface representing a WatchlistItems.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

List all the watchlists.

Interface representing a Watchlists.

Defines headers for Watchlists_createOrUpdate operation.

Optional parameters.

Defines headers for Watchlists_delete operation.

Optional parameters.

Optional parameters.

Optional parameters.

Optional parameters.

Detail about the webhook object.

Defines values for ActionType.
KnownActionType can be used interchangeably with ActionType, this enum contains the known values that the service supports.

Known values supported by the service

ModifyProperties: Modify an object's properties
RunPlaybook: Run a playbook on an object

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listByAlertRuleNext operation.

Contains response data for the listByAlertRule operation.

Defines values for AlertDetail.
KnownAlertDetail can be used interchangeably with AlertDetail, this enum contains the known values that the service supports.

Known values supported by the service

DisplayName: Alert display name
Severity: Alert severity

Defines values for AlertRuleKind.
KnownAlertRuleKind can be used interchangeably with AlertRuleKind, this enum contains the known values that the service supports.

Known values supported by the service

Scheduled
MicrosoftSecurityIncidentCreation
Fusion
MLBehaviorAnalytics
ThreatIntelligence
NRT

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for AlertSeverity.
KnownAlertSeverity can be used interchangeably with AlertSeverity, this enum contains the known values that the service supports.

Known values supported by the service

High: High severity
Medium: Medium severity
Low: Low severity
Informational: Informational severity

Defines values for AlertStatus.
KnownAlertStatus can be used interchangeably with AlertStatus, this enum contains the known values that the service supports.

Known values supported by the service

Unknown: Unknown value
New: New alert
Resolved: Alert closed after handling
Dismissed: Alert dismissed as false positive
InProgress: Alert is being handled

Defines values for AntispamMailDirection.
KnownAntispamMailDirection can be used interchangeably with AntispamMailDirection, this enum contains the known values that the service supports.

Known values supported by the service

Unknown: Unknown
Inbound: Inbound
Outbound: Outbound
Intraorg: Intraorg

Defines values for AttackTactic.
KnownAttackTactic can be used interchangeably with AttackTactic, this enum contains the known values that the service supports.

Known values supported by the service

Reconnaissance
ResourceDevelopment
InitialAccess
Execution
Persistence
PrivilegeEscalation
DefenseEvasion
CredentialAccess
Discovery
LateralMovement
Collection
Exfiltration
CommandAndControl
Impact
PreAttack
ImpairProcessControl
InhibitResponseFunction

Defines values for AutomationRuleBooleanConditionSupportedOperator.
KnownAutomationRuleBooleanConditionSupportedOperator can be used interchangeably with AutomationRuleBooleanConditionSupportedOperator, this enum contains the known values that the service supports.

Known values supported by the service

And: Evaluates as true if all the item conditions are evaluated as true
Or: Evaluates as true if at least one of the item conditions are evaluated as true

Defines values for AutomationRulePropertyArrayChangedConditionSupportedArrayType.
KnownAutomationRulePropertyArrayChangedConditionSupportedArrayType can be used interchangeably with AutomationRulePropertyArrayChangedConditionSupportedArrayType, this enum contains the known values that the service supports.

Known values supported by the service

Alerts: Evaluate the condition on the alerts
Labels: Evaluate the condition on the labels
Tactics: Evaluate the condition on the tactics
Comments: Evaluate the condition on the comments

Defines values for AutomationRulePropertyArrayChangedConditionSupportedChangeType.
KnownAutomationRulePropertyArrayChangedConditionSupportedChangeType can be used interchangeably with AutomationRulePropertyArrayChangedConditionSupportedChangeType, this enum contains the known values that the service supports.

Known values supported by the service

Added: Evaluate the condition on items added to the array

Defines values for AutomationRulePropertyArrayConditionSupportedArrayConditionType.
KnownAutomationRulePropertyArrayConditionSupportedArrayConditionType can be used interchangeably with AutomationRulePropertyArrayConditionSupportedArrayConditionType, this enum contains the known values that the service supports.

Known values supported by the service

AnyItem: Evaluate the condition as true if any item fulfills it

Defines values for AutomationRulePropertyArrayConditionSupportedArrayType.
KnownAutomationRulePropertyArrayConditionSupportedArrayType can be used interchangeably with AutomationRulePropertyArrayConditionSupportedArrayType, this enum contains the known values that the service supports.

Known values supported by the service

CustomDetails: Evaluate the condition on the custom detail keys
CustomDetailValues: Evaluate the condition on a custom detail's values

Defines values for AutomationRulePropertyChangedConditionSupportedChangedType.
KnownAutomationRulePropertyChangedConditionSupportedChangedType can be used interchangeably with AutomationRulePropertyChangedConditionSupportedChangedType, this enum contains the known values that the service supports.

