Contraforce · Schema
ApiResponseOfContraForceIncident
Standard v2 API response envelope for single-item responses.
SecuritySoftware-as-a-ServiceCybersecurityMicrosoftMSP
Properties
| Name | Type | Description |
|---|---|---|
| data | object | Object that represents all the data from an incident that could come from any source |
| meta | object |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-api-response-of-contra-force-incident-schema.json",
"title": "ApiResponseOfContraForceIncident",
"description": "Standard v2 API response envelope for single-item responses.",
"x-generated": "2026-11-04",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/contraforce-incidents-api-openapi.yml#/components/schemas/ApiResponseOfContraForceIncident",
"type": "object",
"properties": {
"data": {
"description": "Object that represents all the data from an incident that could come from any source",
"$ref": "#/$defs/ContraForceIncident"
},
"meta": {
"$ref": "#/$defs/ResponseMeta"
}
},
"$defs": {
"Classification": {
"enum": [
"BenignPositive",
"FalsePositive",
"TruePositive",
"Undetermined",
null
]
},
"ClassificationReason": {
"enum": [
"InaccurateData",
"IncorrectAlertLogic",
"SuspiciousActivity",
"SuspiciousButExpected",
"Unknown",
"Apt",
"Malware",
"SecurityPersonnel",
"SecurityTesting",
"UnwantedSoftware",
"Other",
"MultistagedAttack",
"CompromisedUser",
"Phishing",
"MaliciousUserActivity",
"NotMalicious",
"NoEnoughDataToValidate",
"ConfirmedUserActivity",
"LineOfBusinessApplication",
null
]
},
"ContraForceIncident": {
"type": "object",
"properties": {
"source": {
"description": "Property to retrieve the source of the incident (DefenderXDR, Sentinel, etc)",
"$ref": "#/$defs/IncidentSource"
},
"incident": {
"description": "Object to retrieve the base information of the incident",
"$ref": "#/$defs/Incident"
},
"investigationDetails": {
"description": "Object to retrieve the entities and alerts related to the incident",
"$ref": "#/$defs/IncidentInvestigationDetailsDto"
},
"evidence": {
"description": "Object to retrieve the evidence related to the incident",
"$ref": "#/$defs/GeneralTableDto"
},
"gamebookCatalog": {
"description": "(Nullable) Represents the recommended gamebook by ContraForce or the last run gamebook for the incident",
"$ref": "#/$defs/IncidentGamebooksCatalogDto"
}
},
"description": "Object that represents all the data from an incident that could come from any source"
},
"DefenderIncidentIdentifiers": {
"type": "object",
"properties": {
"incidentId": {
"type": [
"null",
"string"
],
"description": "The Defender XDR incident id."
},
"tenantId": {
"type": [
"null",
"string"
],
"description": "The Entra tenant the Defender incident belongs to, when the vendor reported it."
},
"portalUrl": {
"type": [
"null",
"string"
],
"description": "Direct link to the incident in the Microsoft Defender portal."
}
},
"description": "Microsoft Defender XDR's identifiers for an incident."
},
"EntityType": {
"enum": [
"User",
"IP",
"File",
"Process",
"Device",
"Malware",
"CloudApplication",
"DomainName",
"AzureResource",
"FileHash",
"RegistryKey",
"RegistryValue",
"SecurityGroup",
"URL",
"IoTDevice",
"Mailbox",
"MailCluster",
"MailMessage",
"Submission",
"SentinelEntities",
"DnsResolution",
"Registry",
"OAuthApplication",
"AmazonResource",
"BlobContainer",
"Blob",
"Container",
"ContainerRegistry",
"ContainerImage",
"GoogleCloudResource",
"KubernetesCluster",
"KubernetesController",
"KubernetesNamespace",
"KubernetesPod",
"KubernetesService",
"KubernetesSecret",
"KubernetesServiceAccount",
"AnalyzedMessage",
"DNS",
"Unknown"
]
},
"GamebookDto": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
},
"tracingId": {
"type": [
"null",
"string"
]
},
"incidentId": {
"type": [
"null",
"string"
]
},
"source": {
"description": "Source of the system that owns the incident Sentinel, Defender ATP, etc.",
"$ref": "#/$defs/IncidentSource"
},
"incidentTitle": {
"type": [
"null",
"string"
]
},
"incidentNumber": {
"pattern": "^-?(?:0|[1-9]\\d*)$",
"type": [
"integer",
"string"
