Skip to content

Commit 0cc163a

Browse files
LauragraLauragra
authored
Merge pull request #25228 from microsoftgraph/users/t-hareldamti/add-evidence-entities
Users/t hareldamti/add evidence entities
2 parents 2343375 + 10c40a1 commit 0cc163a

File tree

6 files changed

+372
-2
lines changed

6 files changed

+372
-2
lines changed

‎api-reference/beta/resources/security-alertevidence.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ This resource is the base type for the following evidence types:
3535
* [deviceEvidence](security-deviceevidence.md)
3636
* [fileEvidence](security-fileevidence.md)
3737
* [googleCloudResourceEvidence](security-googlecloudresourceevidence.md)
38+
* [iotDeviceEvidence](security-iotdeviceevidence.md)
3839
* [ipEvidence](security-ipevidence.md)
3940
* [kubernetesClusterEvidence](security-kubernetesclusterevidence.md)
4041
* [kubernetesControllerEvidence](security-kubernetescontrollerevidence.md)
@@ -45,6 +46,7 @@ This resource is the base type for the following evidence types:
4546
* [kubernetesServiceAccountEvidence](security-kubernetesserviceaccountevidence.md)
4647
* [mailClusterEvidence](security-mailclusterevidence.md)
4748
* [mailboxEvidence](security-mailboxevidence.md)
49+
* [nicEvidence](security-nicevidence.md)
4850
* [oauthApplicationEvidence](security-oauthapplicationevidence.md)
4951
* [processEvidence](security-processevidence.md)
5052
* [registryKeyEvidence](security-registrykeyevidence.md)
@@ -81,7 +83,7 @@ This resource is the base type for the following evidence types:
8183
| Member | Description |
8284
| :--------------------------| :--------------------------------------------- |
8385
| none | No threats were found. |
84-
| remediated | Remediation action has completed successfully. |
86+
| remediated | Remediation action completed successfully. |
8587
| prevented | The threat was prevented from executing. |
8688
| blocked | The threat was blocked while executing. |
8789
| notFound | The evidence wasn't found. |

