@microsoft/msgraph-sdk/models/security/index.d.ts

Microsoft Graph JavaScript client library

import { type BaseCollectionPaginationCountResponse, type Entity, type Group, type IdentitySet, type PhysicalAddress, type PublicError, type ResultInfo, type Site } from '../index.js';
import { type AdditionalDataHolder, type BackedModel, type Duration, type Guid, type Parsable, type ParseNode, type SerializationWriter } from '@microsoft/kiota-abstractions';
/**
 * Audit data for A365 AI Execute Tool events.
 */
export interface A365AiExecuteTool extends AuditData, Parsable {
}
/**
 * Audit data for A365 AI Inference Call events.
 */
export interface A365AiInferenceCall extends AuditData, Parsable {
}
/**
 * Audit data for A365 AI Invoke Agent events.
 */
export interface A365AiInvokeAgent extends AuditData, Parsable {
}
/**
 * Audit data for A365 AI Run Summary events.
 */
export interface A365AiRunSummary extends AuditData, Parsable {
}
/**
 * Audit data for A365 Span Outputs events.
 */
export interface A365SpanOutputs extends AuditData, Parsable {
}
/**
 * Audit data for AAD Risk Detection events.
 */
export interface AadRiskDetectionAuditRecord extends AuditData, Parsable {
}
export interface Account extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * List of the type of action. The possible values are: disable, enable, forcePasswordReset, revokeAllSessions, requireUserToSignInAgain, markUserAsCompromised, unknownFutureValue.
     */
    actions?: Action[] | null;
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The account ID.
     */
    identifier?: string | null;
    /**
     * The identityProvider property
     */
    identityProvider?: IdentityProvider | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
}
export type Action = (typeof ActionObject)[keyof typeof ActionObject];
export type ActionAfterRetentionPeriod = (typeof ActionAfterRetentionPeriodObject)[keyof typeof ActionAfterRetentionPeriodObject];
export interface ActiveDirectoryDomainEvidence extends AlertEvidence, Parsable {
    /**
     * The activeDirectoryDomainName property
     */
    activeDirectoryDomainName?: string | null;
    /**
     * The trustedDomains property
     */
    trustedDomains?: ActiveDirectoryDomainEvidence[] | null;
}
export type AdditionalDataOptions = (typeof AdditionalDataOptionsObject)[keyof typeof AdditionalDataOptionsObject];
export type AdditionalOptions = (typeof AdditionalOptionsObject)[keyof typeof AdditionalOptionsObject];
/**
 * Audit data for Advanced eDiscovery events.
 */
export interface AedAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Agent Admin Activity events.
 */
export interface AgentAdminActivityRecord extends AuditData, Parsable {
}
/**
 * Audit data for Agent Setting Admin Activity events.
 */
export interface AgentSettingAdminActivity extends AuditData, Parsable {
}
export interface AiAgentEvidence extends AlertEvidence, Parsable {
    /**
     * The unique identifier for the AI agent.
     */
    agentId?: string | null;
    /**
     * The display name for the AI agent.
     */
    agentName?: string | null;
    /**
     * Type of the platform the agent runs on. The possible values are: unknown, azureAIFoundry, copilotStudio, copilot, unknownFutureValue.
     */
    hostingPlatformType?: AiAgentPlatform | null;
    /**
     * The instructions of the agent.
     */
    instructions?: string | null;
}
export type AiAgentPlatform = (typeof AiAgentPlatformObject)[keyof typeof AiAgentPlatformObject];
/**
 * Audit data for AI App Interaction events.
 */
export interface AiAppInteractionAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for AI Execute Tool events.
 */
export interface AiExecuteToolAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for AI Interactions Change Notification events.
 */
export interface AiInteractionsChangeNotificationAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for AI Interactions Export events.
 */
export interface AiInteractionsExportAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for AI Interactions Subscription events.
 */
export interface AiInteractionsSubscriptionAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for AI Invoke Agent events.
 */
export interface AiInvokeAgentAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for AIP Discover events.
 */
export interface AipDiscover extends AuditData, Parsable {
}
/**
 * Audit data for AIP File Deleted events.
 */
export interface AipFileDeleted extends AuditData, Parsable {
}
/**
 * Audit data for AIP Heart Beat events.
 */
export interface AipHeartBeat extends AuditData, Parsable {
}
/**
 * Audit data for AIP Protection Action log request events.
 */
export interface AipProtectionActionLogRequest extends AuditData, Parsable {
}
/**
 * Audit data for AIP Scanner Discover Event events.
 */
export interface AipScannerDiscoverEvent extends AuditData, Parsable {
}
/**
 * Audit data for AIP Sensitivity Label Action log request events.
 */
export interface AipSensitivityLabelActionLogRequest extends AuditData, Parsable {
}
/**
 * Audit data for AIR Admin Action Investigation events.
 */
export interface AirAdminActionInvestigationData extends AuditData, Parsable {
}
/**
 * Audit data for AIR Investigation events.
