Skip to content

Commit bc22ad1

Browse files
DanielabomDanielabom
authored
Merge pull request #26169 from microsoftgraph/users/t-hareldamti/add-security-entity
Users/t hareldamti/add security entity
2 parents 85b3a07 + ce18873 commit bc22ad1

14 files changed

+402
-14
lines changed

‎api-reference/beta/resources/enums-security.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -883,6 +883,37 @@ Namespace: microsoft.graph.security
883883
| reasonLostInTransit |
884884
| bulk |
885885

886+
### antispamTeamsDirection values
887+
888+
| Member |
889+
| :------|
890+
| unknown |
891+
| inbound |
892+
| outbound |
893+
| intraorg |
894+
| unknownFutureValue |
895+
896+
### teamsDeliveryLocation values
897+
898+
| Member |
899+
| :------|
900+
| unknown |
901+
| teams |
902+
| quarantine |
903+
| failed |
904+
| unknownFutureValue |
905+
906+
### teamsMessageDeliveryAction values
907+
908+
| Member |
909+
| :------|
910+
| unknown |
911+
| deliveredAsSpam |
912+
| delivered |
913+
| blocked |
914+
| replaced |
915+
| unknownFutureValue |
916+
886917
### cloudAttachmentVersion values
887918

888919
|Member|

‎api-reference/beta/resources/security-alertevidence.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ This resource is the base type for the following evidence types:
5353
* [registryKeyEvidence](security-registrykeyevidence.md)
5454
* [registryValueEvidence](security-registryvalueevidence.md)
5555
* [securityGroupEvidence](security-securitygroupevidence.md)
56+
* [teamsMessageEvidence](security-teamsmessageevidence.md)
5657
* [urlEvidence](security-urlevidence.md)
5758
* [userEvidence](security-userevidence.md)
5859

‎api-reference/beta/resources/security-mailboxevidence.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: "mailboxEvidence resource type"
3-
description: "A mailbox that is reported in the alert as evidence."
3+
description: "Represents a mailbox that is reported in the alert as evidence."
44
ms.date: 09/09/2021
55
author: "BenAlfasi"
66
ms.localizationpriority: medium
@@ -14,7 +14,7 @@ Namespace: microsoft.graph.security
1414

1515
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
1616

17-
A mailbox that is reported in the alert as evidence.
17+
Represents a mailbox that is reported in the alert as evidence.
1818

1919
Inherits from [alertEvidence](../resources/security-alertevidence.md).
2020

@@ -23,6 +23,7 @@ Inherits from [alertEvidence](../resources/security-alertevidence.md).
2323
|:---|:---|:---|
2424
|displayName|String|The name associated with the mailbox.|
2525
|primaryAddress|String|The primary email address of the mailbox.|
26+
|upn|String|The mailbox's UPN.|
2627
|userAccount|[microsoft.graph.security.userAccount](../resources/security-useraccount.md)|The user account of the mailbox.|
2728

2829
## Relationships
@@ -49,10 +50,9 @@ The following JSON representation shows the resource type.
4950
"tags": [
5051
"String"
5152
],
52-
"primaryAddress": "String",
5353
"displayName": "String",
54-
"userAccount": {
55-
"@odata.type": "microsoft.graph.security.userAccount"
56-
}
54+
"primaryAddress": "String",
55+
"upn": "String",
56+
"userAccount": {"@odata.type": "microsoft.graph.security.userAccount"}
5757
}
58-
```
58+
```

