Espacio de nombres: microsoft.graph
Importante
Las API de la versión /beta de Microsoft Graph están sujetas a cambios. No se admite el uso de estas API en aplicaciones de producción. Para determinar si una API está disponible en la versión 1.0, use el selector de Versión.
Actualice una propiedad de alerta editable dentro de cualquier solución integrada para mantener el estado de la alerta y las asignaciones sincronizadas entre soluciones. Este método actualiza cualquier solución que tenga un registro del id. de alerta al que se hace referencia.
Esta API está disponible en las siguientes implementaciones en la nube nacional.
| Servicio global |
Administración pública de EE. UU. |
Gobierno de EE. UU. L5 (DOD) |
China operado por 21Vianet |
| ✅ |
✅ |
✅ |
❌ |
Permissions
Elija el permiso o los permisos marcados como con privilegios mínimos para esta API. Use uno o varios permisos con privilegios más altos solo si la aplicación lo requiere. Para obtener más información sobre los permisos delegados y de aplicación, consulte Tipos de permisos. Para obtener más información sobre estos permisos, consulte la referencia de permisos.
| Tipo de permiso |
Permisos con privilegios mínimos |
Permisos con privilegios más altos |
| Delegado (cuenta profesional o educativa) |
SecurityEvents.ReadWrite.All |
No disponible. |
| Delegado (cuenta personal de Microsoft) |
No admitida. |
No admitida. |
| Aplicación |
SecurityEvents.ReadWrite.All |
No disponible. |
Solicitud HTTP
Nota: Debe incluir el id. de alerta como parámetro y vendorInformation que contiene el provider y vendor con este método.
PATCH /security/alerts/{alert_id}
| Nombre |
Descripción |
| Autorización |
{code} del portador. Necesario. |
| Prefer |
return=representation. Opcional. |
Cuerpo de la solicitud
En el cuerpo de la solicitud, proporcione solo los valores de las propiedades que se van a actualizar. Las propiedades existentes que no están incluidas en el cuerpo de la solicitud mantienen sus valores anteriores o se recalculan en función de los cambios realizados en otros valores de propiedad.
En la tabla siguiente se especifican las propiedades que se pueden actualizar.
| Propiedad |
Tipo |
Descripción |
| assignedTo |
Cadena |
Nombre del analista al que se asigna la alerta para la evaluación de prioridades, la investigación o la corrección. |
| closedDateTime |
DateTimeOffset |
Hora en que se cerró la alerta. El tipo de marca de tiempo representa la información de fecha y hora con el formato ISO 8601 y está siempre en hora UTC. Por ejemplo, la medianoche en la zona horaria UTC del 1 de enero de 2014 sería 2014-01-01T00:00:00Z. |
| comments |
Colección String |
Comentarios del analista sobre la alerta (para la gestión de alertas del cliente). Este método puede actualizar el campo de comentarios solo con los siguientes valores: Closed in IPC, Closed in MCAS. |
| feedback |
alertFeedback enum |
Comentarios del analista sobre la alerta. Los valores posibles son: unknown, truePositive, falsePositive y benignPositive |
| status |
alertStatus enum |
Estado del ciclo de vida de la alerta (fase). Los valores posibles son: unknown, newAlert, inProgress y resolved |
| tags |
Colección string |
Etiquetas definibles por el usuario que se pueden aplicar a una alerta y que pueden servir como condiciones de filtro (por ejemplo, "HVA", "SAW"). |
| vendorInformation |
securityVendorInformation |
Tipo complejo que contiene detalles sobre el proveedor, proveedor y subproveedor del producto o servicio de seguridad (por ejemplo, vendor=Microsoft; provider=Windows Defender ATP; subProvider=AppLocker).
Los campos de proveedor y proveedor son obligatorios. |
Respuesta
Si se ejecuta correctamente, este método devuelve un código de respuesta 204 No Content.
Si se utiliza el encabezado de solicitud opcional, el método devuelve un 200 OK código de respuesta y un objeto de alerta actualizado en el cuerpo de la respuesta.
Ejemplos
Solicitud
En el ejemplo siguiente se muestra una solicitud sin el Prefer encabezado.