],
"format": "int32"
},
"isOcr": {
"type": "boolean"
},
"isRecover": {
"type": "boolean"
},
"triggedByUserId": {
"type": [
"null",
"string"
]
},
"displayName": {
"type": [
"null",
"string"
]
},
"modificationDate": {
"type": "string",
"format": "date-time"
},
"creationDate": {
"type": "string",
"format": "date-time"
},
"status": {
"$ref": "#/$defs/GamebookRunningStatus"
},
"title": {
"type": [
"null",
"string"
]
},
"isAdminRequired": {
"type": "boolean"
},
"workspaceId": {
"type": [
"null",
"string"
]
},
"workspaceName": {
"type": [
"null",
"string"
]
},
"tenantId": {
"type": [
"null",
"string"
]
},
"isAutoRun": {
"type": "boolean"
},
"originalGamebookId": {
"type": [
"null",
"string"
],
"description": "Used if the gamebook is retry gamebook and refers to the id of the gamebook id that has been retried"
},
"originalGamebookTitle": {
"type": [
"null",
"string"
],
"description": "Used if the gamebook is retry gamebook and refers to the id of the gamebook title that has been retried"
},
"isRetryGamebook": {
"type": "boolean",
"description": "Indicator if the gamebook is a retry to failed gamebook"
},
"isQueued": {
"type": "boolean",
"description": "Indicator if the gamebook is queued by a service provider and it is not started yet"
},
"playbooks": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/$defs/PlaybookGameplanDto"
}
},
"summary": {
"type": [
"null",
"string"
]
}
}
},
"GamebookRunningStatus": {
"enum": [
"Pending",
"Running",
"Finished",
"Failed",
"Queued",
"Denied",
"Cancelled"
]
},
"GeneralTableDto": {
"type": "object",
"properties": {
"columns": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"rows": {
"type": [
"null",
"array"
],
"items": {
"type": "array"
}
}
}
},
"Incident": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
},
"name": {
"type": [
"null",
"string"
]
},
"displayId": {
"type": [
"null",
"string"
],
"description": "Optional human-readable identifier shown in the table and\npage heading instead of the long opaque string Incident.Id.\nPopulated for sources whose IDs are unwieldy (e.g. CrowdStrike\ncases use a 165-char base64 ID but expose a friendly\n\"`6F1-24`\"-style `reference_id`). When null, callers\nfall back to the existing short-form derivation of\nstring Incident.Id."
},
"title": {
"type": [
"null",
"string"
]
},
"description": {
"type": [
"null",
"string"
]
},
"number": {
"pattern": "^-?(?:0|[1-9]\\d*)$",
"type": [
"integer",
"string"
],
"format": "int32"
},
"type": {
"type": [
"null",
"string"
]
},
"source": {
"$ref": "#/$defs/IncidentSource"
},
"sourceDisplayName": {
"type": [
"null",
"string"
]
},
"lastModificationTime": {
"type": [
"null",
"string"
],
"description": "Date/Time represents the user's local time",
"format": "date-time"
},
"creationTime": {
"type": "string",
"description": "Date/Time represents the user's local time",
"format": "date-time"
},
"lastActivityTime": {
"type": [
"null",
"string"
],
"description": "Date/Time represents the user's local time",
"format": "date-time"
},
"severity": {
"$ref": "#/$defs/Severity"
},
"classification": {
"oneOf": [
{
"type": "null"
},
{
"$ref": "#/$defs/Classification"
}
]
},
"comment": {
"type": [
"null",
"string"
]
},
"classificationReason": {
"oneOf": [
{
"type": "null"
},
{
"$ref": "#/$defs/ClassificationReason"
}
]
},
"classificationComment": {
"type": [
"null",
"string"
]
},
"tactics": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"ruleIds": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
},
"description": "Represents the Ids of the related rules of this incidents"
},
"providerName": {
"type": [
"null",
"string"
],
"description": "The vendor that generated this incident, as the vendor reports it. Sentinel returns\n\"Azure Sentinel\", \"Microsoft 365 Defender\" or \"Microsoft XDR\"; other sources leave it null."
},
"isForwardedMirror": {
"type": "boolean",
"description": "True when this incident is the mirror of one that originated in the other Microsoft system, so\nshowing it would put the same real-world incident in the inbox twice."
