Options
All
  • Public
  • Public/Protected
  • All
Menu

Interface Alert

Package version

Security alert

Hierarchy

Index

Properties

Properties

Optional alertDisplayName

alertDisplayName: undefined | string

The display name of the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional alertType

alertType: undefined | string

Unique identifier for the detection logic (all alert instances from the same detection logic will have the same alertType). NOTE: This property will not be serialized. It can only be populated by the server.

Optional alertUri

alertUri: undefined | string

A direct link to the alert page in Azure Portal. NOTE: This property will not be serialized. It can only be populated by the server.

Optional compromisedEntity

compromisedEntity: undefined | string

The display name of the resource most related to this alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional correlationKey

correlationKey: undefined | string

Key for corelating related alerts. Alerts with the same correlation key considered to be related. NOTE: This property will not be serialized. It can only be populated by the server.

Optional description

description: undefined | string

Description of the suspicious activity that was detected. NOTE: This property will not be serialized. It can only be populated by the server.

Optional endTimeUtc

endTimeUtc: Date

The UTC time of the last event or activity included in the alert in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

Optional entities

entities: AlertEntity[]

A list of entities related to the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional extendedLinks

extendedLinks: {}[]

Links related to the alert NOTE: This property will not be serialized. It can only be populated by the server.

Optional extendedProperties

extendedProperties: undefined | {}

Custom properties for the alert.

Optional id

id: undefined | string

Resource Id NOTE: This property will not be serialized. It can only be populated by the server.

Optional intent

intent: Intent

The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents. NOTE: This property will not be serialized. It can only be populated by the server.

Optional isIncident

isIncident: undefined | false | true

This field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional name

name: undefined | string

Resource name NOTE: This property will not be serialized. It can only be populated by the server.

Optional processingEndTimeUtc

processingEndTimeUtc: Date

The UTC processing end time of the alert in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

Optional productComponentName

productComponentName: undefined | string

The name of Azure Security Center pricing tier which powering this alert. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing NOTE: This property will not be serialized. It can only be populated by the server.

Optional productName

productName: undefined | string

The name of the product which published this alert (Azure Security Center, Azure ATP, Microsoft Defender ATP, O365 ATP, MCAS, and so on). NOTE: This property will not be serialized. It can only be populated by the server.

Optional remediationSteps

remediationSteps: string[]

Manual action items to take to remediate the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional resourceIdentifiers

resourceIdentifiers: ResourceIdentifierUnion[]

The resource identifiers that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional severity

severity: AlertSeverity

The risk level of the threat that was detected. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-alerts-overview#how-are-alerts-classified. NOTE: This property will not be serialized. It can only be populated by the server.

Optional startTimeUtc

startTimeUtc: Date

The UTC time of the first event or activity included in the alert in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

Optional status

status: AlertStatus

The life cycle status of the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional subTechniques

subTechniques: string[]

Kill chain related sub-techniques behind the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional supportingEvidence

supportingEvidence: AlertPropertiesSupportingEvidence

Changing set of properties depending on the supportingEvidence type.

Optional systemAlertId

systemAlertId: undefined | string

Unique identifier for the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional techniques

techniques: string[]

kill chain related techniques behind the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional timeGeneratedUtc

timeGeneratedUtc: Date

The UTC time the alert was generated in ISO8601 format. NOTE: This property will not be serialized. It can only be populated by the server.

Optional type

type: undefined | string

Resource type NOTE: This property will not be serialized. It can only be populated by the server.

Optional vendorName

vendorName: undefined | string

The name of the vendor that raises the alert. NOTE: This property will not be serialized. It can only be populated by the server.

Optional version

version: undefined | string

Schema version. NOTE: This property will not be serialized. It can only be populated by the server.

Generated using TypeDoc