‎api-reference/beta/resources/security-teamsmessageevidence.md

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
title: "teamsMessageEvidence resource type"
3+
description: "Represents a Microsoft Teams message that is reported as part of a security detection alert."
4+
ms.date: 01/29/2025
5+
author: "hareldamti"
6+
ms.localizationpriority: medium
7+
ms.subservice: "security"
8+
doc_type: resourcePageType
9+
---
10+
11+
# teamsMessageEvidence resource type
12+
13+
Namespace: microsoft.graph.security
14+
15+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
16+
17+
Represents a Microsoft Teams message that is reported as part of a security detection alert.
18+
19+
Inherits from [alertEvidence](../resources/security-alertevidence.md).
20+
21+
## Properties
22+
23+
|Property|Type|Description|
24+
|:---|:---|:---|
25+
| campaignId | String | The identifier of the campaign that this Teams message is part of. |
26+
| channelId | String | The channel ID associated with this Teams message. |
27+
| createdDateTime | DateTimeOffset | The date and time when the evidence was created and added to the alert. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Inherited from [alertEvidence](../resources/security-alertevidence.md). |
28+
| deliveryAction | microsoft.graph.security.teamsMessageDeliveryAction | The delivery action of this Teams message. Possible values are: `unknown`, `deliveredAsSpam`, `delivered`, `blocked`, `replaced`, `unknownFutureValue`. |
29+
| deliveryLocation | microsoft.graph.security.teamsDeliveryLocation | The delivery location of this Teams message. Possible values are: `unknown`, `teams`, `quarantine`, `failed`, `unknownFutureValue`. |
30+
| detailedRoles | String collection | The detailed description of the entity roles in an alert. Values are free-form. Inherited from [alertEvidence](../resources/security-alertevidence.md). |
31+
| files | [microsoft.graph.security.fileEvidence](./security-fileevidence.md) collection | The list of file entities that are attached to this Teams message. |
32+
| groupId | String | The identifier of the team or group that this message is part of. |
33+
| isExternal | Boolean | Indicates whether the message is owned by the organization that reported the security detection alert. |
34+
| isOwned | Boolean | Indicates whether the message is owned by your organization. |
35+
| lastModifiedDateTime | DateTimeOffset | Date and time when the message was last edited. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. |
36+
| messageDirection | microsoft.graph.security.antispamTeamsDirection | The direction of the Teams message. The possible values are: `unknown`, `inbound`, `outbound`, `intraorg`, `unknownFutureValue`. |
37+
| messageId | String | The message identifier, unique within the thread. |
38+
| owningTenantId | Guid | Tenant ID (GUID) of the owner of the message. |
39+
| parentMessageId | String | Identifier of the message to which the current message is a reply; otherwise, it's the same as the **messageId**. |
40+
| receivedDateTime | DateTimeOffset | The received date of this message. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. |
41+
| recipients | String collection | The recipients of this Teams message. |
42+
| remediationStatus | [microsoft.graph.security.evidenceRemediationStatus](../resources/security-alertevidence.md#evidenceremediationstatus-values) | Status of the remediation action taken. The possible values are: `none`, `remediated`, `prevented`, `blocked`, `notFound`, `unknownFutureValue`, `active`, `pendingApproval`, `declined`, `unremediated`, `running`, `partiallyRemediated`. Use the `Prefer: include-unknown-enum-members` request header to get the following values from this [evolvable enum](/graph/best-practices-concept#handling-future-members-in-evolvable-enumerations): `active`, `pendingApproval`, `declined`, `unremediated`, `running`, `partiallyRemediated`. Inherited from [alertEvidence](../resources/security-alertevidence.md). |
43+
| remediationStatusDetails | String | Details about the remediation status. Inherited from [alertEvidence](../resources/security-alertevidence.md). |
44+
| roles | [microsoft.graph.security.evidenceRole](../resources/security-alertevidence.md#evidencerole-values) collection | One or more roles that an evidence entity represents in an alert; for example, an IP address associated with an attacker has the evidence role `Attacker`. Inherited from [alertEvidence](../resources/security-alertevidence.md). |
45+
| senderFromAddress | String | The SMTP format address of the sender. |
46+
| senderIP | String | The IP address of the sender. |
47+
| sourceAppName | String | Source of the message; for example, `desktop` and `mobile`. |
48+
| sourceId | String | The source ID of this Teams message. |
49+
| subject | String | The subject of this Teams message. |
50+
| suspiciousRecipients | String collection | The list of recipients who were detected as suspicious. |
51+
| tags | String collection | Array of custom tags associated with an evidence instance; for example, to denote a group of devices or high-value assets. Inherited from [alertEvidence](../resources/security-alertevidence.md). |
52+
| threadId | String | Identifier of the channel or chat that this message is part of. |
53+
| threadType | String | The Teams message type. Supported values are: `Chat`, `Topic`, `Space`, and `Meeting`. |
54+
| urls | [microsoft.graph.security.urlEvidence](./security-urlevidence.md) collection | The URLs contained in this Teams message. |
55+
| verdict |[microsoft.graph.security.evidenceVerdict](../resources/security-alertevidence.md#evidenceverdict-values)| The decision reached by automated investigation. The possible values are: `unknown`, `suspicious`, `malicious`, `noThreatsFound`, `unknownFutureValue`. Inherited from [alertEvidence](../resources/security-alertevidence.md). |
56+
57+
## Relationships
58+
None.
59+
60+
## JSON representation
61+
The following JSON representation shows the resource type.
62+
<!-- {
63+
"blockType": "resource",
64+
"@odata.type": "microsoft.graph.security.teamsMessageEvidence",
65+
"baseType": "microsoft.graph.security.alertEvidence"
66+
}
67+
-->
68+
``` json
69+
{
70+
"@odata.type": "#microsoft.graph.security.teamsMessageEvidence",
71+
"campaignId": "String",
72+
"channelId": "String",
73+
"createdDateTime": "String (timestamp)",
74+
"deliveryAction": "String",
75+
"deliveryLocation": "String",
76+
"files": [{"@odata.type": "microsoft.graph.security.fileEvidence"}],
77+
"groupId": "String",
78+
"isExternal": "Boolean",
79+
"isOwned": "Boolean",
80+
"lastModifiedDateTime": "String (timestamp)",
81+
"messageDirection": "String",
82+
"messageId": "String",
83+
"owningTenantId": "Guid",
84+
"parentMessageId": "String",
85+
"receivedDateTime": "String (timestamp)",
86+
"recipients": ["String"],
87+
"remediationStatus": "String",
88+
"remediationStatusDetails": "String",
89+
"roles": ["String"],
90+
"senderFromAddress": "String",
91+
"senderIP": "String",
92+
"sourceAppName": "String",
93+
"sourceId": "String",
94+
"subject": "String",
95+
"suspiciousRecipients": ["String"],
96+
"tags": ["String"],
97+
"threadId": "String",
98+
"threadType": "String",
99+
"urls": [{"@odata.type": "microsoft.graph.security.urlEvidence"}],
100+
"verdict": "String"
101+
}
102+
```