Known values supported by the service

ChangedFrom: Evaluate the condition on the previous value of the property
ChangedTo: Evaluate the condition on the updated value of the property

Defines values for AutomationRulePropertyChangedConditionSupportedPropertyType.
KnownAutomationRulePropertyChangedConditionSupportedPropertyType can be used interchangeably with AutomationRulePropertyChangedConditionSupportedPropertyType, this enum contains the known values that the service supports.

Known values supported by the service

IncidentSeverity: Evaluate the condition on the incident severity
IncidentStatus: Evaluate the condition on the incident status
IncidentOwner: Evaluate the condition on the incident owner

Defines values for AutomationRulePropertyConditionSupportedOperator.
KnownAutomationRulePropertyConditionSupportedOperator can be used interchangeably with AutomationRulePropertyConditionSupportedOperator, this enum contains the known values that the service supports.

Known values supported by the service

Equals: Evaluates if the property equals at least one of the condition values
NotEquals: Evaluates if the property does not equal any of the condition values
Contains: Evaluates if the property contains at least one of the condition values
NotContains: Evaluates if the property does not contain any of the condition values
StartsWith: Evaluates if the property starts with any of the condition values
NotStartsWith: Evaluates if the property does not start with any of the condition values
EndsWith: Evaluates if the property ends with any of the condition values
NotEndsWith: Evaluates if the property does not end with any of the condition values

Defines values for AutomationRulePropertyConditionSupportedProperty.
KnownAutomationRulePropertyConditionSupportedProperty can be used interchangeably with AutomationRulePropertyConditionSupportedProperty, this enum contains the known values that the service supports.

Known values supported by the service

IncidentTitle: The title of the incident
IncidentDescription: The description of the incident
IncidentSeverity: The severity of the incident
IncidentStatus: The status of the incident
IncidentRelatedAnalyticRuleIds: The related Analytic rule ids of the incident
IncidentTactics: The tactics of the incident
IncidentLabel: The labels of the incident
IncidentProviderName: The provider name of the incident
IncidentUpdatedBySource: The update source of the incident
IncidentCustomDetailsKey: The incident custom detail key
IncidentCustomDetailsValue: The incident custom detail value
AccountAadTenantId: The account Azure Active Directory tenant id
AccountAadUserId: The account Azure Active Directory user id
AccountName: The account name
AccountNTDomain: The account NetBIOS domain name
AccountPUID: The account Azure Active Directory Passport User ID
AccountSid: The account security identifier
AccountObjectGuid: The account unique identifier
AccountUPNSuffix: The account user principal name suffix
AlertProductNames: The name of the product of the alert
AlertAnalyticRuleIds: The analytic rule ids of the alert
AzureResourceResourceId: The Azure resource id
AzureResourceSubscriptionId: The Azure resource subscription id
CloudApplicationAppId: The cloud application identifier
CloudApplicationAppName: The cloud application name
DNSDomainName: The dns record domain name
FileDirectory: The file directory full path
FileName: The file name without path
FileHashValue: The file hash value
HostAzureID: The host Azure resource id
HostName: The host name without domain
HostNetBiosName: The host NetBIOS name
HostNTDomain: The host NT domain
HostOSVersion: The host operating system
IoTDeviceId: "The IoT device id
IoTDeviceName: The IoT device name
IoTDeviceType: The IoT device type
IoTDeviceVendor: The IoT device vendor
IoTDeviceModel: The IoT device model
IoTDeviceOperatingSystem: The IoT device operating system
IPAddress: The IP address
MailboxDisplayName: The mailbox display name
MailboxPrimaryAddress: The mailbox primary address
MailboxUPN: The mailbox user principal name
MailMessageDeliveryAction: The mail message delivery action
MailMessageDeliveryLocation: The mail message delivery location
MailMessageRecipient: The mail message recipient
MailMessageSenderIP: The mail message sender IP address
MailMessageSubject: The mail message subject
MailMessageP1Sender: The mail message P1 sender
MailMessageP2Sender: The mail message P2 sender
MalwareCategory: The malware category
MalwareName: The malware name
ProcessCommandLine: The process execution command line
ProcessId: The process id
RegistryKey: The registry key path
RegistryValueData: The registry key value in string formatted representation
Url: The url

Contains response data for the createOrUpdate operation.

Contains response data for the delete operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the expand operation.

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for ConditionType.
KnownConditionType can be used interchangeably with ConditionType, this enum contains the known values that the service supports.

