Class: MicrosoftGraph::Models::SecurityAlert

Inherits:
Entity
  • Object
show all
Includes:
MicrosoftKiotaAbstractions::Parsable
Defined in:
lib/models/security_alert.rb

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Entity

#additional_data, #additional_data=, #id, #id=, #odata_type, #odata_type=

Constructor Details

#initializeObject

Instantiates a new securityAlert and sets the default values.



206
207
208
# File 'lib/models/security_alert.rb', line 206

def initialize()
    super
end

Class Method Details

.create_from_discriminator_value(parse_node) ⇒ Object

Creates a new instance of the appropriate class based on discriminator value

Parameters:

  • parse_node

    The parse node to use to read the discriminator value and create the object

Returns:

  • a security_alert

Raises:

  • (StandardError)


229
230
231
232
# File 'lib/models/security_alert.rb', line 229

def self.create_from_discriminator_value(parse_node)
    raise StandardError, 'parse_node cannot be null' if parse_node.nil?
    return SecurityAlert.new
end

Instance Method Details

#actor_display_nameObject

Gets the actorDisplayName property value. The adversary or activity group that is associated with this alert.

Returns:

  • a string



101
102
103
# File 'lib/models/security_alert.rb', line 101

def actor_display_name
    return @actor_display_name
end

#actor_display_name=(value) ⇒ Object

Sets the actorDisplayName property value. The adversary or activity group that is associated with this alert.

Parameters:

  • value

    Value to set for the actorDisplayName property.

Returns:

  • a void



109
110
111
# File 'lib/models/security_alert.rb', line 109

def actor_display_name=(value)
    @actor_display_name = value
end

#alert_policy_idObject

Gets the alertPolicyId property value. The alertPolicyId property

Returns:

  • a string



116
117
118
# File 'lib/models/security_alert.rb', line 116

def alert_policy_id
    return @alert_policy_id
end

#alert_policy_id=(value) ⇒ Object

Sets the alertPolicyId property value. The alertPolicyId property

Parameters:

  • value

    Value to set for the alertPolicyId property.

Returns:

  • a void



124
125
126
# File 'lib/models/security_alert.rb', line 124

def alert_policy_id=(value)
    @alert_policy_id = value
end

#alert_web_urlObject

Gets the alertWebUrl property value. URL for the alert page in the Microsoft 365 Defender portal.

Returns:

  • a string



131
132
133
# File 'lib/models/security_alert.rb', line 131

def alert_web_url
    return @alert_web_url
end

#alert_web_url=(value) ⇒ Object

Sets the alertWebUrl property value. URL for the alert page in the Microsoft 365 Defender portal.

Parameters:

  • value

    Value to set for the alertWebUrl property.

Returns:

  • a void



139
140
141
# File 'lib/models/security_alert.rb', line 139

def alert_web_url=(value)
    @alert_web_url = value
end

#assigned_toObject

Gets the assignedTo property value. Owner of the alert, or null if no owner is assigned.

Returns:

  • a string



146
147
148
# File 'lib/models/security_alert.rb', line 146

def assigned_to
    return @assigned_to
end

#assigned_to=(value) ⇒ Object

Sets the assignedTo property value. Owner of the alert, or null if no owner is assigned.

Parameters:

  • value

    Value to set for the assignedTo property.

Returns:

  • a void



154
155
156
# File 'lib/models/security_alert.rb', line 154

def assigned_to=(value)
    @assigned_to = value
end

#categoryObject

Gets the category property value. The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework.

Returns:

  • a string



161
162
163
# File 'lib/models/security_alert.rb', line 161

def category
    return @category
end

#category=(value) ⇒ Object

Sets the category property value. The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework.

Parameters:

  • value

    Value to set for the category property.

Returns:

  • a void



169
170
171
# File 'lib/models/security_alert.rb', line 169

def category=(value)
    @category = value
end

#classificationObject

Gets the classification property value. Specifies whether the alert represents a true threat. Possible values are: unknown, falsePositive, truePositive, benignPositive, unknownFutureValue.

