Edit

Share via

detectionAction resource type

  • Article

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Describes the actions that will be taken after a detection is made by a custom detection rule.

Properties

Property Type Description
alertTemplate microsoft.graph.security.alertTemplate Template for the generated alert.
organizationalScope microsoft.graph.security.organizationalScope Groups to which the custom detection rule applies.
responseActions microsoft.graph.security.responseAction collection Actions taken on impacted assets as set in the custom detection rule.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.detectionAction",
  "alertTemplate": {
    "@odata.type": "microsoft.graph.security.alertTemplate"
  },
  "organizationalScope": {
    "@odata.type": "microsoft.graph.security.organizationalScope"
  },
  "responseActions": [
    {
      "@odata.type": "microsoft.graph.security.stopAndQuarantineFileResponseAction"
    }
  ]
}