Skip to content

Commit 85d585b

Browse files
DanielabomDanielabom
authored
Merge pull request #25968 from microsoftgraph/main
Merge to publish
2 parents 303471b + 05cc645 commit 85d585b

File tree

7 files changed

+53
-6
lines changed

7 files changed

+53
-6
lines changed

‎api-reference/beta/api/security-incident-update.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ PATCH /security/incidents/{incidentId}
5353
|determination|microsoft.graph.security.alertDetermination|Specifies the determination of the incident. Possible values are: `unknown`, `apt`, `malware`, `securityPersonnel`, `securityTesting`, `unwantedSoftware`, `other`, `multiStagedAttack`, `compromisedAccount`, `phishing`, `maliciousUserActivity`, `notMalicious`, `notEnoughDataToValidate`, `confirmedUserActivity`, `lineOfBusinessApplication`, `unknownFutureValue`.|
5454
|displayName|String|The incident name.|
5555
|severity|microsoft.graph.security.alertSeverity|Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically, higher severity items require the most immediate attention. Possible values are: `unknown`, `informational`, `low`, `medium`, `high`, `unknownFutureValue`.|
56+
|resolvingComment|string|User input that explains the resolution of the incident and the classification choice. It contains free editable text.|
5657
|status|microsoft.graph.security.incidentStatus|The status of the incident. Possible values are: `active`, `resolved`, `redirected`, `unknownFutureValue`.|
5758
|summary|String|The overview of an attack. When applicable, the summary contains details of what occurred, impacted assets, and the type of attack.|
5859

‎api-reference/beta/resources/devicemanagement-alertrule.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ For more information, see the [monitoring](devicemanagement-monitoring.md) resou
3333

3434
|Property|Type|Description|
3535
|:---|:---|:---|
36-
|alertRuleTemplate|[microsoft.graph.deviceManagement.alertRuleTemplate](#alertruletemplate-values)|The rule template of the alert event. The possible values are: `cloudPcProvisionScenario`, `cloudPcImageUploadScenario`, `cloudPcOnPremiseNetworkConnectionCheckScenario`, `cloudPcInGracePeriodScenario`, `cloudPcFrontlineInsufficientLicensesScenario`, `cloudPcInaccessibleScenario`. Note that you must use the `Prefer: include-unknown-enum-members` request header to get the following values from this [evolvable enum](/graph/best-practices-concept#handling-future-members-in-evolvable-enumerations): `cloudPcInGracePeriodScenario`.|
36+
|alertRuleTemplate|[microsoft.graph.deviceManagement.alertRuleTemplate](#alertruletemplate-values)|The rule template of the alert event. The possible values are: `cloudPcProvisionScenario`, `cloudPcImageUploadScenario`, `cloudPcOnPremiseNetworkConnectionCheckScenario`, `unknownFutureValue`, `cloudPcInGracePeriodScenario`, `cloudPcFrontlineInsufficientLicensesScenario`, `cloudPcInaccessibleScenario`, and `cloudPcFrontlineConcurrencyScenario`. Note that you must use the `Prefer: include-unknown-enum-members` request header to get the following values from this [evolvable enum](/graph/best-practices-concept#handling-future-members-in-evolvable-enumerations): `cloudPcInGracePeriodScenario`, `cloudPcFrontlineInsufficientLicensesScenario`, `cloudPcInaccessibleScenario`, and `cloudPcFrontlineConcurrencyScenario`.|
3737
|description|String|The rule description.|
3838
|displayName|String|The display name of the rule.|
3939
|enabled|Boolean|The status of the rule that indicates whether the rule is enabled or disabled. If `true`, the rule is enabled; otherwise, the rule is disabled.|
@@ -55,6 +55,7 @@ For more information, see the [monitoring](devicemanagement-monitoring.md) resou
5555
|cloudPcInGracePeriodScenario |The alert rule was triggered when the Cloud PC entered the grace period.|
5656
|cloudPcFrontlineInsufficientLicensesScenario| The alert rule was triggered for the Frontline Cloud PCs where more concurrent Cloud PC connections were active than the concurrency limit allows.|
5757
|cloudPcInaccessibleScenario| The alert rule was triggered when Cloud PCs couldn't connect due to host health failure, connection errors, or a zone outage. Alternatively, because they were under provisioning or restoring device status.|
58+
|cloudPcFrontlineConcurrencyScenario| Indicates that the alert rule was triggered for all conditions of the Frontline Cloud PCs concurrency usage. It includes buffer usage conditions for now.|
5859

5960
### ruleSeverityType values
6061

‎api-reference/beta/resources/devicemanagement-rulecondition.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,9 @@ Represents the rule conditions for an [alert rule](devicemanagement-alertrule.md
4747
|cloudPcConnectionErrors| The rule condition targets Cloud PC connection errors.|
4848
|cloudPcHostHealthCheckFailures| The rule condition targets Cloud PC host health check failures.|
4949
|cloudPcZoneOutage| The rule condition targets Cloud PC zone outage.|
50-
|unknownFutureValue| Evolvable enumeration sentinel value. Do not use.|
50+
|unknownFutureValue| Evolvable enumeration sentinel value. Don't use.|
51+
|frontlineBufferUsageDuration| The alert rule condition targets Frontline buffer usage exceeds time duration.|
52+
|frontlineBufferUsageThreshold| The alert rule condition targets Frontline buffer usage exceeds limiting frequency.|
5153