Returns:

  • a security_alert_classification



176
177
178
# File 'lib/models/security_alert.rb', line 176

def classification
    return @classification
end

#classification=(value) ⇒ Object

Sets the classification property value. Specifies whether the alert represents a true threat. Possible values are: unknown, falsePositive, truePositive, benignPositive, unknownFutureValue.

Parameters:

  • value

    Value to set for the classification property.

Returns:

  • a void



184
185
186
# File 'lib/models/security_alert.rb', line 184

def classification=(value)
    @classification = value
end

#commentsObject

Gets the comments property value. Array of comments created by the Security Operations (SecOps) team during the alert management process.

Returns:

  • a security_alert_comment



191
192
193
# File 'lib/models/security_alert.rb', line 191

def comments
    return @comments
end

#comments=(value) ⇒ Object

Sets the comments property value. Array of comments created by the Security Operations (SecOps) team during the alert management process.

Parameters:

  • value

    Value to set for the comments property.

Returns:

  • a void



199
200
201
# File 'lib/models/security_alert.rb', line 199

def comments=(value)
    @comments = value
end

#created_date_timeObject

Gets the createdDateTime property value. Time when Microsoft 365 Defender created the alert.

Returns:

  • a date_time



213
214
215
# File 'lib/models/security_alert.rb', line 213

def created_date_time
    return @created_date_time
end

#created_date_time=(value) ⇒ Object

Sets the createdDateTime property value. Time when Microsoft 365 Defender created the alert.

Parameters:

  • value

    Value to set for the createdDateTime property.

Returns:

  • a void



221
222
223
# File 'lib/models/security_alert.rb', line 221

def created_date_time=(value)
    @created_date_time = value
end

#descriptionObject

Gets the description property value. String value describing each alert.

Returns:

  • a string



237
238
239
# File 'lib/models/security_alert.rb', line 237

def description
    return @description
end

#description=(value) ⇒ Object

Sets the description property value. String value describing each alert.

Parameters:

  • value

    Value to set for the description property.

Returns:

  • a void



245
246
247
# File 'lib/models/security_alert.rb', line 245

def description=(value)
    @description = value
end

#detection_sourceObject

Gets the detectionSource property value. Detection technology or sensor that identified the notable component or activity. Possible values are: unknown, microsoftDefenderForEndpoint, antivirus, smartScreen, customTi, microsoftDefenderForOffice365, automatedInvestigation, microsoftThreatExperts, customDetection, microsoftDefenderForIdentity, cloudAppSecurity, microsoft365Defender, azureAdIdentityProtection, manual, microsoftDataLossPrevention, appGovernancePolicy, appGovernanceDetection, unknownFutureValue, microsoftDefenderForCloud. Note that you must use the Prefer: include-unknown-enum-members request header to get the following value(s) in this evolvable enum: microsoftDefenderForCloud.

Returns:

  • a security_detection_source



252
253
254
# File 'lib/models/security_alert.rb', line 252

def detection_source
    return @detection_source
end

#detection_source=(value) ⇒ Object

Sets the detectionSource property value. Detection technology or sensor that identified the notable component or activity. Possible values are: unknown, microsoftDefenderForEndpoint, antivirus, smartScreen, customTi, microsoftDefenderForOffice365, automatedInvestigation, microsoftThreatExperts, customDetection, microsoftDefenderForIdentity, cloudAppSecurity, microsoft365Defender, azureAdIdentityProtection, manual, microsoftDataLossPrevention, appGovernancePolicy, appGovernanceDetection, unknownFutureValue, microsoftDefenderForCloud. Note that you must use the Prefer: include-unknown-enum-members request header to get the following value(s) in this evolvable enum: microsoftDefenderForCloud.

Parameters:

  • value

    Value to set for the detectionSource property.

Returns:

  • a void



260
261
262
# File 'lib/models/security_alert.rb', line 260

def detection_source=(value)
    @detection_source = value
end

#detector_idObject

Gets the detectorId property value. The ID of the detector that triggered the alert.

