Microsoft Graph Security.incident API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Security.incident API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: Security.incident
  x-ms-docs-toc-type: page
paths:
  /security/incidents:
    description: Provides operations to manage the incidents property of the microsoft.graph.security entity.
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph List incidents
      description: Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident. This operation allows you to filter and sort through incidents to create an informed cyber security response. It exposes a collection of incidents that were flagged in your network, within the time range you specified in your environment retention policy. The most recent incidents are displayed at the top of the list.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-list-incidents?view=graph-rest-1.0
      operationId: security.ListIncidents
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.incidentCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - Security.incident
      summary: Microsoft Graph Create new navigation property to incidents for security
      operationId: security.CreateIncidents
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.incident'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.incident'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}:
    description: Provides operations to manage the incidents property of the microsoft.graph.security entity.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get incident
      description: Retrieve the properties and relationships of an incident object. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-incident-get?view=graph-rest-1.0
      operationId: security.GetIncidents
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.incident'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - Security.incident
      summary: Microsoft Graph Update incident
      description: Update the properties of an incident object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-incident-update?view=graph-rest-1.0
      operationId: security.UpdateIncidents
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.incident'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.incident'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - Security.incident
      summary: Microsoft Graph Delete navigation property incidents for security
      operationId: security.DeleteIncidents
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}/alerts:
    description: Provides operations to manage the alerts property of the microsoft.graph.security.incident entity.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get alerts from security
      description: The list of related alerts. Supports $expand.
      operationId: security.incidents.ListAlerts
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.alertCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}/alerts/{alert-id}:
    description: Provides operations to manage the alerts property of the microsoft.graph.security.incident entity.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get alerts from security
      description: The list of related alerts. Supports $expand.
      operationId: security.incidents.GetAlerts
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}/alerts/{alert-id}/comments:
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    post:
      tags:
      - Security.incident
      summary: Microsoft Graph Sets a new value for the collection of alertComment.
      operationId: security.incidents.alerts.SetComments
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      requestBody:
        description: New property values
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/microsoft.graph.security.alertComment'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/microsoft.graph.security.alertComment'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/incidents/{incident-id}/alerts/{alert-id}/comments/$count:
    description: Provides operations to count the resources in the collection.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get the number of the resource
      operationId: security.incidents.alerts.Comments.GetCount-ee8f
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/incidents/{incident-id}/alerts/$count:
    description: Provides operations to count the resources in the collection.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get the number of the resource
      operationId: security.incidents.alerts.GetCount-d6ba
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/incidents/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get the number of the resource
      operationId: security.incidents.GetCount-9725
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
components:
  schemas:
    ODataCountResponse:
      type: integer
      format: int32
    microsoft.graph.security.serviceSource:
      title: serviceSource
      enum:
      - unknown
      - microsoftDefenderForEndpoint
      - microsoftDefenderForIdentity
      - microsoftDefenderForCloudApps
      - microsoftDefenderForOffice365
      - microsoft365Defender
      - azureAdIdentityProtection
      - microsoftAppGovernance
      - dataLossPrevention
      - unknownFutureValue
      - microsoftDefenderForCloud
      - microsoftSentinel
      - microsoftInsiderRiskManagement
      - microsoftThreatIntelligence
      type: string
    microsoft.graph.security.investigationState:
      title: investigationState
      enum:
      - unknown
      - terminated
      - successfullyRemediated
      - benign
      - failed
      - partiallyRemediated
      - running
      - pendingApproval
      - pendingResource
      - queued
      - innerFailure
      - preexistingAlert
      - unsupportedOs
      - unsupportedAlertType
      - suppressedAlert
      - partiallyInvestigated
      - terminatedByUser
      - terminatedBySystem
      - unknownFutureValue
      type: string
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.security.alertSeverity:
      title: alertSeverity
      enum:
      - unknown
      - informational
      - low
      - medium
      - high
      - unknownFutureValue
      type: string
    microsoft.graph.security.alertDetermination:
      title: alertDetermination
      enum:
      - unknown
      - apt
      - malware
      - securityPersonnel
      - securityTesting
      - unwantedSoftware
      - other
      - multiStagedAttack
      - compromisedAccount
      - phishing
      - maliciousUserActivity
      - notMalicious
      - notEnoughDataToValidate
      - confirmedActivity
      - lineOfBusinessApplication
      - unknownFutureValue
      type: string
    microsoft.graph.ODataErrors.InnerError:
      title: InnerError
      required:
      - '@odata.type'
      type: object
      properties:
        request-id:
          type: string
          description: Request Id as tracked internally by the service
          nullable: true
        client-request-id:
          type: string
          description: Client request Id as sent by the client application.