‎api-reference/beta/resources/security-iotdeviceevidence.md

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
---
2+
title: "iotDeviceEvidence resource type"
3+
description: "Represents an IoT device that is reported as part of the security detection alert."
4+
author: "hareldamti"
5+
ms.localizationpriority: medium
6+
ms.subservice: "security"
7+
doc_type: resourcePageType
8+
---
9+
10+
# ioTDeviceEvidence resource type
11+
12+
Namespace: microsoft.graph.security
13+
14+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
15+
16+
Represents an IoT device that is reported as part of the security detection alert.
17+
18+
Inherits from [alertEvidence](./security-alertevidence.md).
19+
20+
## Properties
21+
22+
|Property|Type|Description|
23+
|:-------|:---|:----------|
24+
|ioTHub|[microsoft.graph.security.azureResourceEvidence](./security-azureresourceevidence.md)|The **azureResourceEvidence** entity that represents the IoT Hub that the device belongs to.|
25+
|deviceId|String|The device ID.|
26+
|deviceName|String|The friendly name of the device.|
27+
|owners|Collection(String)|The owners for the device.|
28+
|ioTSecurityAgentId|String|The ID of the Azure Security Center for the IoT agent that is running on the device.|
29+
|deviceType|String|The type of the device. For example, "temperature sensor," "freezer," "wind turbine," and so on.|
30+
|source|String|The source (microsoft/vendor) of the device entity.|
31+
|sourceRef|[microsoft.graph.security.urlEvidence](./security-urlevidence.md)|A URL reference to the source item where the device is managed.|
32+
|manufacturer|String|The manufacturer of the device.|
33+
|model|String|The model of the device.|
34+
|operatingSystem|String|The operating system the device is running.|
35+
|ipAddress|[microsoft.graph.security.ipEvidence](./security-ipevidence.md)|The current IP address of the device.|
36+
|macAddress|String|The MAC address of the device.|
37+
|nics|Collection([microsoft.graph.security.nicEvidence](./security-nicevidence.md))|The current network interface controllers on the device.|
38+
|protocols|Collection(String)|The list of protocols that the device supports.|
39+
|serialNumber|String|The serial number of the device.|
40+
|site|String|The site location of the device.|
41+
|zone|String|The zone location of the device within a site.|
42+
|sensor|String|The sensor that monitors the device.|
43+
|importance|[microsoft.graph.security.ioTDeviceImportanceType](#iotdeviceimportancetype-values)|The importance level for the IoT device. Possible values are `low`, `normal`, `high`, and `unknownFutureValue`.|
44+
|purdueLayer|String|The Purdue Layer of the device.|
45+
|isProgramming|Boolean|Indicates whether the device classified as a programming device.|
46+
|isAuthorized|Boolean|Indicates whether the device classified as an authorized device.|
47+
|isScanner|Boolean|Indicates whether the device classified as a scanner.|
48+
|devicePageLink|String|The URL to the device page in the IoT Defender portal.|
49+
|deviceSubType|String|The device subtype.|
50+
51+
### ioTDeviceImportanceType values
52+
|Member|Description |
53+
|:---|:---|
54+
|low| Low importance. |
55+
|normal| Normal importance. |
56+
|high| High importance.|
57+
|unknownFutureValue| Evolvable enumeration sentinel value. Do not use. |
58+
59+
## Relationships
60+
None.
61+
62+
## JSON representation
63+
64+
The following JSON representation shows the resource type.
65+
<!-- {
66+
"blockType": "resource",
67+
"@odata.type": "microsoft.graph.security.ioTDeviceEvidence"
68+
}
69+
-->
70+
``` json
71+
{
72+
"@odata.type": "#microsoft.graph.security.ioTDeviceEvidence",
73+
"createdDateTime": "String (timestamp)",
74+
"verdict": "String",
75+
"remediationStatus": "String",
76+
"remediationStatusDetails": "String",
77+
"roles": [
78+
"String"
79+
],
80+
"tags": [
81+
"String"
82+
],
83+
"iotHub": {
84+
"@odata.type": "microsoft.graph.security.azureResourceEvidence"
85+
},
86+
"deviceId": "String",
87+
"deviceName": "String",
88+
"owners": [
89+
"String"
90+
],
91+
"iotSecuritySolutionId": "Guid",
92+
"deviceType": "String",
93+
"deviceTypeId": "String",
94+
"source": "String",
95+
"sourceRef": {
96+
"@odata.type": "microsoft.graph.security.urlEvidence"
97+
},
98+
"manufacturer": "String",
99+
"model": "String",
100+
"operatingSystem": "String",
101+
"ipAddress": {
102+
"@odata.type": "microsoft.graph.security.ipEvidence"
103+
},
104+
"nics": [
105+
{
106+
"@odata.type": "microsoft.graph.security.nicEvidence"
107+
},
108+
],
109+
"protocols": [
110+
"String"
111+
],
112+
"serialNumber": "String",
113+
"site": "String",
114+
"zone": "String",
115+
"sensor": "String",
116+
"importance": {
117+
"@odata.type": "microsoft.graph.security.ioTDeviceImportanceType"
118+
},
119+
"purdueLayer": "String",
120+
"isProgramming": "Boolean",
121+
"isAuthorized": "Boolean",
122+
"isScanner": "Boolean",
123+
"devicePageLink": "String",
124+
"deviceSubType": "String",
125+
}
126+
```

