case resource type (case management)

Namespace: microsoft.graph.security.caseManagement

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents an abstract security case that tracks an investigation and organizes related tasks, activities, relations, and attachments. Use the genericCase derived type to create case instances. You can't create incidentCase instances with API requests; incident cases are created by the service. Instances are differentiated by @odata.type. This is an abstract type.

Inherits from microsoft.graph.security.caseManagement.caseManagementEntity.

Methods

Use the Update method to update displayName and status for all case types. Other mutable properties depend on the concrete case type.

Method	Return type	Description
List	microsoft.graph.security.caseManagement.case collection	List security cases.
Create	microsoft.graph.security.caseManagement.case	Create a security case by specifying a supported derived type in @odata.type. The incidentCase derived type isn't supported for create requests.
Get	microsoft.graph.security.caseManagement.case	Read the properties and relationships of a security case.
Update	microsoft.graph.security.caseManagement.case	Update the supported mutable properties of a security case.
Delete	None	Delete a security case.

Properties

Property	Type	Description
createdBy	String	The user or service that created the case. Inherited from caseManagementEntity. Supports $filter (eq, ne) and $orderby.
createdDateTime	DateTimeOffset	The date and time when the case was created. Inherited from caseManagementEntity. Supports $filter (eq, ne, ge, le) and $orderby.
customFields	microsoft.graph.security.caseManagement.customFieldValues	Tenant-defined custom field values keyed by custom field identifier.
displayName	String	The display name of the case. Supports $filter (eq, ne) and $orderby.
id	String	The unique identifier for the case. Inherited from entity. Supports $filter (eq, ne) and $orderby.
lastModifiedBy	String	The user or service that last modified the case. Inherited from caseManagementEntity. Supports $filter (eq, ne) and $orderby.
lastModifiedDateTime	DateTimeOffset	The date and time when the case was last modified. Inherited from caseManagementEntity. Supports $filter (eq, ne, ge, le) and $orderby.
status	String	The lifecycle status of the case, such as open, in progress, or closed. Supports $filter (eq, ne) and $orderby.

Relationships

Relationship	Type	Description
activities	microsoft.graph.security.caseManagement.activity collection	The timeline of comments and audit events associated with the case. Supports $expand.
attachments	microsoft.graph.security.caseManagement.attachment collection	Evidence files and metadata associated with the case. Supports $expand.
relations	microsoft.graph.security.caseManagement.relation collection	Links from the case to related security resources. Supports $expand.
tasks	microsoft.graph.security.caseManagement.task collection	Tasks used to track work required to resolve the case. Supports $expand.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.caseManagement.case",
  "id": "String (identifier)",
  "createdDateTime": "String (timestamp)",
  "createdBy": "String",
  "lastModifiedDateTime": "String (timestamp)",
  "lastModifiedBy": "String",
  "displayName": "String",
  "status": "String",
  "customFields": {
    "@odata.type": "#microsoft.graph.security.caseManagement.customFieldValues"
  }
}