Known values supported by the service

Property: Evaluate an object property value
PropertyArray: Evaluate an object array property value
PropertyChanged: Evaluate an object property changed value
PropertyArrayChanged: Evaluate an object array property changed value
Boolean: Apply a boolean operator (e.g AND, OR) to conditions

Defines values for ConfidenceLevel.
KnownConfidenceLevel can be used interchangeably with ConfidenceLevel, this enum contains the known values that the service supports.

Known values supported by the service

Unknown: Unknown confidence, the is the default value
Low: Low confidence, meaning we have some doubts this is indeed malicious or part of an attack
High: High confidence that the alert is true positive malicious

Defines values for ConfidenceScoreStatus.
KnownConfidenceScoreStatus can be used interchangeably with ConfidenceScoreStatus, this enum contains the known values that the service supports.

Known values supported by the service

NotApplicable: Score will not be calculated for this alert as it is not supported by virtual analyst
InProcess: No score was set yet and calculation is in progress
NotFinal: Score is calculated and shown as part of the alert, but may be updated again at a later time following the processing of additional data
Final: Final score was calculated and available

Defines values for ConnectAuthKind.
KnownConnectAuthKind can be used interchangeably with ConnectAuthKind, this enum contains the known values that the service supports.

Known values supported by the service

Basic
OAuth2
APIKey

Defines values for ConnectivityType.
KnownConnectivityType can be used interchangeably with ConnectivityType, this enum contains the known values that the service supports.

Known values supported by the service

IsConnectedQuery

Defines values for ContentType.
KnownContentType can be used interchangeably with ContentType, this enum contains the known values that the service supports.

Known values supported by the service

AnalyticRule
Workbook

Defines values for CreatedByType.
KnownCreatedByType can be used interchangeably with CreatedByType, this enum contains the known values that the service supports.

Known values supported by the service

User
Application
ManagedIdentity
Key

Defines values for CustomEntityQueryKind.
KnownCustomEntityQueryKind can be used interchangeably with CustomEntityQueryKind, this enum contains the known values that the service supports.

Known values supported by the service

Activity

Defines values for DataConnectorAuthorizationState.
KnownDataConnectorAuthorizationState can be used interchangeably with DataConnectorAuthorizationState, this enum contains the known values that the service supports.

Known values supported by the service

Valid
Invalid

Defines values for DataConnectorKind.
KnownDataConnectorKind can be used interchangeably with DataConnectorKind, this enum contains the known values that the service supports.

Known values supported by the service

AzureActiveDirectory
AzureSecurityCenter
MicrosoftCloudAppSecurity
ThreatIntelligence
ThreatIntelligenceTaxii
Office365
OfficeATP
OfficeIRM
Office365Project
OfficePowerBI
AmazonWebServicesCloudTrail
AmazonWebServicesS3
AzureAdvancedThreatProtection
MicrosoftDefenderAdvancedThreatProtection
Dynamics365
MicrosoftThreatProtection
MicrosoftThreatIntelligence
GenericUI
APIPolling
IOT

Defines values for DataConnectorLicenseState.
KnownDataConnectorLicenseState can be used interchangeably with DataConnectorLicenseState, this enum contains the known values that the service supports.

Known values supported by the service

Valid
Invalid
Unknown

Contains response data for the post operation.

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for DataTypeState.
KnownDataTypeState can be used interchangeably with DataTypeState, this enum contains the known values that the service supports.

Known values supported by the service

Enabled
Disabled

Defines values for DeleteStatus.
KnownDeleteStatus can be used interchangeably with DeleteStatus, this enum contains the known values that the service supports.

Known values supported by the service

Deleted: The file was deleted.
NotDeleted: The file was not deleted.
Unspecified: Unspecified

Defines values for DeliveryAction.

Defines values for DeliveryLocation.

Defines values for DeploymentFetchStatus.
KnownDeploymentFetchStatus can be used interchangeably with DeploymentFetchStatus, this enum contains the known values that the service supports.

Known values supported by the service

Success
Unauthorized
NotFound

Defines values for DeploymentResult.
KnownDeploymentResult can be used interchangeably with DeploymentResult, this enum contains the known values that the service supports.

Known values supported by the service

Success
Canceled
Failed

Defines values for DeploymentState.
KnownDeploymentState can be used interchangeably with DeploymentState, this enum contains the known values that the service supports.

Known values supported by the service

In_Progress
Completed
Queued
Canceling

Defines values for DeviceImportance.
KnownDeviceImportance can be used interchangeably with DeviceImportance, this enum contains the known values that the service supports.

Known values supported by the service

Unknown: Unknown - Default value
Low: Low
Normal: Normal
High: High

Contains response data for the get operation.

Defines values for ElevationToken.

Contains response data for the expand operation.

Contains response data for the getInsights operation.

Contains response data for the get operation.

