Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Namespace: microsoft.graph.security.caseManagement
Important
APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Represents an abstract security case that tracks an investigation and organizes related tasks, activities, relations, and attachments. Use the genericCase derived type to create case instances. You can't create incidentCase instances with API requests; incident cases are created by the service. Instances are differentiated by @odata.type.
This is an abstract type.
For cast segments in URLs, use the full type name, for example microsoft.graph.security.caseManagement.genericCase or microsoft.graph.security.caseManagement.incidentCase.
Inherits from microsoft.graph.security.caseManagement.caseManagementEntity.
Methods
Use the Update method to update displayName and status for all case types. Other mutable properties depend on the concrete case type.
| Method | Return type | Description |
|---|---|---|
| List | microsoft.graph.security.caseManagement.case collection | List security cases. |
| Create | microsoft.graph.security.caseManagement.case | Create a security case by specifying a supported derived type in @odata.type. The incidentCase derived type isn't supported for create requests. |
| Get | microsoft.graph.security.caseManagement.case | Read the properties and relationships of a security case. |
| Update | microsoft.graph.security.caseManagement.case | Update the supported mutable properties of a security case. |
| Delete | None | Delete a security case. |
Properties
| Property | Type | Description |
|---|---|---|
| createdBy | String | The user or service that created the case. Inherited from caseManagementEntity. Supports $filter and $orderby. |
| createdDateTime | DateTimeOffset | The date and time when the case was created. Inherited from caseManagementEntity. Supports $filter and $orderby. |
| customFields | microsoft.graph.security.caseManagement.customFieldValues | Tenant-defined custom field values keyed by the exact displayName of each custom field definition. The property and its dynamic fields don't support $filter. |
| displayName | String | The display name of the case. Supports $filter and $orderby. |
| id | String | The unique identifier for the case. Inherited from entity. Supports $filter and $orderby. |
| lastModifiedBy | String | The user or service that last modified the case. Inherited from caseManagementEntity. Supports $filter and $orderby. |
| lastModifiedDateTime | DateTimeOffset | The date and time when the case was last modified. Inherited from caseManagementEntity. Supports $filter and $orderby. |
| status | String | The tenant-defined lifecycle status of the case. Use a displayName value returned in the status tree by List statuses from /security/caseManagement/caseTypeConfigurations/genericCase/statuses or /security/caseManagement/caseTypeConfigurations/incidentCase/statuses, depending on the case type. Supports $filter (eq). |
Relationships
| Relationship | Type | Description |
|---|---|---|
| activities | microsoft.graph.security.caseManagement.activity collection | The timeline of comments and audit events associated with the case. Supports $expand. |
| attachments | microsoft.graph.security.caseManagement.attachment collection | Evidence files and metadata associated with the case. Supports $expand. |
| relations | microsoft.graph.security.caseManagement.relation collection | Links from the case to related security resources. Supports $expand. |
| tasks | microsoft.graph.security.caseManagement.task collection | Tasks used to track work required to resolve the case. Supports $expand. |
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security.caseManagement.case",
"id": "String (identifier)",
"createdDateTime": "String (timestamp)",
"createdBy": "String",
"lastModifiedDateTime": "String (timestamp)",
"lastModifiedBy": "String",
"displayName": "String",
"status": "String",
"customFields": {"@odata.type": "#microsoft.graph.security.caseManagement.customFieldValues"}
}