Returns:

  • a string



267
268
269
# File 'lib/models/security_alert.rb', line 267

def detector_id
    return @detector_id
end

#detector_id=(value) ⇒ Object

Sets the detectorId property value. The ID of the detector that triggered the alert.

Parameters:

  • value

    Value to set for the detectorId property.

Returns:

  • a void



275
276
277
# File 'lib/models/security_alert.rb', line 275

def detector_id=(value)
    @detector_id = value
end

#determinationObject

Gets the determination property value. Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. Possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.

Returns:

  • a security_alert_determination



282
283
284
# File 'lib/models/security_alert.rb', line 282

def determination
    return @determination
end

#determination=(value) ⇒ Object

Sets the determination property value. Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. Possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.

Parameters:

  • value

    Value to set for the determination property.

Returns:

  • a void



290
291
292
# File 'lib/models/security_alert.rb', line 290

def determination=(value)
    @determination = value
end

#evidenceObject

Gets the evidence property value. Collection of evidence related to the alert.

Returns:

  • a security_alert_evidence



297
298
299
# File 'lib/models/security_alert.rb', line 297

def evidence
    return @evidence
end

#evidence=(value) ⇒ Object

Sets the evidence property value. Collection of evidence related to the alert.

Parameters:

  • value

    Value to set for the evidence property.

Returns:

  • a void



305
306
307
# File 'lib/models/security_alert.rb', line 305

def evidence=(value)
    @evidence = value
end

#first_activity_date_timeObject

Gets the firstActivityDateTime property value. The earliest activity associated with the alert.

Returns:

  • a date_time



312
313
314
# File 'lib/models/security_alert.rb', line 312

def first_activity_date_time
    return @first_activity_date_time
end

#first_activity_date_time=(value) ⇒ Object

Sets the firstActivityDateTime property value. The earliest activity associated with the alert.

Parameters:

  • value

    Value to set for the firstActivityDateTime property.

Returns:

  • a void



320
321
322
# File 'lib/models/security_alert.rb', line 320

def first_activity_date_time=(value)
    @first_activity_date_time = value
end

#get_field_deserializersObject

The deserialization information for the current model

Returns:

  • a i_dictionary



327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
# File 'lib/models/security_alert.rb', line 327

def get_field_deserializers()
    return super.merge({
        "actorDisplayName" => lambda {|n| @actor_display_name = n.get_string_value() },
        "alertPolicyId" => lambda {|n| @alert_policy_id = n.get_string_value() },
        "alertWebUrl" => lambda {|n| @alert_web_url = n.get_string_value() },
        "assignedTo" => lambda {|n| @assigned_to = n.get_string_value() },
        "category" => lambda {|n| @category = n.get_string_value() },
        "classification" => lambda {|n| @classification = n.get_enum_value(MicrosoftGraph::Models::SecurityAlertClassification) },
        "comments" => lambda {|n| @comments = n.get_collection_of_object_values(lambda {|pn| MicrosoftGraph::Models::SecurityAlertComment.create_from_discriminator_value(pn) }) },
        "createdDateTime" => lambda {|n| @created_date_time = n.get_date_time_value() },
        "description" => lambda {|n| @description = n.get_string_value() },
        "detectionSource" => lambda {|n| @detection_source = n.get_enum_value(MicrosoftGraph::Models::SecurityDetectionSource) },
        "detectorId" => lambda {|n| @detector_id = n.get_string_value() },
        "determination" => lambda {|n| @determination = n.get_enum_value(MicrosoftGraph::Models::SecurityAlertDetermination) },
        "evidence" => lambda {|n| @evidence = n.get_collection_of_object_values(lambda {|pn| MicrosoftGraph::Models::SecurityAlertEvidence.create_from_discriminator_value(pn) }) },
        "firstActivityDateTime" => lambda {|n| @first_activity_date_time = n.get_date_time_value() },
        "incidentId" => lambda {|n| @incident_id = n.get_string_value() },
        "incidentWebUrl" => lambda {|n| @incident_web_url = n.get_string_value() },
        "lastActivityDateTime" => lambda {|n| @last_activity_date_time = n.get_date_time_value() },
        "lastUpdateDateTime" => lambda {|n| @last_update_date_time = n.get_date_time_value() },
        "mitreTechniques" => lambda {|n| @mitre_techniques = n.get_collection_of_primitive_values(String) },
        "providerAlertId" => lambda {|n| @provider_alert_id = n.get_string_value() },
        "recommendedActions" => lambda {|n| @recommended_actions = n.get_string_value() },
        "resolvedDateTime" => lambda {|n| @resolved_date_time = n.get_date_time_value() },
        "serviceSource" => lambda {|n| @service_source = n.get_enum_value(MicrosoftGraph::Models::SecurityServiceSource) },
        "severity" => lambda {|n| @severity = n.get_enum_value(MicrosoftGraph::Models::SecurityAlertSeverity) },
        "status" => lambda {|n| @status = n.get_enum_value(MicrosoftGraph::Models::SecurityAlertStatus) },
        "tenantId" => lambda {|n| @tenant_id = n.get_string_value() },
        "threatDisplayName" => lambda {|n| @threat_display_name = n.get_string_value() },
        "threatFamilyName" => lambda {|n| @threat_family_name = n.get_string_value() },
        "title" => lambda {|n| @title = n.get_string_value() },
    })
end