Contains response data for the list operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the queries operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for EntityItemQueryKind.
KnownEntityItemQueryKind can be used interchangeably with EntityItemQueryKind, this enum contains the known values that the service supports.

Known values supported by the service

Insight: insight

Defines values for EntityKind.
KnownEntityKind can be used interchangeably with EntityKind, this enum contains the known values that the service supports.

Known values supported by the service

Account: Entity represents account in the system.
Host: Entity represents host in the system.
File: Entity represents file in the system.
AzureResource: Entity represents azure resource in the system.
CloudApplication: Entity represents cloud application in the system.
DnsResolution: Entity represents dns resolution in the system.
FileHash: Entity represents file hash in the system.
Ip: Entity represents ip in the system.
Malware: Entity represents malware in the system.
Process: Entity represents process in the system.
RegistryKey: Entity represents registry key in the system.
RegistryValue: Entity represents registry value in the system.
SecurityGroup: Entity represents security group in the system.
Url: Entity represents url in the system.
IoTDevice: Entity represents IoT device in the system.
SecurityAlert: Entity represents security alert in the system.
Bookmark: Entity represents bookmark in the system.
MailCluster: Entity represents mail cluster in the system.
MailMessage: Entity represents mail message in the system.
Mailbox: Entity represents mailbox in the system.
SubmissionMail: Entity represents submission mail in the system.
Nic: Entity represents network interface in the system.

Defines values for EntityMappingType.
KnownEntityMappingType can be used interchangeably with EntityMappingType, this enum contains the known values that the service supports.

Known values supported by the service

Account: User account entity type
Host: Host entity type
IP: IP address entity type
Malware: Malware entity type
File: System file entity type
Process: Process entity type
CloudApplication: Cloud app entity type
DNS: DNS entity type
AzureResource: Azure resource entity type
FileHash: File-hash entity type
RegistryKey: Registry key entity type
RegistryValue: Registry value entity type
SecurityGroup: Security group entity type
URL: URL entity type
Mailbox: Mailbox entity type
MailCluster: Mail cluster entity type
MailMessage: Mail message entity type
SubmissionMail: Submission mail entity type

Defines values for EntityProviders.
KnownEntityProviders can be used interchangeably with EntityProviders, this enum contains the known values that the service supports.

Known values supported by the service

ActiveDirectory
AzureActiveDirectory

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for EntityQueryKind.
KnownEntityQueryKind can be used interchangeably with EntityQueryKind, this enum contains the known values that the service supports.

Known values supported by the service

Expansion
Insight
Activity

Defines values for EntityQueryTemplateKind.
KnownEntityQueryTemplateKind can be used interchangeably with EntityQueryTemplateKind, this enum contains the known values that the service supports.

Known values supported by the service

Activity

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the getRelation operation.

Defines values for EntityTimelineKind.
KnownEntityTimelineKind can be used interchangeably with EntityTimelineKind, this enum contains the known values that the service supports.

Known values supported by the service

Activity: activity
Bookmark: bookmarks
SecurityAlert: security alerts
Anomaly: anomaly

Defines values for EntityType.
KnownEntityType can be used interchangeably with EntityType, this enum contains the known values that the service supports.

Known values supported by the service

Account: Entity represents account in the system.
Host: Entity represents host in the system.
File: Entity represents file in the system.
AzureResource: Entity represents azure resource in the system.
CloudApplication: Entity represents cloud application in the system.
DNS: Entity represents dns in the system.
FileHash: Entity represents file hash in the system.
IP: Entity represents ip in the system.
Malware: Entity represents malware in the system.
Process: Entity represents process in the system.
RegistryKey: Entity represents registry key in the system.
RegistryValue: Entity represents registry value in the system.
SecurityGroup: Entity represents security group in the system.
URL: Entity represents url in the system.
IoTDevice: Entity represents IoT device in the system.
SecurityAlert: Entity represents security alert in the system.
HuntingBookmark: Entity represents HuntingBookmark in the system.
MailCluster: Entity represents mail cluster in the system.
MailMessage: Entity represents mail message in the system.
Mailbox: Entity represents mailbox in the system.
SubmissionMail: Entity represents submission mail in the system.
Nic: Entity represents network interface in the system.

Defines values for Enum13.
KnownEnum13 can be used interchangeably with Enum13, this enum contains the known values that the service supports.

Known values supported by the service

Expansion
Activity

Defines values for EventGroupingAggregationKind.
KnownEventGroupingAggregationKind can be used interchangeably with EventGroupingAggregationKind, this enum contains the known values that the service supports.

Known values supported by the service

SingleAlert
AlertPerResult

Defines values for FileFormat.
KnownFileFormat can be used interchangeably with FileFormat, this enum contains the known values that the service supports.