 */
export interface AirInvestigationData extends AuditData, Parsable {
}
/**
 * Audit data for AIR Manual Investigation events.
 */
export interface AirManualInvestigationData extends AuditData, Parsable {
}
/**
 * Audit data for AI Span Outputs events.
 */
export interface AISpanOutputsAuditRecord extends AuditData, Parsable {
}
export interface Alert extends Entity, Parsable {
    /**
     * The adversary or activity group that is associated with this alert.
     */
    actorDisplayName?: string | null;
    /**
     * A collection of other alert properties, including user-defined properties. Any custom details defined in the alert, and any dynamic content in the alert details, are stored here.
     */
    additionalDataProperty?: Dictionary | null;
    /**
     * The ID of the policy that generated the alert, and populated when there is a specific policy that generated the alert, whether configured by a customer or a built-in policy.
     */
    alertPolicyId?: string | null;
    /**
     * URL for the Microsoft 365 Defender portal alert page.
     */
    alertWebUrl?: string | null;
    /**
     * Owner of the alert, or null if no owner is assigned.
     */
    assignedTo?: string | null;
    /**
     * The attack kill-chain categories that the alert belongs to. Aligned with the MITRE ATT&CK framework.
     */
    categories?: string[] | null;
    /**
     * The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework. This property is in the process of being deprecated. Use the categories property instead.
     */
    category?: string | null;
    /**
     * Specifies whether the alert represents a true threat. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
     */
    classification?: AlertClassification | null;
    /**
     * Array of comments created by the Security Operations (SecOps) team during the alert management process.
     */
    comments?: AlertComment[] | null;
    /**
     * Time when Microsoft 365 Defender created the alert.
     */
    createdDateTime?: Date | null;
    /**
     * User defined custom fields with string values.
     */
    customDetails?: Dictionary | null;
    /**
     * String value describing each alert.
     */
    description?: string | null;
    /**
     * Detection technology or sensor that identified the notable component or activity.
     */
    detectionSource?: DetectionSource | null;
    /**
     * The ID of the detector that triggered the alert.
     */
    detectorId?: string | null;
    /**
     * Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
     */
    determination?: AlertDetermination | null;
    /**
     * Collection of evidence related to the alert.
     */
    evidence?: AlertEvidence[] | null;
    /**
     * The earliest activity associated with the alert.
     */
    firstActivityDateTime?: Date | null;
    /**
     * Unique identifier to represent the incident this alert resource is associated with.
     */
    incidentId?: string | null;
    /**
     * URL for the incident page in the Microsoft 365 Defender portal.
     */
    incidentWebUrl?: string | null;
    /**
     * Information on the current status of the investigation. The possible values are: unknown, terminated, successfullyRemediated, benign, failed, partiallyRemediated, running, pendingApproval, pendingResource, queued, innerFailure, preexistingAlert, unsupportedOs, unsupportedAlertType, suppressedAlert, partiallyInvestigated, terminatedByUser, terminatedBySystem, unknownFutureValue.
     */
    investigationState?: InvestigationState | null;
    /**
     * The oldest activity associated with the alert.
     */
    lastActivityDateTime?: Date | null;
    /**
     * Time when the alert was last updated at Microsoft 365 Defender.
     */
    lastUpdateDateTime?: Date | null;
    /**
     * The attack techniques, as aligned with the MITRE ATT&CK framework.
     */
    mitreTechniques?: string[] | null;
    /**
     * The name of the product which published this alert.
     */
    productName?: string | null;
    /**
     * The ID of the alert as it appears in the security provider product that generated the alert.
     */
    providerAlertId?: string | null;
    /**
     * Recommended response and remediation actions to take in the event this alert was generated.
     */
    recommendedActions?: string | null;
    /**
     * Time when the alert was resolved.
     */
    resolvedDateTime?: Date | null;
    /**
     * The serviceSource property
     */
    serviceSource?: ServiceSource | null;
    /**
     * The severity property
     */
    severity?: AlertSeverity | null;
    /**
     * The status property
     */
    status?: AlertStatus | null;
    /**
     * The system tags associated with the alert.
     */
    systemTags?: string[] | null;
    /**
     * The Microsoft Entra tenant the alert was created in.
     */
    tenantId?: string | null;
    /**
     * The threat associated with this alert.
     */
    threatDisplayName?: string | null;
    /**
     * Threat family associated with this alert.
     */
    threatFamilyName?: string | null;
    /**
     * Brief identifying string value describing the alert.
     */
    title?: string | null;
}
export type AlertClassification = (typeof AlertClassificationObject)[keyof typeof AlertClassificationObject];
export interface AlertCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: Alert[] | null;
}
export interface AlertComment extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The comment text.
     */
    comment?: string | null;
    /**
     * The person or app name that submitted the comment.
     */
    createdByDisplayName?: string | null;
    /**
     * The time when the comment was submitted.
     */
    createdDateTime?: Date | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
}
export type AlertDetermination = (typeof AlertDeterminationObject)[keyof typeof AlertDeterminationObject];
export interface AlertEvidence extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The date and time when the evidence was created and added to the alert. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
     */
    createdDateTime?: Date | null;
    /**
     * Detailed description of the entity role/s in an alert. Values are free-form.