},
"vendorIdentifiers": {
"description": "The identifiers of every vendor system that holds a record of this incident, for consumers that\nneed to resolve it back to the source vendor.",
"$ref": "#/$defs/IncidentVendorIdentifiers"
},
"alertProductNames": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"user": {
"description": "Represents the user assigned to work on this incident",
"$ref": "#/$defs/UserSummary"
},
"isAssigned": {
"type": "boolean"
},
"productId": {
"type": [
"null",
"string"
]
},
"status": {
"$ref": "#/$defs/Status"
},
"closedUpstreamDuringPause": {
"type": "boolean",
"description": "Set by `IncidentsManager.GetByIdAsync` reconciliation when the CF incident is in a\nCF-native pause status (Status.OnHold / Status.WaitingOnCustomer)\nbut the upstream source has reached terminal Closed. The UI uses this to render the\n\"Closed upstream while paused\" badge on the detail header. Not persisted."
},
"sourceRecordExpired": {
"type": "boolean",
"description": "True when the source no longer holds this incident's record, so only what ContraForce recorded\n(status, classification, owner, comments) can be shown."
},
"sourceLinks": {
"type": [
"null",
"array"
],
"items": {
"description": "A labeled link to an incident's record in its source console.",
"$ref": "#/$defs/IncidentSourceLink"
},
"description": "Links to this incident in the source's own console, when the source provides them (for\nexample the Sumo Logic monitor and the search behind the alert). Always absolute HTTPS URLs."
},
"alertsCount": {
"pattern": "^-?(?:0|[1-9]\\d*)$",
"type": [
"integer",
"string"
],
"format": "int32"
},
"entities": {
"type": [
"null",
"array"
],
"items": {
"description": "This class is used to unify the Entities from different sources into a ContraForce Entity",
"$ref": "#/$defs/IncidentEntity"
}
},
"workspaceName": {
"type": [
"null",
"string"
],
"description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode"
},
"workspaceId": {
"type": [
"null",
"string"
],
"description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode"
},
"isDefenderXDRSourced": {
"type": "boolean",
"description": "Determines whether the incident is originally sourced from Microsoft Defender XDR"
}
},
"description": "This incident object built on top of the Microsoft Azure Sentinel Incident and it's open to extend to any new provider"
},
"IncidentCommentDto": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
},
"message": {
"type": [
"null",
"string"
]
},
"createdTime": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"authorEmail": {
"type": [
"null",
"string"
]
},
"authorName": {
"type": [
"null",
"string"
]
},
"isActivityComment": {
"type": "boolean",
"description": "Indicates if the comment doesn't represent a written note, instead if just a system activity like status changed, priority changed, user assigned, etc."
},
"isAgentComment": {
"type": "boolean",
"description": "Indicates if the comment was authored by an AI agent rather than a human analyst."
},
"agentName": {
"type": [
"null",
"string"
],
"description": "Name of the agent that authored the comment."
},
"isClosingComment": {
"type": "boolean",
"description": "Indicates if the comment is the closing comment added when the incident was resolved or closed."
},
"ticketNoteId": {
"type": [
"null",
"string"
],
"description": "ID of the ticket note in the service ticketing system if the comment is related to a ticket note.\n(Nullable) only available if the tenant written this comment has a ticketing system enabled in their configuration."
},
"ticketId": {
"type": [
"null",
"string"
],
"description": "ID of the ticket in the service ticketing system if the comment is related to a ticket note.\n(Nullable) only available if the tenant written this comment has a ticketing system enabled in their configuration."
}
}
},
"IncidentEntity": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
},
"type": {
"$ref": "#/$defs/EntityType"
},
"kind": {
"type": [
"null",
"string"
]
},
"displayName": {
"type": [
"null",
"string"
]
},
"friendlyName": {
"type": [
"null",
"string"
]
},
"fileName": {
"type": [
"null",
"string"
]
},
"hostName": {
"type": [
"null",
"string"
]
},
"accountEntityId": {
"type": [
"null",
"string"
]
},
"deviceId": {
"type": [
"null",
"string"
]
},
"deviceAzureId": {
"type": [
"null",
"string"
]
},
"defenderAtpDeviceId": {
"type": [
"null",
"string"
]
},
"defenderEndpointDeviceId": {
"type": [
"null",
"string"
]
},
"networkMessageId": {
"type": [
"null",
"string"
]
},
"hashAlgorithm": {
"type": [
"null",
"string"
]
},
"aadUserId": {
"type": [
"null",
"string"
]
},
"emailAddress": {
"type": [
"null",
"string"
]
},
"userPrincipalName": {
"type": [
"null",
"string"
]
},
"ipAddress": {
"type": [
"null",
"string"
]
},
"fileHash": {
"type": [
"null",
"string"
]
},
"emailId": {
"type": [
"null",
"string"
]
},
"emailSubject": {
"type": [
"null",
"string"
]
}
},
"description": "This class is used to unify the Entities from different sources into a ContraForce Entity"
},
"IncidentGamebooksCatalogDto": {
"type": "object",
"properties": {
"recommended": {