Known values supported by the service

CSV: A CSV file.
JSON: A JSON file.
Unspecified: A file of other format.

Defines values for FileHashAlgorithm.
KnownFileHashAlgorithm can be used interchangeably with FileHashAlgorithm, this enum contains the known values that the service supports.

Known values supported by the service

Unknown: Unknown hash algorithm
MD5: MD5 hash type
SHA1: SHA1 hash type
SHA256: SHA256 hash type
SHA256AC: SHA256 Authenticode hash type

Defines values for FileImportContentType.
KnownFileImportContentType can be used interchangeably with FileImportContentType, this enum contains the known values that the service supports.

Known values supported by the service

BasicIndicator: File containing records with the core fields of an indicator, plus the observables to construct the STIX pattern.
StixIndicator: File containing STIX indicators.
Unspecified: File containing other records.

Defines values for FileImportState.
KnownFileImportState can be used interchangeably with FileImportState, this enum contains the known values that the service supports.

Known values supported by the service

FatalError: A fatal error has occurred while ingesting the file.
Ingested: The file has been ingested.
IngestedWithErrors: The file has been ingested with errors.
InProgress: The file ingestion is in progress.
Invalid: The file is invalid.
WaitingForUpload: Waiting for the file to be uploaded.
Unspecified: Unspecified state.

Contains response data for the create operation.

Contains response data for the delete operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for GetInsightsError.
KnownGetInsightsError can be used interchangeably with GetInsightsError, this enum contains the known values that the service supports.

Known values supported by the service

Insight

Contains response data for the get operation.

Defines values for IncidentClassification.
KnownIncidentClassification can be used interchangeably with IncidentClassification, this enum contains the known values that the service supports.

Known values supported by the service

Undetermined: Incident classification was undetermined
TruePositive: Incident was true positive
BenignPositive: Incident was benign positive
FalsePositive: Incident was false positive

Defines values for IncidentClassificationReason.
KnownIncidentClassificationReason can be used interchangeably with IncidentClassificationReason, this enum contains the known values that the service supports.

Known values supported by the service

SuspiciousActivity: Classification reason was suspicious activity
SuspiciousButExpected: Classification reason was suspicious but expected
IncorrectAlertLogic: Classification reason was incorrect alert logic
InaccurateData: Classification reason was inaccurate data

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for IncidentLabelType.
KnownIncidentLabelType can be used interchangeably with IncidentLabelType, this enum contains the known values that the service supports.

Known values supported by the service

User: Label manually created by a user
AutoAssigned: Label automatically created by the system

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for IncidentSeverity.
KnownIncidentSeverity can be used interchangeably with IncidentSeverity, this enum contains the known values that the service supports.

Known values supported by the service

High: High severity
Medium: Medium severity
Low: Low severity
Informational: Informational severity

Defines values for IncidentStatus.
KnownIncidentStatus can be used interchangeably with IncidentStatus, this enum contains the known values that the service supports.

Known values supported by the service

New: An active incident which isn't being handled currently
Active: An active incident which is being handled
Closed: A non-active incident

Contains response data for the createOrUpdate operation.

Contains response data for the createTeam operation.

Contains response data for the get operation.

Contains response data for the listAlerts operation.

Contains response data for the listBookmarks operation.

Contains response data for the listEntities operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the runPlaybook operation.

Defines values for IngestionMode.
KnownIngestionMode can be used interchangeably with IngestionMode, this enum contains the known values that the service supports.

Known values supported by the service

IngestOnlyIfAllAreValid: No records should be ingested when invalid records are detected.
IngestAnyValidRecords: Valid records should still be ingested when invalid records are detected.
Unspecified: Unspecified

Defines values for KillChainIntent.
KnownKillChainIntent can be used interchangeably with KillChainIntent, this enum contains the known values that the service supports.

