responseAction resource type

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Describes an action taken on impacted assets as set in a custom detection rule. For more information, see response actions

This type is abstract and has multiple response action types that are derived from it:

• Stop and quarantine file
• Disable user
• Force user password reset
• Mark user as compromised
• Collect investigation package
• Initiate investigation
• Isolate device
• Restrict app execution
• Run antivirus scan
• Allow file
• Block file
• Hard delete email
• Soft delete email
• Move to inbox
• Move to deleted items
• Move to junk
• Incident task

Properties

None.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.responseAction"
}