     */
    detailedRoles?: string[] | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * The remediationStatus property
     */
    remediationStatus?: EvidenceRemediationStatus | null;
    /**
     * Details about the remediation status.
     */
    remediationStatusDetails?: string | null;
    /**
     * The role/s that an evidence entity represents in an alert, for example, an IP address that is associated with an attacker has the evidence role Attacker.
     */
    roles?: EvidenceRole[] | null;
    /**
     * Array of custom tags associated with an evidence instance, for example, to denote a group of devices, high-value assets, etc.
     */
    tags?: string[] | null;
    /**
     * The verdict property
     */
    verdict?: EvidenceVerdict | null;
}
export type AlertSeverity = (typeof AlertSeverityObject)[keyof typeof AlertSeverityObject];
export type AlertStatus = (typeof AlertStatusObject)[keyof typeof AlertStatusObject];
/**
 * Audit data for Alert Submission events.
 */
export interface AlertSubmissionAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Alert Submission Result Detail events.
 */
export interface AlertSubmissionResultDetailAuditRecord extends AuditData, Parsable {
}
export interface AmazonResourceEvidence extends AlertEvidence, Parsable {
    /**
     * The unique identifier for the Amazon account.
     */
    amazonAccountId?: string | null;
    /**
     * The Amazon resource identifier (ARN) for the cloud resource.
     */
    amazonResourceId?: string | null;
    /**
     * The name of the resource.
     */
    resourceName?: string | null;
    /**
     * The type of the resource.
     */
    resourceType?: string | null;
}
export interface AnalyzedEmail extends Entity, Parsable {
    /**
     * A collection of values that contain the IDs of any alerts associated with the email.
     */
    alertIds?: string[] | null;
    /**
     * A collection of the attachments in the email.
     */
    attachments?: AnalyzedEmailAttachment[] | null;
    /**
     * The authentication details associated with the email.
     */
    authenticationDetails?: AnalyzedEmailAuthenticationDetail | null;
    /**
     * The bulk complaint level of the email. A higher level is more likely to be spam.
     */
    bulkComplaintLevel?: string | null;
    /**
     * Shows the type of client that sent the message (for example, REST).
     */
    clientType?: string | null;
    /**
     * Provides context of the email.
     */
    contexts?: string[] | null;
    /**
     * The methods of detection used.
     */
    detectionMethods?: string[] | null;
    /**
     * The direction of the emails. The possible values are: unknown, inbound, outbound, intraOrg, unknownFutureValue.
     */
    directionality?: AntispamDirectionality | null;
    /**
     * The distribution list details to which the email was sent.
     */
    distributionList?: string | null;
    /**
     * Data loss prevention rules configured in purview.
     */
    dlpRules?: AnalyzedEmailDlpRuleInfo[] | null;
    /**
     * The identifier for the group of similar emails clustered based on heuristic analysis of their content.
     */
    emailClusterId?: string | null;
    /**
     * The name of the Exchange transport rules (ETRs) associated with the email.
     */
    exchangeTransportRules?: AnalyzedEmailExchangeTransportRuleInfo[] | null;
    /**
     * Email smtp forwarding details.
     */
    forwardingDetail?: string | null;
    /**
     * Custom instructions name that defines organizational mail flow and how the email was routed.
     */
    inboundConnectorFormattedName?: string | null;
    /**
     * A public-facing identifier for the email that is sent. The message ID is in the format specified by RFC2822.
     */
    internetMessageId?: string | null;
    /**
     * The detected language of the email content.
     */
    language?: string | null;
    /**
     * The latest delivery details of the email.
     */
    latestDelivery?: AnalyzedEmailDeliveryDetail | null;
    /**
     * Date-time when the email record was logged.
     */
    loggedDateTime?: Date | null;
    /**
     * An internal identifier for the email generated by Microsoft 365.
     */
    networkMessageId?: string | null;
    /**
     * The original delivery details of the email.
     */
    originalDelivery?: AnalyzedEmailDeliveryDetail | null;
    /**
     * An aggregated list of all overrides with source on email.
     */
    overrideSources?: string[] | null;
    /**
     * The phish confidence level associated with the email
     */
    phishConfidenceLevel?: string | null;
    /**
     * The action policy that took effect.
     */
    policy?: string | null;
    /**
     * The action taken on the email based on the configured policy.
     */
    policyAction?: string | null;
    /**
     * Type of policy configured that defines the delivery action on email.
     */
    policyType?: string | null;
    /**
     * Shows the organization or user setting that altered the intended delivery location of the message (allowed instead of blocked, or blocked instead of allowed).
     */
    primaryOverrideSource?: string | null;
    /**
     * Details of the recipients.
     */
    recipientDetail?: AnalyzedEmailRecipientDetail | null;
    /**
     * Contains the email address of the recipient.
     */
    recipientEmailAddress?: string | null;
    /**
     * A field that indicates where and how bounced emails are processed.