Known values supported by the service

Unknown: The default value.
Probing: Probing could be an attempt to access a certain resource regardless of a malicious intent or a failed attempt to gain access to a target system to gather information prior to exploitation. This step is usually detected as an attempt originating from outside the network in attempt to scan the target system and find a way in.
Exploitation: Exploitation is the stage where an attacker manage to get foothold on the attacked resource. This stage is applicable not only for compute hosts, but also for resources such as user accounts, certificates etc. Adversaries will often be able to control the resource after this stage.
Persistence: Persistence is any access, action, or configuration change to a system that gives an adversary a persistent presence on that system. Adversaries will often need to maintain access to systems through interruptions such as system restarts, loss of credentials, or other failures that would require a remote access tool to restart or alternate backdoor for them to regain access.
PrivilegeEscalation: Privilege escalation is the result of actions that allow an adversary to obtain a higher level of permissions on a system or network. Certain tools or actions require a higher level of privilege to work and are likely necessary at many points throughout an operation. User accounts with permissions to access specific systems or perform specific functions necessary for adversaries to achieve their objective may also be considered an escalation of privilege.
DefenseEvasion: Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation.
CredentialAccess: Credential access represents techniques resulting in access to or control over system, domain, or service credentials that are used within an enterprise environment. Adversaries will likely attempt to obtain legitimate credentials from users or administrator accounts (local system administrator or domain users with administrator access) to use within the network. With sufficient access within a network, an adversary can create accounts for later use within the environment.
Discovery: Discovery consists of techniques that allow the adversary to gain knowledge about the system and internal network. When adversaries gain access to a new system, they must orient themselves to what they now have control of and what benefits operating from that system give to their current objective or overall goals during the intrusion. The operating system provides many native tools that aid in this post-compromise information-gathering phase.
LateralMovement: Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access tool. An adversary can use lateral movement for many purposes, including remote Execution of tools, pivoting to additional systems, access to specific information or files, access to additional credentials, or to cause an effect.
Execution: The execution tactic represents techniques that result in execution of adversary-controlled code on a local or remote system. This tactic is often used in conjunction with lateral movement to expand access to remote systems on a network.
Collection: Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.
Exfiltration: Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from a target network. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.
CommandAndControl: The command and control tactic represents how adversaries communicate with systems under their control within a target network.
Impact: The impact intent primary objective is to directly reduce the availability or integrity of a system, service, or network; including manipulation of data to impact a business or operational process. This would often refer to techniques such as ransom-ware, defacement, data manipulation and others.

Defines values for Kind.
KnownKind can be used interchangeably with Kind, this enum contains the known values that the service supports.

Known values supported by the service

DataConnector
DataType
Workbook
WorkbookTemplate
Playbook
PlaybookTemplate
AnalyticsRuleTemplate
AnalyticsRule
HuntingQuery
InvestigationQuery
Parser
Watchlist
WatchlistTemplate
Solution
AzureFunction
LogicAppsCustomConnector
AutomationRule

Defines values for MatchingMethod.
KnownMatchingMethod can be used interchangeably with MatchingMethod, this enum contains the known values that the service supports.

Known values supported by the service

AllEntities: Grouping alerts into a single incident if all the entities match
AnyAlert: Grouping any alerts triggered by this rule into a single incident
Selected: Grouping alerts into a single incident if the selected entities, custom details and alert details match

Contains response data for the create operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the update operation.

Defines values for MicrosoftSecurityProductName.
KnownMicrosoftSecurityProductName can be used interchangeably with MicrosoftSecurityProductName, this enum contains the known values that the service supports.

Known values supported by the service

Microsoft Cloud App Security
Azure Security Center
Azure Advanced Threat Protection
Azure Active Directory Identity Protection
Azure Security Center for IoT
Office 365 Advanced Threat Protection
Microsoft Defender Advanced Threat Protection

Defines values for OSFamily.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for Operator.
KnownOperator can be used interchangeably with Operator, this enum contains the known values that the service supports.

Known values supported by the service

AND
OR

Defines values for OutputType.
KnownOutputType can be used interchangeably with OutputType, this enum contains the known values that the service supports.

Known values supported by the service

Number
String
Date
Entity

Defines values for OwnerType.
KnownOwnerType can be used interchangeably with OwnerType, this enum contains the known values that the service supports.

Known values supported by the service

Unknown: The incident owner type is unknown
User: The incident owner type is an AAD user
Group: The incident owner type is an AAD group

Defines values for PermissionProviderScope.
KnownPermissionProviderScope can be used interchangeably with PermissionProviderScope, this enum contains the known values that the service supports.

Known values supported by the service

ResourceGroup
Subscription
Workspace

Defines values for PollingFrequency.
KnownPollingFrequency can be used interchangeably with PollingFrequency, this enum contains the known values that the service supports.

Known values supported by the service

OnceAMinute: Once a minute
OnceAnHour: Once an hour
OnceADay: Once a day

Contains response data for the get operation.

Contains response data for the list operation.

Contains response data for the update operation.

Defines values for ProviderName.
KnownProviderName can be used interchangeably with ProviderName, this enum contains the known values that the service supports.

Known values supported by the service

Microsoft.OperationalInsights/solutions
Microsoft.OperationalInsights/workspaces
Microsoft.OperationalInsights/workspaces/datasources
microsoft.aadiam/diagnosticSettings
Microsoft.OperationalInsights/workspaces/sharedKeys
Microsoft.Authorization/policyAssignments

Defines values for RegistryHive.
KnownRegistryHive can be used interchangeably with RegistryHive, this enum contains the known values that the service supports.

