ApiResponseOfListIncidentsForWorkspacesResultDto

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-api-response-of-list-incidents-for-workspaces-result-dto-schema.json",
  "title": "ApiResponseOfListIncidentsForWorkspacesResultDto",
  "description": "Standard v2 API response envelope for single-item responses.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-cross-workspace-incidents-api-openapi.yml#/components/schemas/ApiResponseOfListIncidentsForWorkspacesResultDto",
  "type": "object",
  "properties": {
    "data": {
      "description": "Wraps the result of listing incidents for multiple workspaces in the multi-tenancy mode.",
      "$ref": "#/$defs/ListIncidentsForWorkspacesResultDto"
    },
    "meta": {
      "$ref": "#/$defs/ResponseMeta"
    }
  },
  "$defs": {
    "Classification": {
      "enum": [
        "BenignPositive",
        "FalsePositive",
        "TruePositive",
        "Undetermined",
        null
      ]
    },
    "ClassificationReason": {
      "enum": [
        "InaccurateData",
        "IncorrectAlertLogic",
        "SuspiciousActivity",
        "SuspiciousButExpected",
        "Unknown",
        "Apt",
        "Malware",
        "SecurityPersonnel",
        "SecurityTesting",
        "UnwantedSoftware",
        "Other",
        "MultistagedAttack",
        "CompromisedUser",
        "Phishing",
        "MaliciousUserActivity",
        "NotMalicious",
        "NoEnoughDataToValidate",
        "ConfirmedUserActivity",
        "LineOfBusinessApplication",
        null
      ]
    },
    "DefenderIncidentIdentifiers": {
      "type": "object",
      "properties": {
        "incidentId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Defender XDR incident id."
        },
        "tenantId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Entra tenant the Defender incident belongs to, when the vendor reported it."
        },
        "portalUrl": {
          "type": [
            "null",
            "string"
          ],
          "description": "Direct link to the incident in the Microsoft Defender portal."
        }
      },
      "description": "Microsoft Defender XDR's identifiers for an incident."
    },
    "EntityType": {
      "enum": [
        "User",
        "IP",
        "File",
        "Process",
        "Device",
        "Malware",
        "CloudApplication",
        "DomainName",
        "AzureResource",
        "FileHash",
        "RegistryKey",
        "RegistryValue",
        "SecurityGroup",
        "URL",
        "IoTDevice",
        "Mailbox",
        "MailCluster",
        "MailMessage",
        "Submission",
        "SentinelEntities",
        "DnsResolution",
        "Registry",
        "OAuthApplication",
        "AmazonResource",
        "BlobContainer",
        "Blob",
        "Container",
        "ContainerRegistry",
        "ContainerImage",
        "GoogleCloudResource",
        "KubernetesCluster",
        "KubernetesController",
        "KubernetesNamespace",
        "KubernetesPod",
        "KubernetesService",
        "KubernetesSecret",
        "KubernetesServiceAccount",
        "AnalyzedMessage",
        "DNS",
        "Unknown"
      ]
    },
    "Incident": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "name": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Optional human-readable identifier shown in the table and\npage heading instead of the long opaque string Incident.Id.\nPopulated for sources whose IDs are unwieldy (e.g. CrowdStrike\ncases use a 165-char base64 ID but expose a friendly\n\"`6F1-24`\"-style `reference_id`). When null, callers\nfall back to the existing short-form derivation of\nstring Incident.Id."
        },
        "title": {
          "type": [
            "null",
            "string"
          ]
        },
        "description": {
          "type": [
            "null",
            "string"
          ]
        },
        "number": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "integer",
            "string"
          ],
          "format": "int32"
        },
        "type": {
          "type": [
            "null",
            "string"
          ]
        },
        "source": {
          "$ref": "#/$defs/IncidentSource"
        },
        "sourceDisplayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "lastModificationTime": {
          "type": [
            "null",
            "string"
          ],
          "description": "Date/Time represents the user's local time",
          "format": "date-time"
        },
        "creationTime": {
          "type": "string",
          "description": "Date/Time represents the user's local time",
          "format": "date-time"
        },
        "lastActivityTime": {
          "type": [
            "null",
            "string"
          ],
          "description": "Date/Time represents the user's local time",
          "format": "date-time"
        },
        "severity": {
          "$ref": "#/$defs/Severity"
        },
        "classification": {
          "oneOf": [
            {
              "type": "null"
            },
            {
              "$ref": "#/$defs/Classification"
            }
          ]
        },
        "comment": {
          "type": [
            "null",
            "string"
          ]
        },
        "classificationReason": {
          "oneOf": [
            {
              "type": "null"
            },
            {
              "$ref": "#/$defs/ClassificationReason"
            }
          ]
        },
        "classificationComment": {
          "type": [
            "null",
            "string"
          ]
        },
        "tactics": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          }
        },
        "ruleIds": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          },
          "description": "Represents the Ids of the related rules of this incidents"
        },
        "providerName": {
          "type": [
            "null",
            "string"
          ],
          "description": "The vendor that generated this incident, as the vendor reports it. Sentinel returns\n\"Azure Sentinel\", \"Microsoft 365 Defender\" or \"Microsoft XDR\"; other sources leave it null."
