processEvidence resource type
Namespace: microsoft.graph.security
Important
APIs under the /beta
version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Represents a process that is reported in the alert as evidence.
Inherits from alertEvidence.
Properties
Property | Type | Description |
---|---|---|
detectionStatus | microsoft.graph.security.detectionStatus | The status of the detection. The possible values are: detected , blocked , prevented , unknownFutureValue . |
imageFile | microsoft.graph.security.fileDetails | Image file details. |
mdeDeviceId | String | A unique identifier assigned to a device by Microsoft Defender for Endpoint. |
parentProcessCreationDateTime | DateTimeOffset | Date and time when the parent of the process was created. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . |
parentProcessId | Int64 | Process ID (PID) of the parent process that spawned the process. |
parentProcessImageFile | microsoft.graph.security.fileDetails | Parent process image file details. |
processCommandLine | String | Command line used to create the new process. |
processCreationDateTime | DateTimeOffset | Date and time when the process was created. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . |
processId | Int64 | Process ID (PID) of the newly created process. |
userAccount | microsoft.graph.security.userAccount | User details of the user that ran the process. |
Relationships
None.
JSON representation
The following is a JSON representation of the resource.
{
"@odata.type": "#microsoft.graph.security.processEvidence",
"createdDateTime": "String (timestamp)",
"detectionStatus": "String",
"imageFile": {"@odata.type": "microsoft.graph.security.fileDetails"},
"mdeDeviceId": "String",
"parentProcessCreationDateTime": "String (timestamp)",
"parentProcessId": "Int64",
"parentProcessImageFile": {"@odata.type": "microsoft.graph.security.fileDetails"},
"processCommandLine": "String",
"processCreationDateTime": "String (timestamp)",
"processId": "Int64",
"remediationStatus": "String",
"remediationStatusDetails": "String",
"roles": ["String"],
"tags": ["String"],
"userAccount": {"@odata.type": "microsoft.graph.security.userAccount"},
"verdict": "String"
}
Feedback
https://aka.ms/ContentUserFeedback.
Binnenkort beschikbaar: In de loop van 2024 zullen we GitHub-problemen geleidelijk uitfaseren als het feedbackmechanisme voor inhoud en deze vervangen door een nieuw feedbacksysteem. Zie voor meer informatie:Feedback verzenden en weergeven voor