Alert interface

Package:
@azure/arm-security

Security alert

Extends
ProxyResource

Properties

alertDisplayName

The display name of the alert.
alertType

Unique identifier for the detection logic (all alert instances from the same detection logic will have the same alertType).
alertUri

A direct link to the alert page in Azure Portal.
compromisedEntity

The display name of the resource most related to this alert.
correlationKey

Key for corelating related alerts. Alerts with the same correlation key considered to be related.
description

Description of the suspicious activity that was detected.
endTimeUtc

The UTC time of the last event or activity included in the alert in ISO8601 format.
entities

A list of entities related to the alert.
extendedLinks

Links related to the alert
extendedProperties

Custom properties for the alert.
intent

The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents.
isIncident

This field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert.
processingEndTimeUtc

The UTC processing end time of the alert in ISO8601 format.
productComponentName

The name of Azure Security Center pricing tier which powering this alert. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing
productName

The name of the product which published this alert (Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and so on).
remediationSteps

Manual action items to take to remediate the alert.
resourceIdentifiers

The resource identifiers that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert.
severity

The risk level of the threat that was detected. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-alerts-overview#how-are-alerts-classified.
startTimeUtc

The UTC time of the first event or activity included in the alert in ISO8601 format.
status

The life cycle status of the alert.
subTechniques

Kill chain related sub-techniques behind the alert.
supportingEvidence

Changing set of properties depending on the supportingEvidence type.
systemAlertId

Unique identifier for the alert.
techniques

kill chain related techniques behind the alert.
timeGeneratedUtc

The UTC time the alert was generated in ISO8601 format.
vendorName

The name of the vendor that raises the alert.
version

Schema version.

Inherited Properties

id

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name

The name of the resource
systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.
type

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

Property Details

alertDisplayName

The display name of the alert.

alertDisplayName?: string

Property Value

string

alertType

Unique identifier for the detection logic (all alert instances from the same detection logic will have the same alertType).

alertType?: string

Property Value

string

alertUri

A direct link to the alert page in Azure Portal.

alertUri?: string

Property Value

string

compromisedEntity

The display name of the resource most related to this alert.

compromisedEntity?: string

Property Value

string

correlationKey

Key for corelating related alerts. Alerts with the same correlation key considered to be related.

correlationKey?: string

Property Value

string

description

Description of the suspicious activity that was detected.

description?: string

Property Value

string

endTimeUtc

The UTC time of the last event or activity included in the alert in ISO8601 format.

endTimeUtc?: Date

Property Value

Date

entities

A list of entities related to the alert.

entities?: AlertEntity[]

Property Value

AlertEntity[]

Links related to the alert

extendedLinks?: Record<string, string>[]

Property Value

Record<string, string>[]

extendedProperties

Custom properties for the alert.

extendedProperties?: Record<string, string>

Property Value

Record<string, string>

intent

The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents.

intent?: string

Property Value

string

isIncident

This field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert.

isIncident?: boolean

Property Value

boolean

processingEndTimeUtc

The UTC processing end time of the alert in ISO8601 format.

processingEndTimeUtc?: Date

Property Value

Date

productComponentName

The name of Azure Security Center pricing tier which powering this alert. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing

productComponentName?: string

Property Value

string

productName

The name of the product which published this alert (Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and so on).

productName?: string

Property Value

string

remediationSteps

Manual action items to take to remediate the alert.

remediationSteps?: string[]

Property Value

string[]

resourceIdentifiers

The resource identifiers that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert.

resourceIdentifiers?: ResourceIdentifierUnion[]

Property Value

ResourceIdentifierUnion[]

severity

The risk level of the threat that was detected. Learn more: https://docs.microsoft.com/en-us/azure/security-center/security-center-alerts-overview#how-are-alerts-classified.

severity?: string

Property Value

string

startTimeUtc

The UTC time of the first event or activity included in the alert in ISO8601 format.

startTimeUtc?: Date

Property Value

Date

status

The life cycle status of the alert.

status?: string

Property Value

string

subTechniques

Kill chain related sub-techniques behind the alert.

subTechniques?: string[]

Property Value

string[]

supportingEvidence

Changing set of properties depending on the supportingEvidence type.

supportingEvidence?: AlertPropertiesSupportingEvidence

Property Value

AlertPropertiesSupportingEvidence

systemAlertId

Unique identifier for the alert.

systemAlertId?: string

Property Value

string

techniques

kill chain related techniques behind the alert.

techniques?: string[]

Property Value

string[]

timeGeneratedUtc

The UTC time the alert was generated in ISO8601 format.

timeGeneratedUtc?: Date

Property Value

Date

vendorName

The name of the vendor that raises the alert.

vendorName?: string

Property Value

string

version

Schema version.

version?: string

Property Value

string

Inherited Property Details

id

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

id?: string

Property Value

string

Inherited From ProxyResource.id

name

The name of the resource

name?: string

Property Value

string

Inherited From ProxyResource.name

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.

systemData?: SystemData

Property Value

SystemData

Inherited From ProxyResource.systemData

type

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

type?: string

Property Value

string

Inherited From ProxyResource.type