          nullable: true
        date:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Date when the error occured.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.security.evidenceRole:
      title: evidenceRole
      enum:
      - unknown
      - contextual
      - scanned
      - source
      - destination
      - created
      - added
      - compromised
      - edited
      - attacked
      - attacker
      - commandAndControl
      - loaded
      - suspicious
      - policyViolator
      - unknownFutureValue
      type: string
    microsoft.graph.security.alertStatus:
      title: alertStatus
      enum:
      - unknown
      - new
      - inProgress
      - resolved
      - unknownFutureValue
      type: string
    microsoft.graph.security.incidentCollectionResponse:
      title: Collection of incident
      type: object
      allOf:
      - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse'
      - type: object
        properties:
          value:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.security.incident'
    microsoft.graph.security.dictionary:
      title: dictionary
      required:
      - '@odata.type'
      type: object
      properties:
        '@odata.type':
          type: string
    microsoft.graph.security.incidentStatus:
      title: incidentStatus
      enum:
      - active
      - resolved
      - inProgress
      - redirected
      - unknownFutureValue
      - awaitingAction
      type: string
    microsoft.graph.security.alertCollectionResponse:
      title: Collection of alert
      type: object
      allOf:
      - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse'
      - type: object
        properties:
          value:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.security.alert'
    microsoft.graph.security.alertEvidence:
      title: alertEvidence
      required:
      - '@odata.type'
      type: object
      properties:
        createdDateTime:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: The date and time when the evidence was created and added to the alert. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
          format: date-time
        detailedRoles:
          type: array
          items:
            type: string
            nullable: true
          description: Detailed description of the entity role/s in an alert. Values are free-form.
        remediationStatus:
          $ref: '#/components/schemas/microsoft.graph.security.evidenceRemediationStatus'
        remediationStatusDetails:
          type: string
          description: Details about the remediation status.
          nullable: true
        roles:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.security.evidenceRole'
          description: The role/s that an evidence entity represents in an alert, for example, an IP address that is associated with an attacker has the evidence role Attacker.
        tags:
          type: array
          items:
            type: string
            nullable: true
          description: Array of custom tags associated with an evidence instance, for example, to denote a group of devices, high-value assets, etc.
