defenderDetectedMalwareActions resource type

Note: The Microsoft Graph API for Intune requires an active Intune license for the tenant.

Specify Defender’s actions to take on detected Malware per threat level.

Properties

Property Type Description
lowSeverity defenderThreatAction Indicates a Defender action to take for low severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
moderateSeverity defenderThreatAction Indicates a Defender action to take for moderate severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
highSeverity defenderThreatAction Indicates a Defender action to take for high severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
severeSeverity defenderThreatAction Indicates a Defender action to take for severe severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

Relationships

None

JSON Representation

Here is a JSON representation of the resource.

{
  "@odata.type": "#microsoft.graph.defenderDetectedMalwareActions",
  "lowSeverity": "String",
  "moderateSeverity": "String",
  "highSeverity": "String",
  "severeSeverity": "String"
}