Known values supported by the service

HKEY_LOCAL_MACHINE: HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT: HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG: HKEY_CURRENT_CONFIG
HKEY_USERS: HKEY_USERS
HKEY_CURRENT_USER_LOCAL_SETTINGS: HKEY_CURRENT_USER_LOCAL_SETTINGS
HKEY_PERFORMANCE_DATA: HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_NLSTEXT: HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_TEXT: HKEY_PERFORMANCE_TEXT
HKEY_A: HKEY_A
HKEY_CURRENT_USER: HKEY_CURRENT_USER

Defines values for RegistryValueKind.
KnownRegistryValueKind can be used interchangeably with RegistryValueKind, this enum contains the known values that the service supports.

Known values supported by the service

None: None
Unknown: Unknown value type
String: String value type
ExpandString: ExpandString value type
Binary: Binary value type
DWord: DWord value type
MultiString: MultiString value type
QWord: QWord value type

Defines values for RepoType.
KnownRepoType can be used interchangeably with RepoType, this enum contains the known values that the service supports.

Known values supported by the service

Github
DevOps

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Defines values for SecurityMLAnalyticsSettingsKind.
KnownSecurityMLAnalyticsSettingsKind can be used interchangeably with SecurityMLAnalyticsSettingsKind, this enum contains the known values that the service supports.

Known values supported by the service

Anomaly

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the create operation.

Contains response data for the get operation.

Contains response data for the list operation.

Defines values for SettingKind.
KnownSettingKind can be used interchangeably with SettingKind, this enum contains the known values that the service supports.

Known values supported by the service

Anomalies
EyesOn
EntityAnalytics
Ueba

Defines values for SettingType.
KnownSettingType can be used interchangeably with SettingType, this enum contains the known values that the service supports.

Known values supported by the service

CopyableLabel
InstructionStepsGroup
InfoMessage

Defines values for SettingsStatus.
KnownSettingsStatus can be used interchangeably with SettingsStatus, this enum contains the known values that the service supports.

Known values supported by the service

Production: Anomaly settings status in Production mode
Flighting: Anomaly settings status in Flighting mode

Contains response data for the listRepositoriesNext operation.

Contains response data for the listRepositories operation.

Contains response data for the create operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for SourceKind.
KnownSourceKind can be used interchangeably with SourceKind, this enum contains the known values that the service supports.

Known values supported by the service

LocalWorkspace
Community
Solution
SourceRepository

Defines values for SourceType.
KnownSourceType can be used interchangeably with SourceType, this enum contains the known values that the service supports.

Known values supported by the service

Local file
Remote storage

Defines values for SupportTier.
KnownSupportTier can be used interchangeably with SupportTier, this enum contains the known values that the service supports.

Known values supported by the service

Microsoft
Partner
Community

Defines values for TemplateStatus.
KnownTemplateStatus can be used interchangeably with TemplateStatus, this enum contains the known values that the service supports.

Known values supported by the service

Installed: Alert rule template installed. and can not use more then once
Available: Alert rule template is available.
NotAvailable: Alert rule template is not available

Contains response data for the createIndicator operation.

Contains response data for the create operation.

Contains response data for the get operation.

Contains response data for the list operation.

Contains response data for the queryIndicatorsNext operation.

Contains response data for the queryIndicators operation.

Contains response data for the replaceTags operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Defines values for ThreatIntelligenceResourceKindEnum.
KnownThreatIntelligenceResourceKindEnum can be used interchangeably with ThreatIntelligenceResourceKindEnum, this enum contains the known values that the service supports.

Known values supported by the service

indicator: Entity represents threat intelligence indicator in the system.

Defines values for ThreatIntelligenceSortingCriteriaEnum.
KnownThreatIntelligenceSortingCriteriaEnum can be used interchangeably with ThreatIntelligenceSortingCriteriaEnum, this enum contains the known values that the service supports.

Known values supported by the service

unsorted
ascending
descending

Defines values for TriggerOperator.

Defines values for TriggersOn.
KnownTriggersOn can be used interchangeably with TriggersOn, this enum contains the known values that the service supports.

Known values supported by the service

Incidents: Trigger on Incidents
Alerts: Trigger on Alerts

Defines values for TriggersWhen.
KnownTriggersWhen can be used interchangeably with TriggersWhen, this enum contains the known values that the service supports.

Known values supported by the service

Created: Trigger on created objects
Updated: Trigger on updated objects

Defines values for UebaDataSources.
KnownUebaDataSources can be used interchangeably with UebaDataSources, this enum contains the known values that the service supports.

Known values supported by the service

AuditLogs
AzureActivity
SecurityEvent
SigninLogs

Defines values for Version.
KnownVersion can be used interchangeably with Version, this enum contains the known values that the service supports.