     */
    returnPath?: string | null;
    /**
     * Sender details of the email.
     */
    senderDetail?: AnalyzedEmailSenderDetail | null;
    /**
     * Size of the email in bytes.
     */
    sizeInBytes?: number | null;
    /**
     * Spam confidence of the email.
     */
    spamConfidenceLevel?: string | null;
    /**
     * Subject of the email.
     */
    subject?: string | null;
    /**
     * Information about threats detected in the email.
     */
    threatDetectionDetails?: ThreatDetectionDetail[] | null;
    /**
     * Indicates the threat types. The possible values are: unknown, spam, malware, phish, none, unknownFutureValue.
     */
    threatTypes?: ThreatType[] | null;
    /**
     * Delivery and post-delivery events that happened to the email.
     */
    timelineEvents?: TimelineEvent[] | null;
    /**
     * A collection of the URLs in the email.
     */
    urls?: AnalyzedEmailUrl[] | null;
}
export interface AnalyzedEmailAttachment extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The detonation details of the attachment.
     */
    detonationDetails?: DetonationDetails | null;
    /**
     * Extension of the file.
     */
    fileExtension?: string | null;
    /**
     * The name of the attachment in the email.
     */
    fileName?: string | null;
    /**
     * Size of the file.
     */
    fileSize?: number | null;
    /**
     * The type of the attachment in the email.
     */
    fileType?: string | null;
    /**
     * The threat name associated with the threat type.
     */
    malwareFamily?: string | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * The SHA256 file hash of the attachment.
     */
    sha256?: string | null;
    /**
     * Details of entries in tenant allow/block list configured by tenant.
     */
    tenantAllowBlockListDetailInfo?: string | null;
    /**
     * The threat type associated with the attachment. The possible values are: unknown, spam, malware, phishing, none, unknownFutureValue.
     */
    threatType?: ThreatType | null;
}
export interface AnalyzedEmailAuthenticationDetail extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * A value used by Microsoft 365 to combine email authentication such as SPF, DKIM, and DMARC, to determine whether the message is authentic.
     */
    compositeAuthentication?: string | null;
    /**
     * DomainKeys identified mail (DKIM). Indicates whether it was pass/fail/soft fail.
     */
    dkim?: string | null;
    /**
     * Domain-based Message Authentication. Indicates whether it was pass/fail/soft fail.
     */
    dmarc?: string | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * Sender Policy Framework (SPF). Indicates whether it was pass/fail/soft fail.
     */
    senderPolicyFramework?: string | null;
}
export interface AnalyzedEmailCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: AnalyzedEmail[] | null;
}
export interface AnalyzedEmailDeliveryDetail extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * The delivery action of the email. The possible values are: unknown, deliveredToJunk, delivered, blocked, replaced, unknownFutureValue.
     */
    action?: DeliveryAction | null;
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * Latest known threat on the email.
     */
    latestThreats?: string | null;
    /**
     * The delivery location of the email. The possible values are: unknown, inboxfolder, junkFolder, deletedFolder, quarantine, onpremexternal, failed, dropped, others, unknownFutureValue.
     */
    location?: DeliveryLocation | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * Threats identified at the time of delivery.
     */
    originalThreats?: string | null;
}
export interface AnalyzedEmailDlpRuleInfo extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * Name of the the data loss prevention rule.
     */
    name?: string | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * Unique identifier of the data loss prevention rule.
     */
    ruleId?: string | null;
}
export interface AnalyzedEmailExchangeTransportRuleInfo extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * Name of the Exchange transport rules (ETRs) that are part of the email.
     */
    name?: string | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * The ETR rule ID.
     */
    ruleId?: string | null;
}
export interface AnalyzedEmailRecipientDetail extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * Recipient address in the cc field.
     */
    ccRecipients?: string[] | null;
    /**
     * Domain name of the recipient.
     */
    domainName?: string | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
}
export interface AnalyzedEmailSenderDetail extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * Display name of sender from address.
     */
    displayName?: string | null;
    /**
     * Date and time of creation of the sender domain.
     */
    domainCreationDateTime?: Date | null;
    /**
     * Registered name of the domain.
     */
    domainName?: string | null;
    /**
     * Owner of the domain.
     */
    domainOwner?: string | null;
    /**
     * The sender email address in the mail From header, also known as the envelope sender or the P1 sender.
     */
    fromAddress?: string | null;
    /**
     * The IPv4 address of the last detected mail server that relayed the message.
     */
    ipv4?: string | null;
    /**
     * Location of the domain.
     */
    location?: string | null;
    /**
     * The sender email address in the From header, which is visible to email recipients on their email clients. Also known as P2 sender.
     */
    mailFromAddress?: string | null;
    /**
     * Domain name of sender mail from address.
     */
    mailFromDomainName?: string | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
}
export interface AnalyzedEmailUrl extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The method used to detect threats in the URL.
     */
    detectionMethod?: string | null;
    /**
     * Detonation data associated with the URL.