‎api-reference/beta/resources/security-nicevidence.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
title: "nicEvidence resource type"
3+
description: "Represents a NIC (v2) entity that is reported as part of the security detection alert."
4+
author: "hareldamti"
5+
ms.localizationpriority: medium
6+
ms.subservice: "security"
7+
doc_type: resourcePageType
8+
---
9+
10+
# nicEvidence resource type
11+
12+
Namespace: microsoft.graph.security
13+
14+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
15+
16+
Represents a NIC (v2) entity that is reported as part of the security detection alert.
17+
18+
Inherits from [alertEvidence](./security-alertevidence.md).
19+
20+
## Properties
21+
22+
|Property|Type|Description|
23+
|:-------|:---|:----------|
24+
|macAddress|String|The MAC address of the NIC.|
25+
|ipAddress|[microsoft.graph.security.ipEvidence](./security-ipevidence.md)|The current IP address of the NIC.|
26+
|vlans|Collection(String)|The current virtual local area networks of the NIC.|
27+
28+
## Relationships
29+
None.
30+
31+
## JSON representation
32+
The following JSON representation shows the resource type.
33+
<!-- {
34+
"blockType": "resource",
35+
"@odata.type": "microsoft.graph.security.nicEvidence"
36+
}
37+
-->
38+
``` json
39+
{
40+
"@odata.type": "#microsoft.graph.security.nicEvidence",
41+
"createdDateTime": "String (timestamp)",
42+
"verdict": "String",
43+
"remediationStatus": "String",
44+
"remediationStatusDetails": "String",
45+
"roles": [
46+
"String"
47+
],
48+
"tags": [
49+
"String"
50+
],
51+
"macAddress": "String",
52+
"ipAddress": {
53+
"@odata.type": "microsoft.graph.security.ipEvidence",
54+
},
55+
"vlans": [
56+
"String"
57+
],
58+
}
59+
```

‎api-reference/v1.0/resources/security-alertevidence.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,16 +33,18 @@ This resource is the base type for the following evidence types:
3333
* [deviceEvidence](security-deviceevidence.md)
3434
* [fileEvidence](security-fileevidence.md)
3535
* [googleCloudResourceEvidence](security-googlecloudresourceevidence.md)
36+
* [iotDeviceEvidence](security-iotdeviceevidence.md)
3637
* [ipEvidence](security-ipevidence.md)
3738
* [kubernetesClusterEvidence](security-kubernetesclusterevidence.md)
3839
* [kubernetesControllerEvidence](security-kubernetescontrollerevidence.md)
3940
* [kubernetesNamespaceEvidence](security-kubernetesnamespaceevidence.md)
4041
* [kubernetesPodEvidence](security-kubernetespodevidence.md)
4142
* [kubernetesSecretEvidence](security-kubernetessecretevidence.md)
42-
* [kubernetesServiceAccountEvidence](security-kubernetesserviceaccountevidence.md)
4343
* [kubernetesServiceEvidence](security-kubernetesserviceevidence.md)
44+
* [kubernetesServiceAccountEvidence](security-kubernetesserviceaccountevidence.md)
4445
* [mailClusterEvidence](security-mailclusterevidence.md)
4546
* [mailboxEvidence](security-mailboxevidence.md)
47+
* [nicEvidence](security-nicevidence.md)
4648
* [oauthApplicationEvidence](security-oauthapplicationevidence.md)
4749
* [processEvidence](security-processevidence.md)
4850
* [registryKeyEvidence](security-registrykeyevidence.md)