PATCH https://graph.microsoft.com/beta/security/alerts/{alert_id}
Content-type: application/json
{
"assignedTo": "String",
"closedDateTime": "String (timestamp)",
"comments": ["String"],
"feedback": "@odata.type: microsoft.graph.alertFeedback",
"status": "@odata.type: microsoft.graph.alertStatus",
"tags": ["String"],
"vendorInformation":
{
"provider": "String",
"vendor": "String"
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new Alert
{
AssignedTo = "String",
ClosedDateTime = DateTimeOffset.Parse("String (timestamp)"),
Comments = new List<string>
{
"String",
},
Feedback = AlertFeedback.Unknown,
Status = AlertStatus.Unknown,
Tags = new List<string>
{
"String",
},
VendorInformation = new SecurityVendorInformation
{
Provider = "String",
Vendor = "String",
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts["{alert-id}"].PatchAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
"time"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewAlert()
assignedTo := "String"
requestBody.SetAssignedTo(&assignedTo)
closedDateTime , err := time.Parse(time.RFC3339, "String (timestamp)")
requestBody.SetClosedDateTime(&closedDateTime)
comments := []string {
"String",
}
requestBody.SetComments(comments)
feedback := graphmodels.ALERTFEEDBACK_GRAPH_TYPE: MICROSOFT_@ODATA_ALERTFEEDBACK
requestBody.SetFeedback(&feedback)
status := graphmodels.ALERTSTATUS_GRAPH_TYPE: MICROSOFT_@ODATA_ALERTSTATUS
requestBody.SetStatus(&status)
tags := []string {
"String",
}
requestBody.SetTags(tags)
vendorInformation := graphmodels.NewSecurityVendorInformation()
provider := "String"
vendorInformation.SetProvider(&provider)
vendor := "String"
vendorInformation.SetVendor(&vendor)
requestBody.SetVendorInformation(vendorInformation)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
alerts, err := graphClient.Security().Alerts().ByAlertId("alert-id").Patch(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Alert alert = new Alert();
alert.setAssignedTo("String");
OffsetDateTime closedDateTime = OffsetDateTime.parse("String (timestamp)");
alert.setClosedDateTime(closedDateTime);
LinkedList<String> comments = new LinkedList<String>();
comments.add("String");
alert.setComments(comments);
alert.setFeedback(AlertFeedback.Unknown);
alert.setStatus(AlertStatus.Unknown);
LinkedList<String> tags = new LinkedList<String>();
tags.add("String");
alert.setTags(tags);
SecurityVendorInformation vendorInformation = new SecurityVendorInformation();
vendorInformation.setProvider("String");
vendorInformation.setVendor("String");
alert.setVendorInformation(vendorInformation);
Alert result = graphClient.security().alerts().byAlertId("{alert-id}").patch(alert);
const options = {
authProvider,
};
const client = Client.init(options);
const alert = {
assignedTo: 'String',
closedDateTime: 'String (timestamp)',
comments: ['String'],
feedback: '@odata.type: microsoft.graph.alertFeedback',
status: '@odata.type: microsoft.graph.alertStatus',
tags: ['String'],
vendorInformation:
{
provider: 'String',
vendor: 'String'
}
};
await client.api('/security/alerts/{alert_id}')
.version('beta')
.update(alert);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\Alert;
use Microsoft\Graph\Beta\Generated\Models\AlertFeedback;
use Microsoft\Graph\Beta\Generated\Models\AlertStatus;
use Microsoft\Graph\Beta\Generated\Models\SecurityVendorInformation;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Alert();
$requestBody->setAssignedTo('String');
$requestBody->setClosedDateTime(new \DateTime('String (timestamp)'));
$requestBody->setComments(['String', ]);
$requestBody->setFeedback(new AlertFeedback('alertFeedback'));
$requestBody->setStatus(new AlertStatus('alertStatus'));
$requestBody->setTags(['String', ]);
$vendorInformation = new SecurityVendorInformation();
$vendorInformation->setProvider('String');
$vendorInformation->setVendor('String');
$requestBody->setVendorInformation($vendorInformation);
$result = $graphServiceClient->security()->alerts()->byAlertId('alert-id')->patch($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Security
$params = @{
assignedTo = "String"
closedDateTime = [System.DateTime]::Parse("String (timestamp)")
comments = @(
"String"
)
feedback = "@odata.type: microsoft.graph.alertFeedback"
status = "@odata.type: microsoft.graph.alertStatus"
tags = @(
"String"
)
vendorInformation = @{
provider = "String"
vendor = "String"
}
}
Update-MgBetaSecurityAlert -AlertId $alertId -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.alert import Alert
from msgraph_beta.generated.models.alert_feedback import AlertFeedback
from msgraph_beta.generated.models.alert_status import AlertStatus
from msgraph_beta.generated.models.security_vendor_information import SecurityVendorInformation
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Alert(
assigned_to = "String",
closed_date_time = "String (timestamp)",
comments = [
"String",
],
feedback = AlertFeedback.Unknown,
status = AlertStatus.Unknown,
tags = [
"String",
],
vendor_information = SecurityVendorInformation(
provider = "String",
vendor = "String",
),
)
result = await graph_client.security.alerts.by_alert_id('alert-id').patch(request_body)
Respuesta
En el ejemplo siguiente se muestra una respuesta correcta.