     */
    detonationDetails?: DetonationDetails | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * Details of entries in tenant allow/block list configured by tenant.
     */
    tenantAllowBlockListDetailInfo?: string | null;
    /**
     * The type of threat associated with the URL. The possible values are: unknown, spam, malware, phishing, none, unknownFutureValue.
     */
    threatType?: ThreatType | null;
    /**
     * The URL that is found in the email. This is full URL string, including query parameters.
     */
    url?: string | null;
}
export interface AnalyzedMessageEvidence extends AlertEvidence, Parsable {
    /**
     * Direction of the email relative to your network. The possible values are: inbound, outbound or intraorg.
     */
    antiSpamDirection?: string | null;
    /**
     * Number of attachments in the email.
     */
    attachmentsCount?: number | null;
    /**
     * Delivery action of the email. The possible values are: delivered, deliveredAsSpam, junked, blocked, or replaced.
     */
    deliveryAction?: string | null;
    /**
     * Location where the email was delivered. The possible values are: inbox, external, junkFolder, quarantine, failed, dropped, deletedFolder or forwarded.
     */
    deliveryLocation?: string | null;
    /**
     * Public-facing identifier for the email that is set by the sending email system.
     */
    internetMessageId?: string | null;
    /**
     * Detected language of the email content.
     */
    language?: string | null;
    /**
     * Unique identifier for the email, generated by Microsoft 365.
     */
    networkMessageId?: string | null;
    /**
     * The P1 sender.
     */
    p1Sender?: EmailSender | null;
    /**
     * The P2 sender.
     */
    p2Sender?: EmailSender | null;
    /**
     * Date and time when the email was received.
     */
    receivedDateTime?: Date | null;
    /**
     * Email address of the recipient, or email address of the recipient after distribution list expansion.
     */
    recipientEmailAddress?: string | null;
    /**
     * IP address of the last detected mail server that relayed the message.
     */
    senderIp?: string | null;
    /**
     * Subject of the email.
     */
    subject?: string | null;
    /**
     * Collection of methods used to detect malware, phishing, or other threats found in the email.
     */
    threatDetectionMethods?: string[] | null;
    /**
     * Collection of detection names for malware or other threats found.
     */
    threats?: string[] | null;
    /**
     * Number of embedded URLs in the email.
     */
    urlCount?: number | null;
    /**
     * Collection of the URLs contained in this email.
     */
    urls?: string[] | null;
    /**
     * Uniform resource name (URN) of the automated investigation where the cluster was identified.
     */
    urn?: string | null;
}
export type AntispamDirectionality = (typeof AntispamDirectionalityObject)[keyof typeof AntispamDirectionalityObject];
export type AntispamTeamsDirection = (typeof AntispamTeamsDirectionObject)[keyof typeof AntispamTeamsDirectionObject];
export interface Article extends Entity, Parsable {
    /**
     * The body property
     */
    body?: FormattedContent | null;
    /**
     * The date and time when this article was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
     */
    createdDateTime?: Date | null;
    /**
     * URL of the header image for this article, used for display purposes.
     */
    imageUrl?: string | null;
    /**
     * Indicators related to this article.
     */
    indicators?: ArticleIndicator[] | null;
    /**
     * Indicates whether this article is currently featured by Microsoft.
     */
    isFeatured?: boolean | null;
    /**
     * The most recent date and time when this article was updated. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
     */
    lastUpdatedDateTime?: Date | null;
    /**
     * The summary property
     */
    summary?: FormattedContent | null;
    /**
     * Tags for this article, communicating keywords, or key concepts.
     */
    tags?: string[] | null;
    /**
     * The title of this article.
     */
    title?: string | null;
}
export interface ArticleCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: Article[] | null;
}
export interface ArticleIndicator extends Indicator, Parsable {
}
export interface ArticleIndicatorCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: ArticleIndicator[] | null;
}
export interface Artifact extends Entity, Parsable {
}
/**
 * Audit data for Attack Sim Admin events.
 */
export interface AttackSimAdminAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Attack Sim events.
 */
export interface AttackSimAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Audit Config events.
 */
export interface AuditConfigAuditRecord extends AuditData, Parsable {
}
/**
 * Root entity for the audit log API.
 */
export interface AuditCoreRoot extends Entity, Parsable {
    /**
     * The queries property
     */
    queries?: AuditLogQuery[] | null;
}
/**
 * Abstract base type for audit event data.
 */
export interface AuditData extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The dynamicProperties property
     */
    dynamicProperties?: AuditRecordTypeDictionary | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
}
/**
 * Represents a query against the unified audit log.
 */
export interface AuditLogQuery extends Entity, Parsable {
    /**
     * The administrative units tagged to an audit log record.
     */
    administrativeUnitIdFilters?: string[] | null;
    /**
     * The display name of the saved audit log query.
     */
    displayName?: string | null;
    /**
     * The end date of the date range in the query.
     */
    filterEndDateTime?: Date | null;
    /**
     * The start date of the date range in the query.