#incident_idObject

Gets the incidentId property value. Unique identifier to represent the incident this alert resource is associated with.

Returns:

  • a string



364
365
366
# File 'lib/models/security_alert.rb', line 364

def incident_id
    return @incident_id
end

#incident_id=(value) ⇒ Object

Sets the incidentId property value. Unique identifier to represent the incident this alert resource is associated with.

Parameters:

  • value

    Value to set for the incidentId property.

Returns:

  • a void



372
373
374
# File 'lib/models/security_alert.rb', line 372

def incident_id=(value)
    @incident_id = value
end

#incident_web_urlObject

Gets the incidentWebUrl property value. URL for the incident page in the Microsoft 365 Defender portal.

Returns:

  • a string



379
380
381
# File 'lib/models/security_alert.rb', line 379

def incident_web_url
    return @incident_web_url
end

#incident_web_url=(value) ⇒ Object

Sets the incidentWebUrl property value. URL for the incident page in the Microsoft 365 Defender portal.

Parameters:

  • value

    Value to set for the incidentWebUrl property.

Returns:

  • a void



387
388
389
# File 'lib/models/security_alert.rb', line 387

def incident_web_url=(value)
    @incident_web_url = value
end

#last_activity_date_timeObject

Gets the lastActivityDateTime property value. The oldest activity associated with the alert.

Returns:

  • a date_time



394
395
396
# File 'lib/models/security_alert.rb', line 394

def last_activity_date_time
    return @last_activity_date_time
end

#last_activity_date_time=(value) ⇒ Object

Sets the lastActivityDateTime property value. The oldest activity associated with the alert.

Parameters:

  • value

    Value to set for the lastActivityDateTime property.

Returns:

  • a void



402
403
404
# File 'lib/models/security_alert.rb', line 402

def last_activity_date_time=(value)
    @last_activity_date_time = value
end

#last_update_date_timeObject

Gets the lastUpdateDateTime property value. Time when the alert was last updated at Microsoft 365 Defender.

Returns:

  • a date_time



409
410
411
# File 'lib/models/security_alert.rb', line 409

def last_update_date_time
    return @last_update_date_time
end

#last_update_date_time=(value) ⇒ Object

Sets the lastUpdateDateTime property value. Time when the alert was last updated at Microsoft 365 Defender.

Parameters:

  • value

    Value to set for the lastUpdateDateTime property.

Returns:

  • a void



417
418
419
# File 'lib/models/security_alert.rb', line 417

def last_update_date_time=(value)
    @last_update_date_time = value
end

#mitre_techniquesObject

Gets the mitreTechniques property value. The attack techniques, as aligned with the MITRE ATT&CK framework.