HTTP/1.1 204 No Content
Solicitud
En el ejemplo siguiente se muestra una solicitud que incluye el encabezado de solicitud Prefer .
PATCH https://graph.microsoft.com/beta/security/alerts/{alert_id}
Content-type: application/json
Prefer: return=representation
{
"assignedTo": "String",
"closedDateTime": "String (timestamp)",
"comments": ["String"],
"feedback": "@odata.type: microsoft.graph.alertFeedback",
"status": "@odata.type: microsoft.graph.alertStatus",
"tags": ["String"],
"vendorInformation":
{
"provider": "String",
"vendor": "String"
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new Alert
{
AssignedTo = "String",
ClosedDateTime = DateTimeOffset.Parse("String (timestamp)"),
Comments = new List<string>
{
"String",
},
Feedback = AlertFeedback.Unknown,
Status = AlertStatus.Unknown,
Tags = new List<string>
{
"String",
},
VendorInformation = new SecurityVendorInformation
{
Provider = "String",
Vendor = "String",
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts["{alert-id}"].PatchAsync(requestBody, (requestConfiguration) =>
{
requestConfiguration.Headers.Add("Prefer", "return=representation");
});
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
"time"
abstractions "github.com/microsoft/kiota-abstractions-go"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
//other-imports
)
headers := abstractions.NewRequestHeaders()
headers.Add("Prefer", "return=representation")
configuration := &graphsecurity.AlertsItemRequestBuilderPatchRequestConfiguration{
Headers: headers,
}
requestBody := graphmodels.NewAlert()
assignedTo := "String"
requestBody.SetAssignedTo(&assignedTo)
closedDateTime , err := time.Parse(time.RFC3339, "String (timestamp)")
requestBody.SetClosedDateTime(&closedDateTime)
comments := []string {
"String",
}
requestBody.SetComments(comments)
feedback := graphmodels.ALERTFEEDBACK_GRAPH_TYPE: MICROSOFT_@ODATA_ALERTFEEDBACK
requestBody.SetFeedback(&feedback)
status := graphmodels.ALERTSTATUS_GRAPH_TYPE: MICROSOFT_@ODATA_ALERTSTATUS
requestBody.SetStatus(&status)
tags := []string {
"String",
}
requestBody.SetTags(tags)
vendorInformation := graphmodels.NewSecurityVendorInformation()
provider := "String"
vendorInformation.SetProvider(&provider)
vendor := "String"
vendorInformation.SetVendor(&vendor)
requestBody.SetVendorInformation(vendorInformation)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
alerts, err := graphClient.Security().Alerts().ByAlertId("alert-id").Patch(context.Background(), requestBody, configuration)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Alert alert = new Alert();
alert.setAssignedTo("String");
OffsetDateTime closedDateTime = OffsetDateTime.parse("String (timestamp)");
alert.setClosedDateTime(closedDateTime);
LinkedList<String> comments = new LinkedList<String>();
comments.add("String");
alert.setComments(comments);
alert.setFeedback(AlertFeedback.Unknown);
alert.setStatus(AlertStatus.Unknown);
LinkedList<String> tags = new LinkedList<String>();
tags.add("String");
alert.setTags(tags);
SecurityVendorInformation vendorInformation = new SecurityVendorInformation();
vendorInformation.setProvider("String");
vendorInformation.setVendor("String");
alert.setVendorInformation(vendorInformation);
Alert result = graphClient.security().alerts().byAlertId("{alert-id}").patch(alert, requestConfiguration -> {
requestConfiguration.headers.add("Prefer", "return=representation");
});
const options = {
authProvider,
};
const client = Client.init(options);
const alert = {