     */
    filterStartDateTime?: Date | null;
    /**
     * The IP address of the device that was used when the activity was logged.
     */
    ipAddressFilters?: string[] | null;
    /**
     * Free text field to search non-indexed properties of the audit log.
     */
    keywordFilter?: string | null;
    /**
     * For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For Exchange admin audit logging, the name of the object that was modified by the cmdlet.
     */
    objectIdFilters?: string[] | null;
    /**
     * The name of the user or admin activity. For a description of the most common operations/activities, see Search the audit log in the Office 365 Protection Center.
     */
    operationFilters?: string[] | null;
    /**
     * An individual audit log record.
     */
    records?: AuditLogRecord[] | null;
    /**
     * The type of operation indicated by the record. For the list of member values, see auditLogRecordType.
     */
    recordTypeFilters?: AuditLogRecordType[] | null;
    /**
     * The serviceFilters property
     */
    serviceFilters?: string[] | null;
    /**
     * Describes the current status of the query. The possible values are: notStarted, running, succeeded, failed, cancelled, unknownFutureValue.
     */
    status?: AuditLogQueryStatus | null;
    /**
     * The UPN (user principal name) of the user who performed the action (specified in the operation property) that resulted in the record being logged; for example, myname@mydomain_name.
     */
    userPrincipalNameFilters?: string[] | null;
}
export interface AuditLogQueryCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: AuditLogQuery[] | null;
}
export type AuditLogQueryStatus = (typeof AuditLogQueryStatusObject)[keyof typeof AuditLogQueryStatusObject];
/**
 * Represents an individual audit log record.
 */
export interface AuditLogRecord extends Entity, Parsable {
    /**
     * The administrative units tagged to an audit log record.
     */
    administrativeUnits?: string[] | null;
    /**
     * A JSON object that contains the actual audit log data.
     */
    auditData?: AuditData | null;
    /**
     * The type of operation indicated by the record. For the list of member values, see auditLogRecordType.
     */
    auditLogRecordType?: AuditLogRecordType | null;
    /**
     * The IP address of the device used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format.
     */
    clientIp?: string | null;
    /**
     * The date and time in UTC when the user performed the activity.
     */
    createdDateTime?: Date | null;
    /**
     * For Exchange admin audit logging, the name of the object modified by the cmdlet. For SharePoint activity, the full URL path name of the file or folder accessed by a user. For Microsoft Entra activity, the name of the user account that was modified.
     */
    objectId?: string | null;
    /**
     * The name of the user or admin activity.
     */
    operation?: string | null;
    /**
     * The GUID for your organization.
     */
    organizationId?: string | null;
    /**
     * The Microsoft 365 service where the activity occurred.
     */
    service?: string | null;
    /**
     * The user who performed the action (specified in the Operation property) that resulted in the record being logged. Audit records for activity performed by system accounts (such as SHAREPOINT/system or NT AUTHORITY/SYSTEM) are also included in the audit log. Another common value for the UserId property is app@sharepoint. It indicates that the 'user' who performed the activity was an application with the necessary permissions in SharePoint to perform organization-wide actions (such as searching a SharePoint site or OneDrive account) on behalf of a user, admin, or service.
     */
    userId?: string | null;
    /**
     * UPN of the user who performed the action.
     */
    userPrincipalName?: string | null;
    /**
     * The type of user that performed the operation. The possible values are: regular, reserved, admin, dcAdmin, system, application, servicePrincipal, customPolicy, systemPolicy, partnerTechnician, guest, unknownFutureValue.
     */
    userType?: AuditLogUserType | null;
}
export interface AuditLogRecordCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: AuditLogRecord[] | null;
}
export type AuditLogRecordType = (typeof AuditLogRecordTypeObject)[keyof typeof AuditLogRecordTypeObject];
export type AuditLogUserType = (typeof AuditLogUserTypeObject)[keyof typeof AuditLogUserTypeObject];
/**
 * A dictionary of name-value pairs for dynamic audit event properties.
 */
export interface AuditRecordTypeDictionary extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
}
/**
 * Audit data for Audit Search events.
 */
export interface AuditSearchAuditRecord extends AuditData, Parsable {
}
export interface AuthorityTemplate extends FilePlanDescriptorTemplate, Parsable {
}
export interface AuthorityTemplateCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: AuthorityTemplate[] | null;
}
export interface AutoAuditingConfiguration extends Entity, Parsable {
    /**
     * Indicates whether automatic auditing is enabled for Defender for Identity monitoring.
     */
    isAutomatic?: boolean | null;
}
export interface AutonomousSystem extends AdditionalDataHolder, BackedModel, Parsable {
    /**
     * Stores model information.
     */
    backingStoreEnabled?: boolean | null;
    /**
     * The name of the autonomous system.
     */
    name?: string | null;
    /**
     * The autonomous system number, assigned by IANA.
     */
    number?: number | null;
    /**
     * The OdataType property
     */
    odataType?: string | null;
    /**
     * The name of the autonomous system organization.
     */
    organization?: string | null;
    /**
     * A displayable value for these autonomous system details.
