runDetails resource type

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents an instance of a custom detection rule run.

Properties

Property	Type	Description
errorCode	microsoft.graph.security.huntingRuleErrorCode	Error code of the most recent run that encountered an error. The possible values are: queryExecutionFailed, queryExecutionThrottling, queryExceededResultSize, queryLimitsExceeded, queryTimeout, alertCreationFailed, alertReportNotFound, partialRowsFailed, unknownFutureValue.
failureReason	String	Reason for failure when the custom detection last ran and failed. See the table below.
lastRunDateTime	DateTimeOffset	Timestamp when the custom detection was last run.
status	microsoft.graph.security.huntingRuleRunStatus	Status of custom detection when it was last run. The possible values are: running, completed, failed, partiallyFailed, unknownFutureValue.

Failure Reasons table

errorCode	Reason
queryExecutionFailed	An unexpected error occurred during query execution. Contact support if this failure reoccurs.
queryExecutionThrottling	Query execution was throttled due to exceeded tenant resources.
queryExceededResultSize	Result size limit exceeded. Only the first 100 query results were processed.
queryLimitsExceeded	Query execution was preempted. This failure can be due to high CPU and/or memory resource consumption. Optimize your query by following best practices and try again.
queryTimeout	Query execution took longer than the assigned timeout and was aborted.
alertCreationFailed	An unexpected error occurred while generating alerts from query results. Contact support if this failure reoccurs.
alertReportNotFound	An event couldn't be matched to the given Timestamp, DeviceId, or ReportId. Check the query for aggregation expressions on those columns.
partialRowsFailed	Only a subset of query results could be processed to alerts. Contact support if this failure reoccurs.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.runDetails",
  "lastRunDateTime": "String (timestamp)",
  "status": "String",
  "failureReason": "String",
  "errorCode": "String"
}