Microsoft Graph Security.incident API

openapi: 3.1.0
info:
  title: Microsoft Graph Admin Admin.admin Security.incident API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: Security.incident
  x-ms-docs-toc-type: page
paths:
  /security/incidents:
    description: Provides operations to manage the incidents property of the microsoft.graph.security entity.
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph List incidents
      description: Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident. This operation allows you to filter and sort through incidents to create an informed cyber security response. It exposes a collection of incidents that were flagged in your network, within the time range you specified in your environment retention policy. The most recent incidents are displayed at the top of the list.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-list-incidents?view=graph-rest-1.0
      operationId: security.ListIncidents
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.incidentCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - Security.incident
      summary: Microsoft Graph Create new navigation property to incidents for security
      operationId: security.CreateIncidents
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.incident'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.incident'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}:
    description: Provides operations to manage the incidents property of the microsoft.graph.security entity.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get incident
      description: Retrieve the properties and relationships of an incident object. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacker into an incident.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-incident-get?view=graph-rest-1.0
      operationId: security.GetIncidents
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.incident'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - Security.incident
      summary: Microsoft Graph Update incident
      description: Update the properties of an incident object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-incident-update?view=graph-rest-1.0
      operationId: security.UpdateIncidents
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.incident'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.incident'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - Security.incident
      summary: Microsoft Graph Delete navigation property incidents for security
      operationId: security.DeleteIncidents
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}/alerts:
    description: Provides operations to manage the alerts property of the microsoft.graph.security.incident entity.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get alerts from security
      description: The list of related alerts. Supports $expand.
      operationId: security.incidents.ListAlerts
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.alertCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}/alerts/{alert-id}:
    description: Provides operations to manage the alerts property of the microsoft.graph.security.incident entity.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get alerts from security
      description: The list of related alerts. Supports $expand.
      operationId: security.incidents.GetAlerts
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.alert'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/incidents/{incident-id}/alerts/{alert-id}/comments:
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    post:
      tags:
      - Security.incident
      summary: Microsoft Graph Sets a new value for the collection of alertComment.
      operationId: security.incidents.alerts.SetComments
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      requestBody:
        description: New property values
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/microsoft.graph.security.alertComment'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/microsoft.graph.security.alertComment'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/incidents/{incident-id}/alerts/{alert-id}/comments/$count:
    description: Provides operations to count the resources in the collection.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    - name: alert-id
      in: path
      description: The unique identifier of alert
      required: true
      schema:
        type: string
      x-ms-docs-key-type: alert
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get the number of the resource
      operationId: security.incidents.alerts.Comments.GetCount-ee8f
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/incidents/{incident-id}/alerts/$count:
    description: Provides operations to count the resources in the collection.
    parameters:
    - name: incident-id
      in: path
      description: The unique identifier of incident
      required: true
      schema:
        type: string
      x-ms-docs-key-type: incident
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get the number of the resource
      operationId: security.incidents.alerts.GetCount-d6ba
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/incidents/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - Security.incident
      summary: Microsoft Graph Get the number of the resource
      operationId: security.incidents.GetCount-9725
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
components:
  schemas:
    microsoft.graph.security.alertEvidence:
      title: alertEvidence
      required:
      - '@odata.type'
      type: object
      properties:
        createdDateTime:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: The date and time when the evidence was created and added to the alert. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
          format: date-time
        detailedRoles:
          type: array
          items:
            type: string
            nullable: true
          description: Detailed description of the entity role/s in an alert. Values are free-form.
        remediationStatus:
          $ref: '#/components/schemas/microsoft.graph.security.evidenceRemediationStatus'
        remediationStatusDetails:
          type: string
          description: Details about the remediation status.
          nullable: true
        roles:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.security.evidenceRole'
          description: The role/s that an evidence entity represents in an alert, for example, an IP address that is associated with an attacker has the evidence role Attacker.
        tags:
          type: array
          items:
            type: string
            nullable: true
          description: Array of custom tags associated with an evidence instance, for example, to denote a group of devices, high-value assets, etc.