     */
    value?: string | null;
}
/**
 * Audit data for Azfw Application Rule Aggregation Event events.
 */
export interface AzfwApplicationRuleAggregationEventRecord extends AuditData, Parsable {
}
/**
 * Audit data for Azfw Dns Query Event events.
 */
export interface AzfwDnsQueryEventRecord extends AuditData, Parsable {
}
/**
 * Audit data for Azfw Network Rule Event events.
 */
export interface AzfwNetworkRuleEventRecord extends AuditData, Parsable {
}
/**
 * Audit data for Azure Active Directory Account Logon events.
 */
export interface AzureActiveDirectoryAccountLogonAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Azure Active Directory events.
 */
export interface AzureActiveDirectoryAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Azure Active Directory STS Logon events.
 */
export interface AzureActiveDirectoryStsLogonAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Azure AI Search Audit events.
 */
export interface AzureAISearchAuditRecord extends AuditData, Parsable {
}
export interface AzureResourceEvidence extends AlertEvidence, Parsable {
    /**
     * The unique identifier for the Azure resource.
     */
    resourceId?: string | null;
    /**
     * The name of the resource.
     */
    resourceName?: string | null;
    /**
     * The type of the resource.
     */
    resourceType?: string | null;
}
export type BehaviorDuringRetentionPeriod = (typeof BehaviorDuringRetentionPeriodObject)[keyof typeof BehaviorDuringRetentionPeriodObject];
export interface BlobContainerEvidence extends AlertEvidence, Parsable {
    /**
     * The name of the blob container.
     */
    name?: string | null;
    /**
     * The storage which the blob container belongs to.
     */
    storageResource?: AzureResourceEvidence | null;
    /**
     * The full URL representation of the blob container.
     */
    url?: string | null;
}
export interface BlobEvidence extends AlertEvidence, Parsable {
    /**
     * The container which the blob belongs to.
     */
    blobContainer?: BlobContainerEvidence | null;
    /**
     * The Etag associated with this blob.
     */
    etag?: string | null;
    /**
     * The file hashes associated with this blob.
     */
    fileHashes?: FileHash[] | null;
    /**
     * The name of the blob.
     */
    name?: string | null;
    /**
     * The full URL representation of the blob.
     */
    url?: string | null;
}
/**
 * Audit data for threat campaign events.
 */
export interface CampaignAuditRecord extends AuditData, Parsable {
}
export type CaseAction = (typeof CaseActionObject)[keyof typeof CaseActionObject];
export interface CaseEscaped extends Entity, Parsable {
    /**
     * The createdDateTime property
     */
    createdDateTime?: Date | null;
    /**
     * The description property
     */
    description?: string | null;
    /**
     * The displayName property
     */
    displayName?: string | null;
    /**
     * The lastModifiedBy property
     */
    lastModifiedBy?: IdentitySet | null;
    /**
     * The lastModifiedDateTime property
     */
    lastModifiedDateTime?: Date | null;
    /**
     * The status property
     */
    status?: CaseStatus | null;
}
export interface CaseOperation extends Entity, Parsable {
    /**
     * The type of action the operation represents. The possible values are: contentExport,  applyTags, convertToPdf, index, estimateStatistics, addToReviewSet, holdUpdate, unknownFutureValue, purgeData, exportReport, exportResult, holdPolicySync. Use the Prefer: include-unknown-enum-members request header to get the following values from this evolvable enum: purgeData, exportReport, exportResult, holdPolicySync.
     */
    action?: CaseAction | null;
    /**
     * The date and time the operation was completed.
     */
    completedDateTime?: Date | null;
    /**
     * The user that created the operation.
     */
    createdBy?: IdentitySet | null;
    /**
     * The date and time the operation was created.
     */
    createdDateTime?: Date | null;
    /**
     * The progress of the operation.
     */
    percentProgress?: number | null;
    /**
     * Contains success and failure-specific result information.
     */
    resultInfo?: ResultInfo | null;
    /**
     * The status of the case operation. The possible values are: notStarted, submissionFailed, running, succeeded, partiallySucceeded, failed, unknownFutureValue.
     */
    status?: CaseOperationStatus | null;
}
export interface CaseOperationCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: CaseOperation[] | null;
}
export type CaseOperationStatus = (typeof CaseOperationStatusObject)[keyof typeof CaseOperationStatusObject];
export interface CasesRoot extends Entity, Parsable {
    /**
     * The ediscoveryCases property
     */
    ediscoveryCases?: EdiscoveryCase[] | null;
}
export type CaseStatus = (typeof CaseStatusObject)[keyof typeof CaseStatusObject];
export type CaseType = (typeof CaseTypeObject)[keyof typeof CaseTypeObject];
export interface CategoryTemplate extends FilePlanDescriptorTemplate, Parsable {
    /**
     * Represents all subcategories under a particular category.
     */
    subcategories?: SubcategoryTemplate[] | null;
}
export interface CategoryTemplateCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: CategoryTemplate[] | null;
}
/**
 * Audit data for CCRAI Policy Violation events.