Returns:

  • a string



424
425
426
# File 'lib/models/security_alert.rb', line 424

def mitre_techniques
    return @mitre_techniques
end

#mitre_techniques=(value) ⇒ Object

Sets the mitreTechniques property value. The attack techniques, as aligned with the MITRE ATT&CK framework.

Parameters:

  • value

    Value to set for the mitreTechniques property.

Returns:

  • a void



432
433
434
# File 'lib/models/security_alert.rb', line 432

def mitre_techniques=(value)
    @mitre_techniques = value
end

#provider_alert_idObject

Gets the providerAlertId property value. The ID of the alert as it appears in the security provider product that generated the alert.

Returns:

  • a string



439
440
441
# File 'lib/models/security_alert.rb', line 439

def provider_alert_id
    return @provider_alert_id
end

#provider_alert_id=(value) ⇒ Object

Sets the providerAlertId property value. The ID of the alert as it appears in the security provider product that generated the alert.

Parameters:

  • value

    Value to set for the providerAlertId property.

Returns:

  • a void



447
448
449
# File 'lib/models/security_alert.rb', line 447

def provider_alert_id=(value)
    @provider_alert_id = value
end

Gets the recommendedActions property value. Recommended response and remediation actions to take in the event this alert was generated.

Returns:

  • a string



454
455
456
# File 'lib/models/security_alert.rb', line 454

def recommended_actions
    return @recommended_actions
end

Sets the recommendedActions property value. Recommended response and remediation actions to take in the event this alert was generated.

Parameters:

  • value

    Value to set for the recommendedActions property.

Returns:

  • a void



462
463
464
# File 'lib/models/security_alert.rb', line 462

def recommended_actions=(value)
    @recommended_actions = value
end

#resolved_date_timeObject

Gets the resolvedDateTime property value. Time when the alert was resolved.

Returns:

  • a date_time



469
470
471
# File 'lib/models/security_alert.rb', line 469

def resolved_date_time
    return @resolved_date_time
end

#resolved_date_time=(value) ⇒ Object

Sets the resolvedDateTime property value. Time when the alert was resolved.

Parameters:

  • value

    Value to set for the resolvedDateTime property.

Returns:

  • a void



477
478
479
# File 'lib/models/security_alert.rb', line 477

def resolved_date_time=(value)
    @resolved_date_time = value
end

#serialize(writer) ⇒ Object

Serializes information the current object

Parameters:

  • writer

    Serialization writer to use to serialize this model

Returns:

  • a void

Raises:

  • (StandardError)


485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
# File 'lib/models/security_alert.rb', line 485

def serialize(writer)
    raise StandardError, 'writer cannot be null' if writer.nil?
    super
    writer.write_string_value("actorDisplayName", @actor_display_name)
    writer.write_string_value("alertPolicyId", @alert_policy_id)
    writer.write_string_value("alertWebUrl", @alert_web_url)
    writer.write_string_value("assignedTo", @assigned_to)
    writer.write_string_value("category", @category)
    writer.write_enum_value("classification", @classification)
    writer.write_collection_of_object_values("comments", @comments)
    writer.write_date_time_value("createdDateTime", @created_date_time)
    writer.write_string_value("description", @description)
    writer.write_enum_value("detectionSource", @detection_source)
    writer.write_string_value("detectorId", @detector_id)
    writer.write_enum_value("determination", @determination)
    writer.write_collection_of_object_values("evidence", @evidence)
    writer.write_date_time_value("firstActivityDateTime", @first_activity_date_time)
    writer.write_string_value("incidentId", @incident_id)
    writer.write_string_value("incidentWebUrl", @incident_web_url)
    writer.write_date_time_value("lastActivityDateTime", @last_activity_date_time)
    writer.write_date_time_value("lastUpdateDateTime", @last_update_date_time)
    writer.write_collection_of_primitive_values("mitreTechniques", @mitre_techniques)
    writer.write_string_value("providerAlertId", @provider_alert_id)
    writer.write_string_value("recommendedActions", @recommended_actions)
    writer.write_date_time_value("resolvedDateTime", @resolved_date_time)
    writer.write_enum_value("serviceSource", @service_source)
    writer.write_enum_value("severity", @severity)
    writer.write_enum_value("status", @status)
    writer.write_string_value("tenantId", @tenant_id)
    writer.write_string_value("threatDisplayName", @threat_display_name)
    writer.write_string_value("threatFamilyName", @threat_family_name)
    writer.write_string_value("title", @title)
end