        verdict:
          $ref: '#/components/schemas/microsoft.graph.security.evidenceVerdict'
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.security.aiAgentEvidence': '#/components/schemas/microsoft.graph.security.aiAgentEvidence'
          '#microsoft.graph.security.amazonResourceEvidence': '#/components/schemas/microsoft.graph.security.amazonResourceEvidence'
          '#microsoft.graph.security.analyzedMessageEvidence': '#/components/schemas/microsoft.graph.security.analyzedMessageEvidence'
          '#microsoft.graph.security.azureResourceEvidence': '#/components/schemas/microsoft.graph.security.azureResourceEvidence'
          '#microsoft.graph.security.blobContainerEvidence': '#/components/schemas/microsoft.graph.security.blobContainerEvidence'
          '#microsoft.graph.security.blobEvidence': '#/components/schemas/microsoft.graph.security.blobEvidence'
          '#microsoft.graph.security.cloudApplicationEvidence': '#/components/schemas/microsoft.graph.security.cloudApplicationEvidence'
          '#microsoft.graph.security.cloudLogonRequestEvidence': '#/components/schemas/microsoft.graph.security.cloudLogonRequestEvidence'
          '#microsoft.graph.security.cloudLogonSessionEvidence': '#/components/schemas/microsoft.graph.security.cloudLogonSessionEvidence'
          '#microsoft.graph.security.containerEvidence': '#/components/schemas/microsoft.graph.security.containerEvidence'
          '#microsoft.graph.security.containerImageEvidence': '#/components/schemas/microsoft.graph.security.containerImageEvidence'
          '#microsoft.graph.security.containerRegistryEvidence': '#/components/schemas/microsoft.graph.security.containerRegistryEvidence'
          '#microsoft.graph.security.deviceEvidence': '#/components/schemas/microsoft.graph.security.deviceEvidence'
          '#microsoft.graph.security.dnsEvidence': '#/components/schemas/microsoft.graph.security.dnsEvidence'
          '#microsoft.graph.security.fileEvidence': '#/components/schemas/microsoft.graph.security.fileEvidence'
          '#microsoft.graph.security.fileHashEvidence': '#/components/schemas/microsoft.graph.security.fileHashEvidence'
          '#microsoft.graph.security.gitHubOrganizationEvidence': '#/components/schemas/microsoft.graph.security.gitHubOrganizationEvidence'
          '#microsoft.graph.security.gitHubRepoEvidence': '#/components/schemas/microsoft.graph.security.gitHubRepoEvidence'
          '#microsoft.graph.security.gitHubUserEvidence': '#/components/schemas/microsoft.graph.security.gitHubUserEvidence'
          '#microsoft.graph.security.googleCloudResourceEvidence': '#/components/schemas/microsoft.graph.security.googleCloudResourceEvidence'
          '#microsoft.graph.security.hostLogonSessionEvidence': '#/components/schemas/microsoft.graph.security.hostLogonSessionEvidence'
          '#microsoft.graph.security.ioTDeviceEvidence': '#/components/schemas/microsoft.graph.security.ioTDeviceEvidence'
          '#microsoft.graph.security.ipEvidence': '#/components/schemas/microsoft.graph.security.ipEvidence'
          '#microsoft.graph.security.kubernetesClusterEvidence': '#/components/schemas/microsoft.graph.security.kubernetesClusterEvidence'
          '#microsoft.graph.security.kubernetesControllerEvidence': '#/components/schemas/microsoft.graph.security.kubernetesControllerEvidence'
          '#microsoft.graph.security.kubernetesNamespaceEvidence': '#/components/schemas/microsoft.graph.security.kubernetesNamespaceEvidence'
          '#microsoft.graph.security.kubernetesPodEvidence': '#/components/schemas/microsoft.graph.security.kubernetesPodEvidence'
          '#microsoft.graph.security.kubernetesSecretEvidence': '#/components/schemas/microsoft.graph.security.kubernetesSecretEvidence'
          '#microsoft.graph.security.kubernetesServiceAccountEvidence': '#/components/schemas/microsoft.graph.security.kubernetesServiceAccountEvidence'
          '#microsoft.graph.security.kubernetesServiceEvidence': '#/components/schemas/microsoft.graph.security.kubernetesServiceEvidence'