assignedTo: 'String',
closedDateTime: 'String (timestamp)',
comments: ['String'],
feedback: '@odata.type: microsoft.graph.alertFeedback',
status: '@odata.type: microsoft.graph.alertStatus',
tags: ['String'],
vendorInformation:
{
provider: 'String',
vendor: 'String'
}
};
await client.api('/security/alerts/{alert_id}')
.version('beta')
.update(alert);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Alerts\Item\AlertItemRequestBuilderPatchRequestConfiguration;
use Microsoft\Graph\Beta\Generated\Models\Alert;
use Microsoft\Graph\Beta\Generated\Models\AlertFeedback;
use Microsoft\Graph\Beta\Generated\Models\AlertStatus;
use Microsoft\Graph\Beta\Generated\Models\SecurityVendorInformation;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Alert();
$requestBody->setAssignedTo('String');
$requestBody->setClosedDateTime(new \DateTime('String (timestamp)'));
$requestBody->setComments(['String', ]);
$requestBody->setFeedback(new AlertFeedback('alertFeedback'));
$requestBody->setStatus(new AlertStatus('alertStatus'));
$requestBody->setTags(['String', ]);
$vendorInformation = new SecurityVendorInformation();
$vendorInformation->setProvider('String');
$vendorInformation->setVendor('String');
$requestBody->setVendorInformation($vendorInformation);
$requestConfiguration = new AlertItemRequestBuilderPatchRequestConfiguration();
$headers = [
'Prefer' => 'return=representation',
];
$requestConfiguration->headers = $headers;
$result = $graphServiceClient->security()->alerts()->byAlertId('alert-id')->patch($requestBody, $requestConfiguration)->wait();
Import-Module Microsoft.Graph.Beta.Security
$params = @{
assignedTo = "String"
closedDateTime = [System.DateTime]::Parse("String (timestamp)")
comments = @(
"String"
)
feedback = "@odata.type: microsoft.graph.alertFeedback"
status = "@odata.type: microsoft.graph.alertStatus"
tags = @(
"String"
)
vendorInformation = @{
provider = "String"
vendor = "String"
}
}
Update-MgBetaSecurityAlert -AlertId $alertId -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.alerts.item.alert_item_request_builder import AlertItemRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
from msgraph_beta.generated.models.alert import Alert
from msgraph_beta.generated.models.alert_feedback import AlertFeedback
from msgraph_beta.generated.models.alert_status import AlertStatus
from msgraph_beta.generated.models.security_vendor_information import SecurityVendorInformation
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Alert(
assigned_to = "String",
closed_date_time = "String (timestamp)",
comments = [
"String",
],
feedback = AlertFeedback.Unknown,
status = AlertStatus.Unknown,
tags = [
"String",
],
vendor_information = SecurityVendorInformation(
provider = "String",
vendor = "String",
),
)
request_configuration = RequestConfiguration()
request_configuration.headers.add("Prefer", "return=representation")
result = await graph_client.security.alerts.by_alert_id('alert-id').patch(request_body, request_configuration = request_configuration)
Respuesta
En el ejemplo siguiente se muestra una respuesta cuando se usa el encabezado de solicitud opcional Prefer: return=representation .
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 200 OK
Content-type: application/json
{
"activityGroupName": "activityGroupName-value",
"assignedTo": "assignedTo-value",
"azureSubscriptionId": "azureSubscriptionId-value",
"azureTenantId": "azureTenantId-value",
"category": "category-value",
"closedDateTime": "datetime-value"
}