        },
        "isForwardedMirror": {
          "type": "boolean",
          "description": "True when this incident is the mirror of one that originated in the other Microsoft system, so\nshowing it would put the same real-world incident in the inbox twice."
        },
        "vendorIdentifiers": {
          "description": "The identifiers of every vendor system that holds a record of this incident, for consumers that\nneed to resolve it back to the source vendor.",
          "$ref": "#/$defs/IncidentVendorIdentifiers"
        },
        "alertProductNames": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          }
        },
        "user": {
          "description": "Represents the user assigned to work on this incident",
          "$ref": "#/$defs/UserSummary"
        },
        "isAssigned": {
          "type": "boolean"
        },
        "productId": {
          "type": [
            "null",
            "string"
          ]
        },
        "status": {
          "$ref": "#/$defs/Status"
        },
        "closedUpstreamDuringPause": {
          "type": "boolean",
          "description": "Set by `IncidentsManager.GetByIdAsync` reconciliation when the CF incident is in a\nCF-native pause status (Status.OnHold / Status.WaitingOnCustomer)\nbut the upstream source has reached terminal Closed. The UI uses this to render the\n\"Closed upstream while paused\" badge on the detail header. Not persisted."
        },
        "sourceRecordExpired": {
          "type": "boolean",
          "description": "True when the source no longer holds this incident's record, so only what ContraForce recorded\n(status, classification, owner, comments) can be shown."
        },
        "sourceLinks": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "A labeled link to an incident's record in its source console.",
            "$ref": "#/$defs/IncidentSourceLink"
          },
          "description": "Links to this incident in the source's own console, when the source provides them (for\nexample the Sumo Logic monitor and the search behind the alert). Always absolute HTTPS URLs."
        },
        "alertsCount": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "integer",
            "string"
          ],
          "format": "int32"
        },
        "entities": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "This class is used to unify the Entities from different sources into a ContraForce Entity",
            "$ref": "#/$defs/IncidentEntity"
          }
        },
        "workspaceName": {
          "type": [
            "null",
            "string"
          ],
          "description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode"
        },
        "workspaceId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode"
        },
        "isDefenderXDRSourced": {
          "type": "boolean",
          "description": "Determines whether the incident is originally sourced from Microsoft Defender XDR"
        }
      },
      "description": "This incident object built on top of the Microsoft Azure Sentinel Incident and it's open to extend to any new provider"
    },
    "IncidentEntity": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "type": {
          "$ref": "#/$defs/EntityType"
        },
        "kind": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "friendlyName": {
          "type": [
            "null",
            "string"
          ]
        },
        "fileName": {
          "type": [
            "null",
            "string"
          ]
        },
        "hostName": {
          "type": [
            "null",
            "string"
          ]
        },
        "accountEntityId": {
          "type": [
            "null",
            "string"
          ]
        },
        "deviceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "deviceAzureId": {
          "type": [
            "null",
            "string"
          ]
        },
        "defenderAtpDeviceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "defenderEndpointDeviceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "networkMessageId": {
          "type": [
            "null",
            "string"
          ]
        },
        "hashAlgorithm": {
          "type": [
            "null",
            "string"
          ]
        },
        "aadUserId": {
          "type": [
            "null",
            "string"
          ]
        },
        "emailAddress": {
          "type": [
            "null",
            "string"
          ]
        },
        "userPrincipalName": {
          "type": [
            "null",
            "string"
          ]
        },
        "ipAddress": {
          "type": [
            "null",
            "string"
          ]
        },
        "fileHash": {
          "type": [
            "null",
            "string"
          ]
        },
        "emailId": {
          "type": [
            "null",
            "string"
          ]
        },
        "emailSubject": {
          "type": [
            "null",
            "string"
          ]
        }
      },
      "description": "This class is used to unify the Entities from different sources into a ContraForce Entity"
    },
    "IncidentSource": {
      "enum": [
        "Sentinel",
        "DefenderXDR",
        "QRadar",
        "Splunk",
        "CrowdStrike",
        "SentinelOne",
        "SumoLogic"
      ]
    },
    "IncidentSourceLink": {
      "type": "object",
      "properties": {
        "label": {
          "type": [
            "null",
            "string"
          ],
          "description": "What the link opens, for example \"Monitor\" or \"Search\"."