          '#microsoft.graph.security.mailboxConfigurationEvidence': '#/components/schemas/microsoft.graph.security.mailboxConfigurationEvidence'
          '#microsoft.graph.security.mailboxEvidence': '#/components/schemas/microsoft.graph.security.mailboxEvidence'
          '#microsoft.graph.security.mailClusterEvidence': '#/components/schemas/microsoft.graph.security.mailClusterEvidence'
          '#microsoft.graph.security.malwareEvidence': '#/components/schemas/microsoft.graph.security.malwareEvidence'
          '#microsoft.graph.security.networkConnectionEvidence': '#/components/schemas/microsoft.graph.security.networkConnectionEvidence'
          '#microsoft.graph.security.nicEvidence': '#/components/schemas/microsoft.graph.security.nicEvidence'
          '#microsoft.graph.security.oauthApplicationEvidence': '#/components/schemas/microsoft.graph.security.oauthApplicationEvidence'
          '#microsoft.graph.security.processEvidence': '#/components/schemas/microsoft.graph.security.processEvidence'
          '#microsoft.graph.security.registryKeyEvidence': '#/components/schemas/microsoft.graph.security.registryKeyEvidence'
          '#microsoft.graph.security.registryValueEvidence': '#/components/schemas/microsoft.graph.security.registryValueEvidence'
          '#microsoft.graph.security.sasTokenEvidence': '#/components/schemas/microsoft.graph.security.sasTokenEvidence'
          '#microsoft.graph.security.securityGroupEvidence': '#/components/schemas/microsoft.graph.security.securityGroupEvidence'
          '#microsoft.graph.security.servicePrincipalEvidence': '#/components/schemas/microsoft.graph.security.servicePrincipalEvidence'
          '#microsoft.graph.security.submissionMailEvidence': '#/components/schemas/microsoft.graph.security.submissionMailEvidence'
          '#microsoft.graph.security.teamsMessageEvidence': '#/components/schemas/microsoft.graph.security.teamsMessageEvidence'
          '#microsoft.graph.security.urlEvidence': '#/components/schemas/microsoft.graph.security.urlEvidence'
          '#microsoft.graph.security.userEvidence': '#/components/schemas/microsoft.graph.security.userEvidence'
    microsoft.graph.security.dictionary:
      title: dictionary
      required:
      - '@odata.type'
      type: object
      properties:
        '@odata.type':
          type: string
    microsoft.graph.entity:
      title: entity
      required:
      - '@odata.type'
      type: object
      properties:
        id:
          type: string
          description: The unique identifier for an entity. Read-only.
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.accessPackage': '#/components/schemas/microsoft.graph.accessPackage'
          '#microsoft.graph.accessPackageAssignment': '#/components/schemas/microsoft.graph.accessPackageAssignment'
          '#microsoft.graph.accessPackageAssignmentPolicy': '#/components/schemas/microsoft.graph.accessPackageAssignmentPolicy'
          '#microsoft.graph.accessPackageAssignmentRequest': '#/components/schemas/microsoft.graph.accessPackageAssignmentRequest'
          '#microsoft.graph.accessPackageCatalog': '#/components/schemas/microsoft.graph.accessPackageCatalog'
          '#microsoft.graph.accessPackageQuestion': '#/components/schemas/microsoft.graph.accessPackageQuestion'
          '#microsoft.graph.accessPackageMultipleChoiceQuestion': '#/components/schemas/microsoft.graph.accessPackageMultipleChoiceQuestion'
          '#microsoft.graph.accessPackageTextInputQuestion': '#/components/schemas/microsoft.graph.accessPackageTextInputQuestion'
          '#microsoft.graph.accessPackageResource': '#/components/schemas/microsoft.graph.accessPackageResource'
          '#microsoft.graph.accessPackageResourceEnvironment': '#/components/schemas/microsoft.graph.accessPackageResourceEnvironment'
          '#microsoft.graph.accessPackageResourceRequest': '#/components/schemas/microsoft.graph.accessPackageResourceRequest'
          '#microsoft.graph.accessPackageResourceRole': '#/components/schemas/microsoft.graph.accessPackageResourceRole'