"$ref": "#/$defs/RecommendedGamebookDto"
},
"lastGamebook": {
"$ref": "#/$defs/GamebookDto"
},
"isPreviousRunAvailable": {
"type": "boolean",
"description": "Indicates if the last Gamebook Run is available"
},
"isRecommendedAvailable": {
"type": "boolean",
"description": "Indicates if the recommended Gamebook is available"
},
"aiRecommendedAvailable": {
"type": "boolean",
"description": "Indicator if there is a recommended Gamebook by ContraForce"
},
"serviceProviderRecommendedAvailable": {
"type": "boolean",
"description": "Indicator if there is a recommended Gamebook by the Service Provider"
}
},
"description": "Contains the recommended gamebooks by ContraForce or the Service Provider, in addition to the last Gamebook Run associated with an Incident"
},
"IncidentInvestigationDetailsDto": {
"type": "object",
"properties": {
"entities": {
"type": [
"null",
"array"
],
"items": {
"description": "DTO that is being used for the investigation graph while retrieving the related entity of an node",
"$ref": "#/$defs/InvestigationEntityDto"
}
},
"alerts": {
"type": [
"null",
"array"
],
"items": {
"description": "DTO that is being used for the investigation graph while retrieving the related Alerts of an entity",
"$ref": "#/$defs/InvestigationAlertDto"
}
},
"incident": {
"description": "This incident object built on top of the Microsoft Azure Sentinel Incident and it's open to extend to any new provider",
"$ref": "#/$defs/Incident"
},
"incidentComment": {
"type": [
"null",
"array"
],
"items": {
"$ref": "#/$defs/IncidentCommentDto"
}
}
}
},
"IncidentSource": {
"enum": [
"Sentinel",
"DefenderXDR",
"QRadar",
"Splunk",
"CrowdStrike",
"SentinelOne",
"SumoLogic"
]
},
"IncidentSourceLink": {
"type": "object",
"properties": {
"label": {
"type": [
"null",
"string"
],
"description": "What the link opens, for example \"Monitor\" or \"Search\"."
},
"url": {
"type": [
"null",
"string"
],
"description": "Absolute HTTPS URL; producers validate it before setting it."
}
},
"description": "A labeled link to an incident's record in its source console."
},
"IncidentVendorIdentifiers": {
"type": "object",
"properties": {
"sentinel": {
"description": "Sentinel's identifiers for this incident, when it exists in Sentinel.",
"$ref": "#/$defs/SentinelIncidentIdentifiers"
},
"defender": {
"description": "Defender XDR's identifiers for this incident, when it exists in Defender XDR.",
"$ref": "#/$defs/DefenderIncidentIdentifiers"
}
},
"description": "The identifiers of every vendor system that holds a record of one incident, carried together so an\nexternal consumer can resolve the incident back to whichever system it standardizes on."
},
"InvestigationAlertDto": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
},
"kind": {
"type": [
"null",
"string"
]
},
"displayName": {
"type": [
"null",
"string"
]
},
"alertName": {
"type": [
"null",
"string"
]
},
"vendorName": {
"type": [
"null",
"string"
]
},
"type": {
"type": [
"null",
"string"
]
},
"description": {
"type": [
"null",
"string"
]
},
"timeGenerated": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"tactics": {
"type": [
"null",
"array"
],
"items": {
"type": "string"
}
},
"severity": {
"type": [
"null",
"string"
]
},
"productName": {
"type": [
"null",
"string"
]
},
"deviceId": {
"type": [
"null",
"string"
]
}
},
"description": "DTO that is being used for the investigation graph while retrieving the related Alerts of an entity"
},
"InvestigationEntityDto": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
},
"displayName": {
"type": [
"null",
"string"
]
},
"fileName": {
"type": [
"null",
"string"
]
},
"fileHash": {
"type": [
"null",
"string"
]
},
"type": {
"$ref": "#/$defs/EntityType"
},
"friendlyName": {
"type": [
"null",
"string"
]
},
"hostName": {
"type": [
"null",
"string"
]
},
"kind": {
"type": [
"null",
"string"
]
},
"accountEntityId": {
"type": [
"null",
"string"
]
},
"networkMessageId": {
"type": [
"null",
"string"
]
},
"commandLine": {
"type": [
"null",
"string"
]
},
"userUpn": {
"type": [
"null",
"string"
]
},
"deviceId": {
"type": [
"null",
"string"
]
},
"aadUserId": {
"type": [
"null",
"string"
]
},
"internetMessageId": {
"type": [
"null",
"string"
]
},
"entityType": {
"$ref": "#/$defs/PlaybookEntityType"
},
"isValidEntraIdUser": {
"type": "boolean",
"description": "True if the user is a Microsoft Entra ID user (AAD), false indicates that the user is a local user"
},
"isValidEntraIdDevice": {
"type": "boolean",
"description": "True if the device is a Microsoft Entra ID joined-device (AAD), false indicates that the device is a local device"
}
},
"description": "DTO that is being used for the investigation graph while retrieving the related entity of an node"
},
"PlaybookEntityType": {
"enum": [
"User",
"Endpoint",
"General",
"Network",
"Email"
]
},
"PlaybookGameplanDto": {
"type": "object",
"properties": {
"id": {
"type": [
"null",
"string"
]
},
"referenceId": {
"type": [
"null",
"string"
],
"description": "Stable identity of a plan item — the playbook id combined with the target it acts on.\nUsed for the gamebook plan's de-duplication, equality, and the V2 list `@key`."