Known values supported by the service

V1
V2

Contains response data for the createOrUpdate operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Contains response data for the createOrUpdate operation.

Contains response data for the delete operation.

Contains response data for the get operation.

Contains response data for the listNext operation.

Contains response data for the list operation.

Known values of ActionType that the service accepts.

Known values of AlertDetail that the service accepts.

Known values of AlertRuleKind that the service accepts.

Known values of AlertSeverity that the service accepts.

Known values of AlertStatus that the service accepts.

Known values of AntispamMailDirection that the service accepts.

Known values of AttackTactic that the service accepts.

Known values of AutomationRuleBooleanConditionSupportedOperator that the service accepts.

Known values of AutomationRulePropertyArrayChangedConditionSupportedArrayType that the service accepts.

Known values of AutomationRulePropertyArrayChangedConditionSupportedChangeType that the service accepts.

Known values of AutomationRulePropertyArrayConditionSupportedArrayConditionType that the service accepts.

Known values of AutomationRulePropertyArrayConditionSupportedArrayType that the service accepts.

Known values of AutomationRulePropertyChangedConditionSupportedChangedType that the service accepts.

Known values of AutomationRulePropertyChangedConditionSupportedPropertyType that the service accepts.

Known values of AutomationRulePropertyConditionSupportedOperator that the service accepts.

Known values of AutomationRulePropertyConditionSupportedProperty that the service accepts.

Known values of ConditionType that the service accepts.

Known values of ConfidenceLevel that the service accepts.

Known values of ConfidenceScoreStatus that the service accepts.

Known values of ConnectAuthKind that the service accepts.

Known values of ConnectivityType that the service accepts.

Known values of ContentType that the service accepts.

Known values of CreatedByType that the service accepts.

Known values of CustomEntityQueryKind that the service accepts.

Known values of DataConnectorAuthorizationState that the service accepts.

Known values of DataConnectorKind that the service accepts.

Known values of DataConnectorLicenseState that the service accepts.

Known values of DataTypeState that the service accepts.

Known values of DeleteStatus that the service accepts.

Known values of DeploymentFetchStatus that the service accepts.

Known values of DeploymentResult that the service accepts.

Known values of DeploymentState that the service accepts.

Known values of DeviceImportance that the service accepts.

Known values of EntityItemQueryKind that the service accepts.

Known values of EntityKind that the service accepts.

Known values of EntityMappingType that the service accepts.

Known values of EntityProviders that the service accepts.

Known values of EntityQueryKind that the service accepts.

Known values of EntityQueryTemplateKind that the service accepts.

Known values of EntityTimelineKind that the service accepts.

Known values of EntityType that the service accepts.

Known values of Enum13 that the service accepts.

Known values of EventGroupingAggregationKind that the service accepts.

Known values of FileFormat that the service accepts.

Known values of FileHashAlgorithm that the service accepts.

Known values of FileImportContentType that the service accepts.

Known values of FileImportState that the service accepts.

Known values of GetInsightsError that the service accepts.

Known values of IncidentClassification that the service accepts.

Known values of IncidentClassificationReason that the service accepts.

Known values of IncidentLabelType that the service accepts.

Known values of IncidentSeverity that the service accepts.

Known values of IncidentStatus that the service accepts.

Known values of IngestionMode that the service accepts.

Known values of KillChainIntent that the service accepts.

Known values of Kind that the service accepts.

Known values of MatchingMethod that the service accepts.

Known values of MicrosoftSecurityProductName that the service accepts.

Known values of Operator that the service accepts.

Known values of OutputType that the service accepts.

Known values of OwnerType that the service accepts.

Known values of PermissionProviderScope that the service accepts.

Known values of PollingFrequency that the service accepts.

Known values of ProviderName that the service accepts.

Known values of RegistryHive that the service accepts.

Known values of RegistryValueKind that the service accepts.

Known values of RepoType that the service accepts.

Known values of SecurityMLAnalyticsSettingsKind that the service accepts.

Known values of SettingKind that the service accepts.

Known values of SettingType that the service accepts.

Known values of SettingsStatus that the service accepts.

Known values of SourceKind that the service accepts.

Known values of SourceType that the service accepts.

Known values of SupportTier that the service accepts.

Known values of TemplateStatus that the service accepts.

Known values of ThreatIntelligenceResourceKindEnum that the service accepts.

Known values of ThreatIntelligenceSortingCriteriaEnum that the service accepts.

Known values of TriggersOn that the service accepts.

Known values of TriggersWhen that the service accepts.

Known values of UebaDataSources that the service accepts.

Known values of Version that the service accepts.

Given the last .value produced by the byPage iterator, returns a continuation token that can be used to begin paging from that point later.