 */
export interface CcraiPolicyViolationRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP Classifier Health events.
 */
export interface CdpClassifierHealthRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP Cold Crawl Status events.
 */
export interface CdpColdCrawlStatusRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP Consumption Resource events.
 */
export interface CdpConsumptionResourceRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP Content Explorer Aggregate events.
 */
export interface CdpContentExplorerAggregateRecord extends AuditData, Parsable {
}
/**
 * Audit data for Cdpdlmai Interaction Insights events.
 */
export interface CdpdlmaiInteractionInsightsRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP DLP Sensitive Endpoint events.
 */
export interface CdpDlpSensitiveEndpointAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP Log events.
 */
export interface CdpLogRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP OCR Billing events.
 */
export interface CdpOcrBillingRecord extends AuditData, Parsable {
}
/**
 * Audit data for CDP Resource Scope Change Event events.
 */
export interface CdpResourceScopeChangeEventRecord extends AuditData, Parsable {
}
export type ChildSelectability = (typeof ChildSelectabilityObject)[keyof typeof ChildSelectabilityObject];
export interface CitationTemplate extends FilePlanDescriptorTemplate, Parsable {
    /**
     * Represents the jurisdiction or agency that published the citation.
     */
    citationJurisdiction?: string | null;
    /**
     * Represents the URL to the published citation.
     */
    citationUrl?: string | null;
}
export interface CitationTemplateCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
    /**
     * The value property
     */
    value?: CitationTemplate[] | null;
}
export interface CloudApplicationEvidence extends AlertEvidence, Parsable {
    /**
     * Unique identifier of the application.
     */
    appId?: number | null;
    /**
     * Name of the application.
     */
    displayName?: string | null;
    /**
     * Identifier of the instance of the Software as a Service (SaaS) application.
     */
    instanceId?: number | null;
    /**
     * Name of the instance of the SaaS application.
     */
    instanceName?: string | null;
    /**
     * The identifier of the SaaS application.
     */
    saasAppId?: number | null;
    /**
     * The stream property
     */
    stream?: Stream | null;
}
export type CloudAttachmentVersion = (typeof CloudAttachmentVersionObject)[keyof typeof CloudAttachmentVersionObject];
export interface CloudLogonRequestEvidence extends AlertEvidence, Parsable {
    /**
     * The unique identifier for the sign-in request.
     */
    requestId?: string | null;
}
export interface CloudLogonSessionEvidence extends AlertEvidence, Parsable {
    /**
     * The account associated with the sign-in session.
     */
    account?: UserEvidence | null;
    /**
     * The browser that is used for the sign-in, if known.
     */
    browser?: string | null;
    /**
     * The friendly name of the device, if known.
     */
    deviceName?: string | null;
    /**
     * The operating system that the device is running, if known.
     */
    operatingSystem?: string | null;
    /**
     * The previous sign-in time for this account, if known.
     */
    previousLogonDateTime?: Date | null;
    /**
     * The authentication protocol that is used in this session, if known.
     */
    protocol?: string | null;
    /**
     * The session ID for the account reported in the alert.
     */
    sessionId?: string | null;
    /**
     * The session start time, if known.
     */
    startUtcDateTime?: Date | null;
    /**
     * The user agent that is used for the sign-in, if known.
     */
    userAgent?: string | null;
}
/**
 * Audit data for Cloud Update Device Config events.
 */
export interface CloudUpdateDeviceConfigAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Cloud Update Profile Config events.
 */
export interface CloudUpdateProfileConfigAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Cloud Update Tenant Config events.
 */
export interface CloudUpdateTenantConfigAuditRecord extends AuditData, Parsable {
}
export interface CollaborationRoot extends Entity, Parsable {
    /**
     * Contains metadata for analyzed emails.
     */
    analyzedEmails?: AnalyzedEmail[] | null;
}
/**
 * Audit data for Compliance Connector events.
 */
export interface ComplianceConnectorAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLM Exchange events.
 */
export interface ComplianceDLMExchangeAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLM SharePoint events.
 */
export interface ComplianceDLMSharePointAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Applications events.
 */
export interface ComplianceDLPApplicationsAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Applications Classification events.
 */
export interface ComplianceDLPApplicationsClassificationAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Endpoint events.
 */
export interface ComplianceDLPEndpointAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Endpoint Discovery events.
 */
export interface ComplianceDLPEndpointDiscoveryAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Enforcement events.
 */
export interface ComplianceDLPEnforcementAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Exchange events.
 */
export interface ComplianceDLPExchangeAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Exchange Classification events.
 */
export interface ComplianceDLPExchangeClassificationAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Exchange Classification CDP events.
 */
export interface ComplianceDLPExchangeClassificationCdpRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP Exchange Discovery events.
 */
export interface ComplianceDLPExchangeDiscoveryAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP SharePoint events.
 */
export interface ComplianceDLPSharePointAuditRecord extends AuditData, Parsable {
}
/**
 * Audit data for Compliance DLP SharePoint Cla