          '#microsoft.graph.accessPackageResourceRoleScope': '#/components/schemas/microsoft.graph.accessPackageResourceRoleScope'
          '#microsoft.graph.accessPackageResourceScope': '#/components/schemas/microsoft.graph.accessPackageResourceScope'
          '#microsoft.graph.accessPackageSubject': '#/components/schemas/microsoft.graph.accessPackageSubject'
          '#microsoft.graph.accessReviewHistoryDefinition': '#/components/schemas/microsoft.graph.accessReviewHistoryDefinition'
          '#microsoft.graph.accessReviewHistoryInstance': '#/components/schemas/microsoft.graph.accessReviewHistoryInstance'
          '#microsoft.graph.accessReviewInstance': '#/components/schemas/microsoft.graph.accessReviewInstance'
          '#microsoft.graph.accessReviewInstanceDecisionItem': '#/components/schemas/microsoft.graph.accessReviewInstanceDecisionItem'
          '#microsoft.graph.accessReviewReviewer': '#/components/schemas/microsoft.graph.accessReviewReviewer'
          '#microsoft.graph.accessReviewScheduleDefinition': '#/components/schemas/microsoft.graph.accessReviewScheduleDefinition'
          '#microsoft.graph.accessReviewSet': '#/components/schemas/microsoft.graph.accessReviewSet'
          '#microsoft.graph.accessReviewStage': '#/components/schemas/microsoft.graph.accessReviewStage'
          '#microsoft.graph.activitiesContainer': '#/components/schemas/microsoft.graph.activitiesContainer'
          '#microsoft.graph.activityHistoryItem': '#/components/schemas/microsoft.graph.activityHistoryItem'
          '#microsoft.graph.adminConsentRequestPolicy': '#/components/schemas/microsoft.graph.adminConsentRequestPolicy'
          '#microsoft.graph.adminMicrosoft365Apps': '#/components/schemas/microsoft.graph.adminMicrosoft365Apps'
          '#microsoft.graph.adminReportSettings': '#/components/schemas/microsoft.graph.adminReportSettings'
          '#microsoft.graph.agreement': '#/components/schemas/microsoft.graph.agreement'
          '#microsoft.graph.agreementAcceptance': '#/components/schemas/microsoft.graph.agreementAcceptance'
          '#microsoft.graph.agreementFileProperties': '#/components/schemas/microsoft.graph.agreementFileProperties'
          '#microsoft.graph.agreementFile': '#/components/schemas/microsoft.graph.agreementFile'
          '#microsoft.graph.agreementFileLocalization': '#/components/schemas/microsoft.graph.agreementFileLocalization'
          '#microsoft.graph.agreementFileVersion': '#/components/schemas/microsoft.graph.agreementFileVersion'
          '#microsoft.graph.aiInteraction': '#/components/schemas/microsoft.graph.aiInteraction'
          '#microsoft.graph.aiInteractionHistory': '#/components/schemas/microsoft.graph.aiInteractionHistory'
          '#microsoft.graph.aiUser': '#/components/schemas/microsoft.graph.aiUser'
          '#microsoft.graph.alert': '#/components/schemas/microsoft.graph.alert'
          '#microsoft.graph.allowedValue': '#/components/schemas/microsoft.graph.allowedValue'
          '#microsoft.graph.appCatalogs': '#/components/schemas/microsoft.graph.appCatalogs'
          '#microsoft.graph.appConsentApprovalRoute': '#/components/schemas/microsoft.graph.appConsentApprovalRoute'
          '#microsoft.graph.appConsentRequest': '#/components/schemas/microsoft.graph.appConsentRequest'
          '#microsoft.graph.applePushNotificationCertificate': '#/components/schemas/microsoft.graph.applePushNotificationCertificate'
          '#microsoft.graph.applicationTemplate': '#/components/schemas/microsoft.graph.applicationTemplate'
          '#microsoft.graph.appLogCollectionRequest': '#/components/schemas/microsoft.graph.appLogCollectionRequest'
          '#microsoft.graph.approval': '#/components/schemas/microsoft.graph.approval'
          '#microsoft.graph.approvalStage': '#/components/schemas/microsoft.graph.approvalStage'
          '#microsoft.graph.appScope': '#/components/schemas/microsoft.graph.appScope'
          '#microsoft.graph.attachment': '#/components/schemas/microsoft.graph.attachment'