        },
        "url": {
          "type": [
            "null",
            "string"
          ],
          "description": "Absolute HTTPS URL; producers validate it before setting it."
        }
      },
      "description": "A labeled link to an incident's record in its source console."
    },
    "IncidentVendorIdentifiers": {
      "type": "object",
      "properties": {
        "sentinel": {
          "description": "Sentinel's identifiers for this incident, when it exists in Sentinel.",
          "$ref": "#/$defs/SentinelIncidentIdentifiers"
        },
        "defender": {
          "description": "Defender XDR's identifiers for this incident, when it exists in Defender XDR.",
          "$ref": "#/$defs/DefenderIncidentIdentifiers"
        }
      },
      "description": "The identifiers of every vendor system that holds a record of one incident, carried together so an\nexternal consumer can resolve the incident back to whichever system it standardizes on."
    },
    "ListIncidentsForWorkspacesResultDto": {
      "type": "object",
      "properties": {
        "incidents": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "This incident object built on top of the Microsoft Azure Sentinel Incident and it's open to extend to any new provider",
            "$ref": "#/$defs/Incident"
          },
          "description": "Incidents returned for this page across all workspaces and sources the caller\nhas access to. Aggregated and merged in time-descending order by the server."
        },
        "sourcePageTokens": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "Opaque continuation tokens for a single workspace, partitioned by incident source.",
            "$ref": "#/$defs/WorkspaceSourcePageTokens"
          },
          "description": "Opaque per-workspace, per-source continuation tokens for fetching the next\npage. Pass this value verbatim as `WorkspacePageTokens` on the next\nrequest along with `IsFirstCall = false`."
        },
        "moreIncidentsAvailable": {
          "type": "boolean",
          "description": "`true` when at least one workspace/source still has additional pages.\n        When `false`, the caller has consumed the full result set and may stop\n        paging."
        }
      },
      "description": "Wraps the result of listing incidents for multiple workspaces in the multi-tenancy mode."
    },
    "ResponseMeta": {
      "type": "object",
      "properties": {
        "requestId": {
          "type": [
            "null",
            "string"
          ]
        },
        "timestamp": {
          "type": [
            "null",
            "string"
          ]
        }
      }
    },
    "SentinelIncidentIdentifiers": {
      "type": "object",
      "properties": {
        "armId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The full ARM resource id, e.g.\n`/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{ws}/providers/Microsoft.SecurityInsights/incidents/{guid}`."
        },
        "incidentId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The incident GUID, the last segment of string SentinelIncidentIdentifiers.ArmId."
        },
        "subscriptionId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Azure subscription holding the Log Analytics workspace."
        },
        "resourceGroupName": {
          "type": [
            "null",
            "string"
          ],
          "description": "The resource group holding the Log Analytics workspace."
        },
        "workspaceName": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Log Analytics workspace name."
        },
        "incidentNumber": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "null",
            "integer",
            "string"
          ],
          "description": "The incident's number within the Sentinel workspace, when known.",
          "format": "int32"
        },
        "portalUrl": {
          "type": [
            "null",
            "string"
          ],
          "description": "Direct link to the incident in the Microsoft Sentinel portal."
        }
      },
      "description": "Microsoft Sentinel's identifiers for an incident."
    },
    "Severity": {
      "enum": [
        "Informational",
        "Low",
        "Medium",
        "High"
      ]
    },
    "Status": {
      "enum": [
        "Active",
        "New",
        "Closed",
        "OnHold",
        "WaitingOnCustomer"
      ]
    },
    "UserSummary": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "email": {
          "type": [
            "null",
            "string"
          ]
        }
      },
      "description": "Represents a light version of the user object, that is used to add reference to a specific user in a foreign entities"
    },
    "WorkspaceSourcePageTokens": {
      "type": "object",
      "properties": {
        "workspaceId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Identifier of the workspace these tokens belong to."
        },
        "sourceTokens": {
          "type": [
            "null",
            "object"
          ],
          "additionalProperties": {
            "type": "string"
          },
          "description": "Per-source continuation tokens. Each entry represents one more page of incidents\navailable from that source within this workspace; absent sources have no further\npages."
        }
      },
      "description": "Opaque continuation tokens for a single workspace, partitioned by incident source."
    }
  }
}