Alert interface

The display name of the alert. NOTE: This property will not be serialized. It can only be populated by the server.

alertDisplayName?: string

Property Value

Unique identifier for the detection logic (all alert instances from the same detection logic will have the same alertType). NOTE: This property will not be serialized. It can only be populated by the server.

alertType?: string

Property Value

A direct link to the alert page in Azure Portal. NOTE: This property will not be serialized. It can only be populated by the server.

alertUri?: string

Property Value

The display name of the resource most related to this alert. NOTE: This property will not be serialized. It can only be populated by the server.

compromisedEntity?: string

Property Value

Key for corelating related alerts. Alerts with the same correlation key considered to be related. NOTE: This property will not be serialized. It can only be populated by the server.

correlationKey?: string

Property Value

Description of the suspicious activity that was detected. NOTE: This property will not be serialized. It can only be populated by the server.

description?: string

Property Value

The UTC time of the last event or activity included in the alert in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

endTimeUtc?: Date

Property Value

A list of entities related to the alert. NOTE: This property will not be serialized. It can only be populated by the server.

entities?: AlertEntity[]

Property Value

Links related to the alert NOTE: This property will not be serialized. It can only be populated by the server.

extendedLinks?: {[propertyName: string]: string}[]

Property Value

Custom properties for the alert.

extendedProperties?: {[propertyName: string]: string}

Property Value

The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents. NOTE: This property will not be serialized. It can only be populated by the server.

intent?: string

Property Value

This field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert. NOTE: This property will not be serialized. It can only be populated by the server.

isIncident?: boolean

Property Value

The UTC processing end time of the alert in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

processingEndTimeUtc?: Date

Property Value

The name of Azure Security Center pricing tier which powering this alert. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing NOTE: This property will not be serialized. It can only be populated by the server.

productComponentName?: string

Property Value

The name of the product which published this alert (Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and so on). NOTE: This property will not be serialized. It can only be populated by the server.

productName?: string

Property Value

Manual action items to take to remediate the alert. NOTE: This property will not be serialized. It can only be populated by the server.

remediationSteps?: string[]

Property Value

The resource identifiers that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert. NOTE: This property will not be serialized. It can only be populated by the server.

resourceIdentifiers?: ResourceIdentifierUnion[]

Property Value

The risk level of the threat that was detected. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-alerts-overview#how-are-alerts-classified. NOTE: This property will not be serialized. It can only be populated by the server.

severity?: string

Property Value

The UTC time of the first event or activity included in the alert in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

startTimeUtc?: Date

Property Value

The life cycle status of the alert. NOTE: This property will not be serialized. It can only be populated by the server.

status?: string

Property Value

Kill chain related sub-techniques behind the alert. NOTE: This property will not be serialized. It can only be populated by the server.

subTechniques?: string[]

Property Value

Changing set of properties depending on the supportingEvidence type.

supportingEvidence?: AlertPropertiesSupportingEvidence

Property Value

Unique identifier for the alert. NOTE: This property will not be serialized. It can only be populated by the server.

systemAlertId?: string

Property Value

kill chain related techniques behind the alert. NOTE: This property will not be serialized. It can only be populated by the server.

techniques?: string[]

Property Value

The UTC time the alert was generated in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

timeGeneratedUtc?: Date

Property Value

The name of the vendor that raises the alert. NOTE: This property will not be serialized. It can only be populated by the server.

vendorName?: string

Property Value

Schema version. NOTE: This property will not be serialized. It can only be populated by the server.

version?: string

Property Value

Resource Id NOTE: This property will not be serialized. It can only be populated by the server.

id?: string

Property Value

Inherited From Resource.id

Resource name NOTE: This property will not be serialized. It can only be populated by the server.

name?: string

Property Value

Inherited From Resource.name

Resource type NOTE: This property will not be serialized. It can only be populated by the server.

type?: string

Property Value

Inherited From Resource.type