#service_sourceObject

Gets the serviceSource property value. The serviceSource property

Returns:

  • a security_service_source



522
523
524
# File 'lib/models/security_alert.rb', line 522

def service_source
    return @service_source
end

#service_source=(value) ⇒ Object

Sets the serviceSource property value. The serviceSource property

Parameters:

  • value

    Value to set for the serviceSource property.

Returns:

  • a void



530
531
532
# File 'lib/models/security_alert.rb', line 530

def service_source=(value)
    @service_source = value
end

#severityObject

Gets the severity property value. The severity property

Returns:

  • a security_alert_severity



537
538
539
# File 'lib/models/security_alert.rb', line 537

def severity
    return @severity
end

#severity=(value) ⇒ Object

Sets the severity property value. The severity property

Parameters:

  • value

    Value to set for the severity property.

Returns:

  • a void



545
546
547
# File 'lib/models/security_alert.rb', line 545

def severity=(value)
    @severity = value
end

#statusObject

Gets the status property value. The status property

Returns:

  • a security_alert_status



552
553
554
# File 'lib/models/security_alert.rb', line 552

def status
    return @status
end

#status=(value) ⇒ Object

Sets the status property value. The status property

Parameters:

  • value

    Value to set for the status property.

Returns:

  • a void



560
561
562
# File 'lib/models/security_alert.rb', line 560

def status=(value)
    @status = value
end

#tenant_idObject

Gets the tenantId property value. The Azure Active Directory tenant the alert was created in.

Returns:

  • a string



567
568
569
# File 'lib/models/security_alert.rb', line 567

def tenant_id
    return @tenant_id
end

#tenant_id=(value) ⇒ Object

Sets the tenantId property value. The Azure Active Directory tenant the alert was created in.

Parameters:

  • value

    Value to set for the tenantId property.

Returns:

  • a void



575
576
577
# File 'lib/models/security_alert.rb', line 575

def tenant_id=(value)
    @tenant_id = value
end

#threat_display_nameObject

Gets the threatDisplayName property value. The threat associated with this alert.

Returns:

  • a string



582
583
584
# File 'lib/models/security_alert.rb', line 582

def threat_display_name
    return @threat_display_name
end

#threat_display_name=(value) ⇒ Object

Sets the threatDisplayName property value. The threat associated with this alert.

Parameters:

  • value

    Value to set for the threatDisplayName property.

Returns:

  • a void



590
591
592
# File 'lib/models/security_alert.rb', line 590

def threat_display_name=(value)
    @threat_display_name = value
end

#threat_family_nameObject

Gets the threatFamilyName property value. Threat family associated with this alert.

Returns:

  • a string



597
598
599
# File 'lib/models/security_alert.rb', line 597

def threat_family_name
    return @threat_family_name
end

#threat_family_name=(value) ⇒ Object

Sets the threatFamilyName property value. Threat family associated with this alert.

Parameters:

  • value

    Value to set for the threatFamilyName property.

Returns:

  • a void



605
606
607
# File 'lib/models/security_alert.rb', line 605

def threat_family_name=(value)
    @threat_family_name = value
end

#titleObject

Gets the title property value. Brief identifying string value describing the alert.

Returns:

  • a string



612
613
614
# File 'lib/models/security_alert.rb', line 612

def title
    return @title
end

#title=(value) ⇒ Object

Sets the title property value. Brief identifying string value describing the alert.

Parameters:

  • value

    Value to set for the title property.

Returns:

  • a void



620
621
622
# File 'lib/models/security_alert.rb', line 620

def title=(value)
    @title = value
end