},
"entityId": {
"type": [
"null",
"string"
]
},
"name": {
"type": [
"null",
"string"
]
},
"userObjectId": {
"type": [
"null",
"string"
],
"description": "Azure AD object id (GUID) of the user/mailbox a playbook should act on, supplied\ndirectly by the caller instead of being resolved from the incident's entities."
},
"userPrincipalName": {
"type": [
"null",
"string"
],
"description": "User principal name (UPN) of the user/mailbox a playbook should act on, supplied\ndirectly by the caller instead of being resolved from the incident's entities."
},
"internetMessageId": {
"type": [
"null",
"string"
],
"description": "RFC 2822 internet message id of the email an email playbook should act on, supplied\ndirectly by the caller instead of being read from the incident's email entity."
},
"description": {
"type": [
"null",
"string"
]
},
"entityType": {
"$ref": "#/$defs/PlaybookEntityType"
},
"affectedEntity": {
"type": [
"null",
"string"
]
},
"isRecommended": {
"type": "boolean"
},
"status": {
"$ref": "#/$defs/PlaybookRunningStatus"
},
"errorMessage": {
"type": [
"null",
"string"
]
},
"sequence": {
"pattern": "^-?(?:0|[1-9]\\d*)$",
"type": [
"integer",
"string"
],
"format": "int32"
},
"modificationDate": {
"type": "string",
"format": "date-time"
},
"startingDate": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"finishingDate": {
"type": [
"null",
"string"
],
"format": "date-time"
},
"executionTime": {
"type": [
"null",
"string"
],
"description": "Total execution time taken to execute the playbook, the value is null until the DateTime? PlaybookGameplanDto.FinishingDate property is populated"
},
"tracingId": {
"type": [
"null",
"string"
]
},
"parameters": {
"type": [
"null",
"object"
],
"description": "Represents the parameters of the playbooks to be sent in the message\nThe value will be populated only if the playbook is configurable (Block IP)"
},
"isAdminRequired": {
"type": "boolean"
}
}
},
"PlaybookRunningStatus": {
"enum": [
"Pending",
"Running",
"Finished",
"Failed",
"Terminated"
]
},
"RecommendedGamebookDto": {
"type": "object",
"properties": {
"aiGamebook": {
"$ref": "#/$defs/GamebookDto"
},
"serviceProviderGamebook": {
"$ref": "#/$defs/GamebookDto"
}
}
},
"ResponseMeta": {
"type": "object",
"properties": {
"requestId": {
"type": [
"null",
"string"
]
},
"timestamp": {
"type": [
"null",
"string"
]
}
}
},
"SentinelIncidentIdentifiers": {
"type": "object",
"properties": {
"armId": {
"type": [
"null",
"string"
],
"description": "The full ARM resource id, e.g.\n`/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{ws}/providers/Microsoft.SecurityInsights/incidents/{guid}`."
},
"incidentId": {
"type": [
"null",
"string"
],
"description": "The incident GUID, the last segment of string SentinelIncidentIdentifiers.ArmId."
},
"subscriptionId": {
"type": [
"null",
"string"
],
"description": "The Azure subscription holding the Log Analytics workspace."
},
"resourceGroupName": {
# --- truncated at 32 KB (33 KB total) ---
# Full source: https://artifacts.apis.io/contraforce/json-schema/contraforce-api-response-of-contra-force-incident-schema.json
Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/contraforce-api-response-of-contra-force-incident"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.