          '#microsoft.graph.fileAttachment': '#/components/schemas/microsoft.graph.fileAttachment'
          '#microsoft.graph.itemAttachment': '#/components/schemas/microsoft.graph.itemAttachment'
          '#microsoft.graph.referenceAttachment': '#/components/schemas/microsoft.graph.referenceAttachment'
          '#microsoft.graph.attachmentBase': '#/components/schemas/microsoft.graph.attachmentBase'
          '#microsoft.graph.taskFileAttachment': '#/components/schemas/microsoft.graph.taskFileAttachment'
          '#microsoft.graph.attachmentSession': '#/components/schemas/microsoft.graph.attachmentSession'
          '#microsoft.graph.attackSimulationRoot': '#/components/schemas/microsoft.graph.attackSimulationRoot'
          '#microsoft.graph.attendanceRecord': '#/components/schemas/microsoft.graph.attendanceRecord'
          '#microsoft.graph.attributeMappingFunctionSchema': '#/components/schemas/microsoft.graph.attributeMappingFunctionSchema'
          '#microsoft.graph.attributeSet': '#/components/schemas/microsoft.graph.attributeSet'
          '#microsoft.graph.audioRoutingGroup': '#/components/schemas/microsoft.graph.audioRoutingGroup'
          '#microsoft.graph.auditEvent': '#/components/schemas/microsoft.graph.auditEvent'
          '#microsoft.graph.auditLogRoot': '#/components/schemas/microsoft.graph.auditLogRoot'
          '#microsoft.graph.authentication': '#/components/schemas/microsoft.graph.authentication'
          '#microsoft.graph.authenticationCombinationConfiguration': '#/components/schemas/microsoft.graph.authenticationCombinationConfiguration'
          '#microsoft.graph.fido2CombinationConfiguration': '#/components/schemas/microsoft.graph.fido2CombinationConfiguration'
          '#microsoft.graph.x509CertificateCombinationConfiguration': '#/components/schemas/microsoft.graph.x509CertificateCombinationConfiguration'
          '#microsoft.graph.authenticationContextClassReference': '#/components/schemas/microsoft.graph.authenticationContextClassReference'
          '#microsoft.graph.authenticationEventListener': '#/components/schemas/microsoft.graph.authenticationEventListener'
          '#microsoft.graph.onAttributeCollectionListener': '#/components/schemas/microsoft.graph.onAttributeCollectionListener'
          '#microsoft.graph.onAttributeCollectionStartListener': '#/components/schemas/microsoft.graph.onAttributeCollectionStartListener'
          '#microsoft.graph.onAttributeCollectionSubmitListener': '#/components/schemas/microsoft.graph.onAttributeCollectionSubmitListener'
          '#microsoft.graph.onAuthenticationMethodLoadStartListener': '#/components/schemas/microsoft.graph.onAuthenticationMethodLoadStartListener'
          '#microsoft.graph.onEmailOtpSendListener': '#/components/schemas/microsoft.graph.onEmailOtpSendListener'
          '#microsoft.graph.onFraudProtectionLoadStartListener': '#/components/schemas/microsoft.graph.onFraudProtectionLoadStartListener'
          '#microsoft.graph.onInteractiveAuthFlowStartListener': '#/components/schemas/microsoft.graph.onInteractiveAuthFlowStartListener'
          '#microsoft.graph.onTokenIssuanceStartListener': '#/components/schemas/microsoft.graph.onTokenIssuanceStartListener'
          '#microsoft.graph.onUserCreateStartListener': '#/components/schemas/microsoft.graph.onUserCreateStartListener'
          '#microsoft.graph.authenticationEventsFlow': '#/components/schemas/microsoft.graph.authenticationEventsFlow'
          '#microsoft.graph.externalUsersSelfServiceSignUpEventsFlow': '#/components/schemas/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow'
          '#microsoft.graph.authenticationFlowsPolicy': '#/components/schemas/microsoft.graph.authenticationFlowsPolicy'
          '#microsoft.graph.authenticationMethod': '#/components/schemas/microsoft.graph.authenticationMethod'
          '#microsoft.graph.emailAuthentica

# --- truncated at 32 KB (167 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-security-incident-api-openapi.yml