Microsoft Graph security.threatIntelligence API

openapi: 3.1.0
info:
  title: Microsoft Graph Admin Admin.admin security.threatIntelligence API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: security.threatIntelligence
  x-ms-docs-toc-type: page
paths:
  /security/threatIntelligence:
    description: Provides operations to manage the threatIntelligence property of the microsoft.graph.security entity.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get threatIntelligence from security
      operationId: security.GetThreatIntelligence
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.threatIntelligence'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Update the navigation property threatIntelligence in security
      operationId: security.UpdateThreatIntelligence
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.threatIntelligence'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.threatIntelligence'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Delete navigation property threatIntelligence for security
      operationId: security.DeleteThreatIntelligence
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articleIndicators:
    description: Provides operations to manage the articleIndicators property of the microsoft.graph.security.threatIntelligence entity.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get articleIndicator
      description: Read the properties and relationships of an articleIndicator object.
      operationId: security.threatIntelligence.ListArticleIndicators
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.articleIndicatorCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Create new navigation property to articleIndicators for security
      operationId: security.threatIntelligence.CreateArticleIndicators
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.articleIndicator'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.articleIndicator'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articleIndicators/{articleIndicator-id}:
    description: Provides operations to manage the articleIndicators property of the microsoft.graph.security.threatIntelligence entity.
    parameters:
    - name: articleIndicator-id
      in: path
      description: The unique identifier of articleIndicator
      required: true
      schema:
        type: string
      x-ms-docs-key-type: articleIndicator
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get articleIndicator
      description: Read the properties and relationships of an articleIndicator object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-articleindicator-get?view=graph-rest-1.0
      operationId: security.threatIntelligence.GetArticleIndicators
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.articleIndicator'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Update the navigation property articleIndicators in security
      operationId: security.threatIntelligence.UpdateArticleIndicators
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.articleIndicator'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.articleIndicator'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Delete navigation property articleIndicators for security
      operationId: security.threatIntelligence.DeleteArticleIndicators
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articleIndicators/{articleIndicator-id}/artifact:
    description: Provides operations to manage the artifact property of the microsoft.graph.security.indicator entity.
    parameters:
    - name: articleIndicator-id
      in: path
      description: The unique identifier of articleIndicator
      required: true
      schema:
        type: string
      x-ms-docs-key-type: articleIndicator
    x-ms-docs-grouped-path:
    - /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicator-id}/artifact
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get artifact from security
      description: The artifact related to this indicator.
      operationId: security.threatIntelligence.articleIndicators.GetArtifact
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.artifact'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articleIndicators/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get the number of the resource
      operationId: security.threatIntelligence.articleIndicators.GetCount-c9c7
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/threatIntelligence/articles:
    description: Provides operations to manage the articles property of the microsoft.graph.security.threatIntelligence entity.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph List articles
      description: Get a list of article objects, including their properties and relationships.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-threatintelligence-list-articles?view=graph-rest-1.0
      operationId: security.threatIntelligence.ListArticles
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.articleCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Create new navigation property to articles for security
      operationId: security.threatIntelligence.CreateArticles
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.article'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.article'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articles/{article-id}:
    description: Provides operations to manage the articles property of the microsoft.graph.security.threatIntelligence entity.
    parameters:
    - name: article-id
      in: path
      description: The unique identifier of article
      required: true
      schema:
        type: string
      x-ms-docs-key-type: article
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get article
      description: Read the properties and relationships of an article object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-article-get?view=graph-rest-1.0
      operationId: security.threatIntelligence.GetArticles
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.article'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Update the navigation property articles in security
      operationId: security.threatIntelligence.UpdateArticles
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.article'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.article'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Delete navigation property articles for security
      operationId: security.threatIntelligence.DeleteArticles
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articles/{article-id}/indicators:
    description: Provides operations to manage the indicators property of the microsoft.graph.security.article entity.