‎api-reference/beta/toc/security/toc.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ items:
4848
href: ../../api/security-incident-update.md
4949
- name: Create comment for incident
5050
href: ../../api/security-incident-post-comments.md
51+
- name: Complex types
52+
items:
53+
- name: Teams message evidence
54+
href: ../../resources/security-teamsmessageevidence.md
5155
- name: Attack simulation and training
5256
items:
5357
- name: Simulation

‎api-reference/beta/toc/toc.mapping.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2506,6 +2506,9 @@
25062506
"microsoft.graph.security.alert",
25072507
"microsoft.graph.security.alertEvidence",
25082508
"microsoft.graph.security.incident"
2509+
],
2510+
"complexTypes": [
2511+
"microsoft.graph.security.teamsMessageEvidence"
25092512
]
25102513
},
25112514
{

‎api-reference/v1.0/resources/enums-security.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,37 @@ Namespace: microsoft.graph.security
160160
| critical |
161161
| unknownFutureValue |
162162

163+
### antispamTeamsDirection values
164+
165+
| Member |
166+
| :------|
167+
| unknown |
168+
| inbound |
169+
| outbound |
170+
| intraorg |
171+
| unknownFutureValue |
172+
173+
### teamsDeliveryLocation values
174+
175+
| Member |
176+
| :------|
177+
| unknown |
178+
| teams |
179+
| quarantine |
180+
| failed |
181+
| unknownFutureValue |
182+
183+
### teamsMessageDeliveryAction values
184+
185+
| Member |
186+
| :------|
187+
| unknown |
188+
| deliveredAsSpam |
189+
| delivered |
190+
| blocked |
191+
| replaced |
192+
| unknownFutureValue |
193+
163194
<!--
164195
{
165196
"type": "#page.annotation",

‎api-reference/v1.0/resources/security-alertevidence.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ This resource is the base type for the following evidence types:
5151
* [registryKeyEvidence](security-registrykeyevidence.md)
5252
* [registryValueEvidence](security-registryvalueevidence.md)
5353
* [securityGroupEvidence](security-securitygroupevidence.md)
54+
* [teamsMessageEvidence](security-teamsmessageevidence.md)
5455
* [urlEvidence](security-urlevidence.md)
5556
* [userEvidence](security-userevidence.md)
5657

‎api-reference/v1.0/resources/security-mailboxevidence.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: "mailboxEvidence resource type"
3-
description: "A mailbox that is reported in the alert as evidence."
3+
description: "Represents a mailbox that is reported in the alert as evidence."
44
ms.date: 11/11/2022
55
author: "BenAlfasi"
66
ms.localizationpriority: medium
@@ -12,7 +12,7 @@ doc_type: resourcePageType
1212

1313
Namespace: microsoft.graph.security
1414

15-
A mailbox that is reported in the alert as evidence.
15+
Represents a mailbox that is reported in the alert as evidence.
1616

1717
Inherits from [alertEvidence](../resources/security-alertevidence.md).
1818

@@ -21,6 +21,7 @@ Inherits from [alertEvidence](../resources/security-alertevidence.md).
2121
|:---|:---|:---|
2222
|displayName|String|The name associated with the mailbox.|
2323
|primaryAddress|String|The primary email address of the mailbox.|
24+
|upn|String|The mailbox's UPN.|
2425
|userAccount|[microsoft.graph.security.userAccount](../resources/security-useraccount.md)|The user account of the mailbox.|
2526

2627
## Relationships
@@ -47,10 +48,9 @@ The following JSON representation shows the resource type.
4748
"tags": [
4849
"String"
4950
],
50-
"primaryAddress": "String",
5151
"displayName": "String",
52-
"userAccount": {
53-
"@odata.type": "microsoft.graph.security.userAccount"
54-
}
52+
"primaryAddress": "String",
53+
"upn": "String",
54+
"userAccount": {"@odata.type": "microsoft.graph.security.userAccount"}
5555
}
56-
```
56+
```

0 commit comments

Comments
 (0)