5254
### aggregationType values
5355

@@ -57,7 +59,8 @@ Represents the rule conditions for an [alert rule](devicemanagement-alertrule.md
5759
|percentage|The percentage of the items that match the rule conditions.|
5860
|affectedCloudPcCount|The total number of Cloud PCs that meet the rule conditions.|
5961
|affectedCloudPcPercentage|The percentage of Cloud PCs that meet the rule conditions.|
60-
|unknownFutureValue|Evolvable enumeration sentinel value. Do not use.|
62+
|unknownFutureValue|Evolvable enumeration sentinel value. Don't use.|
63+
|durationInMinutes| The time range during which Cloud PCs that meet the alert rule conditions are affected.|
6164

6265
### operatorType values
6366

@@ -69,7 +72,7 @@ Represents the rule conditions for an [alert rule](devicemanagement-alertrule.md
6972
|less|The operator is less than the threshold target.|
7073
|lessOrEqual|The operator is less than or equal to the threshold target.|
7174
|notEqual|The operator isn't equal to the threshold target.|
72-
|unknownFutureValue|Evolvable enumeration sentinel value. Do not use.|
75+
|unknownFutureValue|Evolvable enumeration sentinel value. Don't use.|
7376

7477
## Relationships
7578

‎api-reference/v1.0/api/security-incident-update.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ PATCH /security/incidents/{incidentId}
5151
|determination|microsoft.graph.security.alertDetermination|Specifies the determination of the incident. Possible values are: `unknown`, `apt`, `malware`, `securityPersonnel`, `securityTesting`, `unwantedSoftware`, `other`, `multiStagedAttack`, `compromisedAccount`, `phishing`, `maliciousUserActivity`, `notMalicious`, `notEnoughDataToValidate`, `confirmedUserActivity`, `lineOfBusinessApplication`, `unknownFutureValue`.|
5252
|displayName|String|The incident name.|
5353
|severity|microsoft.graph.security.alertSeverity|Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically, higher severity items require the most immediate attention. Possible values are: `unknown`, `informational`, `low`, `medium`, `high`, `unknownFutureValue`.|
54+
|resolvingComment|string|User input that explains the resolution of the incident and the classification choice. It contains free editable text.|
5455
|status|microsoft.graph.security.incidentStatus|The status of the incident. Possible values are: `active`, `resolved`, `redirected`, `unknownFutureValue`.|
5556
|summary|String|The overview of an attack. When applicable, the summary contains details of what occurred, impacted assets, and the type of attack.|
5657

‎changelog/Microsoft.DeviceManagement.Monitoring.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,47 @@
11
{
22
"changelog": [
3+
{
4+
"ChangeList": [
5+
{
6+
"Id": "2785679c-6f41-4aae-87cf-41ac2a5ca5ea",
7+
"ApiChange": "Member",
8+
"ChangedApiName": "durationInMinutes",
9+
"ChangeType": "Addition",
10+
"Description": "Added the `durationInMinutes` member to the **aggregationType** enumeration.",
11+
"Target": "aggregationType"
12+
},
13+
{
14+
"Id": "2785679c-6f41-4aae-87cf-41ac2a5ca5ea",
15+
"ApiChange": "Member",
16+
"ChangedApiName": "cloudPcFrontlineConcurrencyScenario",
17+
"ChangeType": "Addition",
18+
"Description": "Added the `cloudPcFrontlineConcurrencyScenario` member to the **alertRuleTemplate** enumeration.",
19+
"Target": "alertRuleTemplate"
20+
},
21+
{
22+
"Id": "2785679c-6f41-4aae-87cf-41ac2a5ca5ea",
23+
"ApiChange": "Member",
24+
"ChangedApiName": "frontlineBufferUsageDuration",
25+
"ChangeType": "Addition",
26+
"Description": "Added the `frontlineBufferUsageDuration` member to the **conditionCategory** enumeration.",
27+
"Target": "conditionCategory"
28+
},
29+
{
30+
"Id": "2785679c-6f41-4aae-87cf-41ac2a5ca5ea",
31+
"ApiChange": "Member",
32+
"ChangedApiName": "frontlineBufferUsageThreshold",
33+
"ChangeType": "Addition",
34+
"Description": "Added the `frontlineBufferUsageThreshold` member to the **conditionCategory** enumeration.",
35+
"Target": "conditionCategory"
36+
}
37+
],
38+
"Id": "2785679c-6f41-4aae-87cf-41ac2a5ca5ea",
39+
"Cloud": "Prod",
40+
"Version": "beta",
41+
"CreatedDateTime": "2024-11-12T10:40:03.4590295Z",
42+
"WorkloadArea": "Device and app management",
43+
"SubArea": "Cloud PC"
44+
},
345
{
446
"ChangeList": [
547
{

‎changelog/Microsoft.DirectoryServices.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"changelog": [
3-
,
43
{
54
"ChangeList": [
65
{

‎concepts/whats-new-overview.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ For details about previous updates to Microsoft Graph, see [Microsoft Graph what
2525

2626
### Security | Alerts and incidents
2727

28-
Enabled the **description**, **displayName**, and **severity** properties as supported properties in an [Update incident](/graph/api/resources/security-incident) request.
28+
Enabled the **description**, **displayName**, **resolvingComment**, and **severity** properties as supported properties in an [Update incident](/graph/api/resources/security-incident) request.
2929

3030
### Teamwork and communications | Shift management
3131

0 commit comments

Comments
 (0)