        verdict:
          $ref: '#/components/schemas/microsoft.graph.security.evidenceVerdict'
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.security.aiAgentEvidence': '#/components/schemas/microsoft.graph.security.aiAgentEvidence'
          '#microsoft.graph.security.amazonResourceEvidence': '#/components/schemas/microsoft.graph.security.amazonResourceEvidence'
          '#microsoft.graph.security.analyzedMessageEvidence': '#/components/schemas/microsoft.graph.security.analyzedMessageEvidence'
          '#microsoft.graph.security.azureResourceEvidence': '#/components/schemas/microsoft.graph.security.azureResourceEvidence'
          '#microsoft.graph.security.blobContainerEvidence': '#/components/schemas/microsoft.graph.security.blobContainerEvidence'
          '#microsoft.graph.security.blobEvidence': '#/components/schemas/microsoft.graph.security.blobEvidence'
          '#microsoft.graph.security.cloudApplicationEvidence': '#/components/schemas/microsoft.graph.security.cloudApplicationEvidence'
          '#microsoft.graph.security.cloudLogonRequestEvidence': '#/components/schemas/microsoft.graph.security.cloudLogonRequestEvidence'
          '#microsoft.graph.security.cloudLogonSessionEvidence': '#/components/schemas/microsoft.graph.security.cloudLogonSessionEvidence'
          '#microsoft.graph.security.containerEvidence': '#/components/schemas/microsoft.graph.security.containerEvidence'
          '#microsoft.graph.security.containerImageEvidence': '#/components/schemas/microsoft.graph.security.containerImageEvidence'
          '#microsoft.graph.security.containerRegistryEvidence': '#/components/schemas/microsoft.graph.security.containerRegistryEvidence'
          '#microsoft.graph.security.deviceEvidence': '#/components/schemas/microsoft.graph.security.deviceEvidence'
          '#microsoft.graph.security.dnsEvidence': '#/components/schemas/microsoft.graph.security.dnsEvidence'
          '#microsoft.graph.security.fileEvidence': '#/components/schemas/microsoft.graph.security.fileEvidence'
          '#microsoft.graph.security.fileHashEvidence': '#/components/schemas/microsoft.graph.security.fileHashEvidence'
          '#microsoft.graph.security.gitHubOrganizationEvidence': '#/components/schemas/microsoft.graph.security.gitHubOrganizationEvidence'
          '#microsoft.graph.security.gitHubRepoEvidence': '#/components/schemas/microsoft.graph.security.gitHubRepoEvidence'
          '#microsoft.graph.security.gitHubUserEvidence': '#/components/schemas/microsoft.graph.security.gitHubUserEvidence'
          '#microsoft.graph.security.googleCloudResourceEvidence': '#/components/schemas/microsoft.graph.security.googleCloudResourceEvidence'
          '#microsoft.graph.security.hostLogonSessionEvidence': '#/components/schemas/microsoft.graph.security.hostLogonSessionEvidence'
          '#microsoft.graph.security.ioTDeviceEvidence': '#/components/schemas/microsoft.graph.security.ioTDeviceEvidence'
          '#microsoft.graph.security.ipEvidence': '#/components/schemas/microsoft.graph.security.ipEvidence'
          '#microsoft.graph.security.kubernetesClusterEvidence': '#/components/schemas/microsoft.graph.security.kubernetesClusterEvidence'
          '#microsoft.graph.security.kubernetesControllerEvidence': '#/components/schemas/microsoft.graph.security.kubernetesControllerEvidence'
          '#microsoft.graph.security.kubernetesNamespaceEvidence': '#/components/schemas/microsoft.graph.security.kubernetesNamespaceEvidence'
          '#microsoft.graph.security.kubernetesPodEvidence': '#/components/schemas/microsoft.graph.security.kubernetesPodEvidence'
          '#microsoft.graph.security.kubernetesSecretEvidence': '#/components/schemas/microsoft.graph.security.kubernetesSecretEvidence'
          '#microsoft.graph.security.kubernetesServiceAccountEvidence': '#/components/schemas/microsoft.graph.security.kubernetesServiceAccountEvidence'
          '#microsoft.graph.security.kubernetesServiceEvidence': '#/components/schemas/microsoft.graph.security.kubernetesServiceEvidence'
          '#microsoft.graph.security.mailboxConfigurationEvidence': '#/components/schemas/microsoft.graph.security.mailboxConfigurationEvidence'
          '#microsoft.graph.security.mailboxEvidence': '#/components/schemas/microsoft.graph.security.mailboxEvidence'
          '#microsoft.graph.security.mailClusterEvidence': '#/components/schemas/microsoft.graph.security.mailClusterEvidence'
          '#microsoft.graph.security.malwareEvidence': '#/components/schemas/microsoft.graph.security.malwareEvidence'
          '#microsoft.graph.security.networkConnectionEvidence': '#/components/schemas/microsoft.graph.security.networkConnectionEvidence'
          '#microsoft.graph.security.nicEvidence': '#/components/schemas/microsoft.graph.security.nicEvidence'
          '#microsoft.graph.security.oauthApplicationEvidence': '#/components/schemas/microsoft.graph.security.oauthApplicationEvidence'
          '#microsoft.graph.security.processEvidence': '#/components/schemas/microsoft.graph.security.processEvidence'
          '#microsoft.graph.security.registryKeyEvidence': '#/components/schemas/microsoft.graph.security.registryKeyEvidence'