    parameters:
    - name: article-id
      in: path
      description: The unique identifier of article
      required: true
      schema:
        type: string
      x-ms-docs-key-type: article
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph List indicators
      description: Get a list of articleIndicator objects that represent indicators of threat or compromise related to the contents of an article.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-article-list-indicators?view=graph-rest-1.0
      operationId: security.threatIntelligence.articles.ListIndicators
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.articleIndicatorCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articles/{article-id}/indicators/{articleIndicator-id}:
    description: Provides operations to manage the indicators property of the microsoft.graph.security.article entity.
    parameters:
    - name: article-id
      in: path
      description: The unique identifier of article
      required: true
      schema:
        type: string
      x-ms-docs-key-type: article
    - name: articleIndicator-id
      in: path
      description: The unique identifier of articleIndicator
      required: true
      schema:
        type: string
      x-ms-docs-key-type: articleIndicator
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get indicators from security
      description: Indicators related to this article.
      operationId: security.threatIntelligence.articles.GetIndicators
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.articleIndicator'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/articles/{article-id}/indicators/$count:
    description: Provides operations to count the resources in the collection.
    parameters:
    - name: article-id
      in: path
      description: The unique identifier of article
      required: true
      schema:
        type: string
      x-ms-docs-key-type: article
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get the number of the resource
      operationId: security.threatIntelligence.articles.indicators.GetCount-1d6c
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/threatIntelligence/articles/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get the number of the resource
      operationId: security.threatIntelligence.articles.GetCount-3702
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/threatIntelligence/hostComponents:
    description: Provides operations to manage the hostComponents property of the microsoft.graph.security.threatIntelligence entity.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get hostComponent
      description: Read the properties and relationships of a hostComponent object.
      operationId: security.threatIntelligence.ListHostComponents
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.hostComponentCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Create new navigation property to hostComponents for security
      operationId: security.threatIntelligence.CreateHostComponents
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.hostComponent'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.hostComponent'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/hostComponents/{hostComponent-id}:
    description: Provides operations to manage the hostComponents property of the microsoft.graph.security.threatIntelligence entity.
    parameters:
    - name: hostComponent-id
      in: path
      description: The unique identifier of hostComponent
      required: true
      schema:
        type: string
      x-ms-docs-key-type: hostComponent
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get hostComponent
      description: Read the properties and relationships of a hostComponent object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/security-hostcomponent-get?view=graph-rest-1.0
      operationId: security.threatIntelligence.GetHostComponents
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.hostComponent'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Update the navigation property hostComponents in security
      operationId: security.threatIntelligence.UpdateHostComponents
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.security.hostComponent'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.hostComponent'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Delete navigation property hostComponents for security
      operationId: security.threatIntelligence.DeleteHostComponents
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/hostComponents/{hostComponent-id}/host:
    description: Provides operations to manage the host property of the microsoft.graph.security.hostComponent entity.
    parameters:
    - name: hostComponent-id
      in: path
      description: The unique identifier of hostComponent
      required: true
      schema:
        type: string
      x-ms-docs-key-type: hostComponent
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get host from security
      description: The host related to this component. This is a reverse navigation property. When navigating to components from a host, this should be assumed to be a return reference.
      operationId: security.threatIntelligence.hostComponents.GetHost
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.security.host'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /security/threatIntelligence/hostComponents/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get the number of the resource
      operationId: security.threatIntelligence.hostComponents.GetCount-3ca4
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /security/threatIntelligence/hostCookies:
    description: Provides operations to manage the hostCookies property of the microsoft.graph.security.threatIntelligence entity.
    get:
      tags:
      - security.threatIntelligence
      summary: Microsoft Graph Get hostCookie
      description: Read the properties and relationships of a hostCookie object.
      operationId: security.threatIntelligence.ListHostCookies
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.security.hostCookieCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x

# --- truncated at 32 KB (426 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-security-threatintelligence-api-openapi.yml