‎api-reference/v1.0/resources/security-iotdeviceevidence.md

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
---
2+
title: "IotDeviceEvidence resource type"
3+
description: "Represents a IoT device that is reported as part of the security detection alert."
4+
author: "hareldamti"
5+
ms.localizationpriority: medium
6+
ms.subservice: "security"
7+
doc_type: resourcePageType
8+
---
9+
10+
# IoTDeviceEvidence resource type
11+
12+
Namespace: microsoft.graph.security
13+
14+
Represents a IoT device that is reported as part of the security detection alert.
15+
16+
Inherits from [alertEvidence](./security-alertevidence.md).
17+
18+
## Properties
19+
20+
|Property|Type|Description|
21+
|:-------|:---|:----------|
22+
|ioTHub|[microsoft.graph.security.azureResourceEvidence](./security-azureresourceevidence.md)|The **azureResourceEvidence** entity that represents the IoT Hub that the device belongs to.|
23+
|deviceId|String|The device ID.|
24+
|deviceName|String|The friendly name of the device.|
25+
|owners|Collection(String)|The owners for the device.|
26+
|ioTSecurityAgentId|String|The ID of the Azure Security Center for the IoT agent that is running on the device.|
27+
|deviceType|String|The type of the device. For example, "temperature sensor," "freezer," "wind turbine," and so on.|
28+
|source|String|The source (microsoft/vendor) of the device entity.|
29+
|sourceRef|[microsoft.graph.security.urlEvidence](./security-urlevidence.md)|A URL reference to the source item where the device is managed.|
30+
|manufacturer|String|The manufacturer of the device.|
31+
|model|String|The model of the device.|
32+
|operatingSystem|String|The operating system the device is running.|
33+
|ipAddress|[microsoft.graph.security.ipEvidence](./security-ipevidence.md)|The current IP address of the device.|
34+
|macAddress|String|The MAC address of the device.|
35+
|nics|Collection([microsoft.graph.security.nicEvidence](./security-nicevidence.md))|The current network interface controllers on the device.|
36+
|protocols|Collection(String)|The list of protocols that the device supports.|
37+
|serialNumber|String|The serial number of the device.|
38+
|site|String|The site location of the device.|
39+
|zone|String|The zone location of the device within a site.|
40+
|sensor|String|The sensor that monitors the device.|
41+
|importance|[microsoft.graph.security.ioTDeviceImportanceType](#iotdeviceimportancetype-values)|The importance level for the IoT device. Possible values are `low`, `normal`, `high`, and `unknownFutureValue`.|
42+
|purdueLayer|String|The Purdue Layer of the device.|
43+
|isProgramming|Boolean|Indicates whether the device classified as a programming device.|
44+
|isAuthorized|Boolean|Indicates whether the device classified as an authorized device.|
45+
|isScanner|Boolean|Indicates whether the device classified as a scanner.|
46+
|devicePageLink|String|The URL to the device page in the IoT Defender portal.|
47+
|deviceSubType|String|The device subtype.|
48+
49+
### ioTDeviceImportanceType values
50+
|Member|Description |
51+
|:---|:---|
52+
|low| Low importance. |
53+
|normal| Normal importance. |
54+
|high| High importance.|
55+
|unknownFutureValue| Evolvable enumeration sentinel value. Do not use. |
56+
57+
## Relationships
58+
None.
59+
60+
## JSON representation
61+
62+
The following JSON representation shows the resource type.
63+
<!-- {
64+
"blockType": "resource",
65+
"@odata.type": "microsoft.graph.security.ioTDeviceEvidence"
66+
}
67+
-->
68+
``` json
69+
{
70+
"@odata.type": "#microsoft.graph.security.ioTDeviceEvidence",
71+
"createdDateTime": "String (timestamp)",
72+
"verdict": "String",
73+
"remediationStatus": "String",
74+
"remediationStatusDetails": "String",
75+
"roles": [
76+
"String"
77+
],
78+
"tags": [
79+
"String"
80+
],
81+
"iotHub": {
82+
"@odata.type": "microsoft.graph.security.azureResourceEvidence"
83+
},
84+
"deviceId": "String",
85+
"deviceName": "String",
86+
"owners": [
87+
"String"
88+
],
89+
"iotSecuritySolutionId": "Guid",
90+
"deviceType": "String",
91+
"deviceTypeId": "String",
92+
"source": "String",
93+
"sourceRef": {
94+
"@odata.type": "microsoft.graph.security.urlEvidence"
95+
},
96+
"manufacturer": "String",
97+
"model": "String",
98+
"operatingSystem": "String",
99+
"ipAddress": {
100+
"@odata.type": "microsoft.graph.security.ipEvidence"
101+
},
102+
"nics": [
103+
{
104+
"@odata.type": "microsoft.graph.security.nicEvidence"
105+
},
106+
],
107+
"protocols": [
108+
"String"
109+
],
110+
"serialNumber": "String",
111+
"site": "String",
112+
"zone": "String",
113+
"sensor": "String",
114+
"importance": {
115+
"@odata.type": "microsoft.graph.security.IoTDeviceImportanceType"
116+
},
117+
"purdueLayer": "String",
118+
"isProgramming": "Boolean",
119+
"isAuthorized": "Boolean",
120+
"isScanner": "Boolean",
121+
"devicePageLink": "String",
122+
"deviceSubType": "String",
123+
}
124+
```

0 commit comments

Comments
 (0)