          '#microsoft.graph.security.registryValueEvidence': '#/components/schemas/microsoft.graph.security.registryValueEvidence'
          '#microsoft.graph.security.sasTokenEvidence': '#/components/schemas/microsoft.graph.security.sasTokenEvidence'
          '#microsoft.graph.security.securityGroupEvidence': '#/components/schemas/microsoft.graph.security.securityGroupEvidence'
          '#microsoft.graph.security.servicePrincipalEvidence': '#/components/schemas/microsoft.graph.security.servicePrincipalEvidence'
          '#microsoft.graph.security.submissionMailEvidence': '#/components/schemas/microsoft.graph.security.submissionMailEvidence'
          '#microsoft.graph.security.teamsMessageEvidence': '#/components/schemas/microsoft.graph.security.teamsMessageEvidence'
          '#microsoft.graph.security.urlEvidence': '#/components/schemas/microsoft.graph.security.urlEvidence'
          '#microsoft.graph.security.userEvidence': '#/components/schemas/microsoft.graph.security.userEvidence'
    microsoft.graph.security.alertClassification:
      title: alertClassification
      enum:
      - unknown
      - falsePositive
      - truePositive
      - informationalExpectedActivity
      - unknownFutureValue
      type: string
    microsoft.graph.security.incident:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: incident
        required:
        - '@odata.type'
        type: object
        properties:
          assignedTo:
            type: string
            description: Owner of the incident, or null if no owner is assigned. Free editable text.
            nullable: true
          classification:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.security.alertClassification'
            - type: object
              nullable: true
            description: 'The specification for the incident. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.'
          comments:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.security.alertComment'
            description: Array of comments created by the Security Operations (SecOps) team when the incident is managed.
          createdDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Time when the incident was first created.
            format: date-time
          customTags:
            type: array
            items:
              type: string
              nullable: true
            description: Array of custom tags associated with an incident.
          description:
            type: string
            description: Description of the incident.
            nullable: true
          determination:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
            - type: object
              nullable: true
            description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
          displayName:
            type: string
            description: The incident name.
            nullable: true
          incidentWebUrl:
            type: string
            description: The URL for the incident page in the Microsoft 365 Defender portal.
            nullable: true
          lastModifiedBy:
            type: string
            description: The identity that last modified the incident.
            nullable: true
          lastUpdateDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Time when the incident was last updated.
            format: date-time
          redirectIncidentId:
            type: string
            description: Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.
            nullable: true
          resolvingComment:
            type: string
            description: User input that explains the resolution of the incident and the classification choice. This property contains free editable text.
            nullable: true
          severity:
            $ref: '#/components/schemas/microsoft.graph.security.alertSeverity'
          status:
            $ref: '#/components/schemas/microsoft.graph.security.incidentStatus'
          summary:
            type: string
            description: The overview of an attack. When applicable, the summary contains details of what occurred, impacted assets, and the type of attack.
            nullable: true
          systemTags:
            type: array
            items:
              type: string
              nullable: true
            description: The system tags associated with the incident.
          tenantId:
            type: string
            description: The Microsoft Entra tenant in which the alert was created.
            nullable: true
          alerts:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.security.alert'
            description: The list of related alerts. Supports $expand.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.security.incident'
    microsoft.graph.security.alertComment:
      title: alertComment
      required:
      - '@odata.type'
      type: object
      properties:
        comment:
          type: string
          description: The comment text.
          nullable: true
        createdByDisplayName:
          type: string
          description: The person or app name that submitted the comment.
          nullable: true
        createdDateTime:
     

# --- truncated at 32 KB (167 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-security-incident-api-openapi.yml