@azure/arm-securityinsight 1.0.0-beta.5 → 1.0.0-beta.7

package/dist/browser/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAy4MH,sEAAsE;AACtE,MAAM,CAAN,IAAY,kBAaX;AAbD,WAAY,kBAAkB;IAC5B,gBAAgB;IAChB,6CAAuB,CAAA;IACvB,wCAAwC;IACxC,6FAAuE,CAAA;IACvE,aAAa;IACb,uCAAiB,CAAA;IACjB,0BAA0B;IAC1B,iEAA2C,CAAA;IAC3C,yBAAyB;IACzB,+DAAyC,CAAA;IACzC,UAAU;IACV,iCAAW,CAAA;AACb,CAAC,EAbW,kBAAkB,KAAlB,kBAAkB,QAa7B;AAgBD,sEAAsE;AACtE,MAAM,CAAN,IAAY,kBASX;AATD,WAAY,kBAAkB;IAC5B,WAAW;IACX,mCAAa,CAAA;IACb,kBAAkB;IAClB,iDAA2B,CAAA;IAC3B,sBAAsB;IACtB,yDAAmC,CAAA;IACnC,UAAU;IACV,iCAAW,CAAA;AACb,CAAC,EATW,kBAAkB,KAAlB,kBAAkB,QAS7B;AAcD,mEAAmE;AACnE,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,2BAA2B;IAC3B,0CAAuB,CAAA;IACvB,wBAAwB;IACxB,oCAAiB,CAAA;AACnB,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAYD,qEAAqE;AACrE,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,iCAAiC;IACjC,wCAAmB,CAAA;IACnB,iCAAiC;IACjC,wCAAmB,CAAA;AACrB,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B;AAYD,sEAAsE;AACtE,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,wCAAwC;IACxC,2CAAqB,CAAA;IACrB,8CAA8C;IAC9C,qDAA+B,CAAA;IAC/B,gDAAgD;IAChD,yDAAmC,CAAA;IACnC,sDAAsD;IACtD,mEAA6C,CAAA;IAC7C,2DAA2D;IAC3D,yCAAmB,CAAA;AACrB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAeD,mEAAmE;AACnE,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,oCAAoC;IACpC,wDAAqC,CAAA;IACrC,kCAAkC;IAClC,8CAA2B,CAAA;AAC7B,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAYD,yEAAyE;AACzE,MAAM,CAAN,IAAY,qBASX;AATD,WAAY,qBAAqB;IAC/B,oBAAoB;IACpB,sCAAa,CAAA;IACb,sBAAsB;IACtB,0CAAiB,CAAA;IACjB,mBAAmB;IACnB,oCAAW,CAAA;IACX,6BAA6B;IAC7B,wDAA+B,CAAA;AACjC,CAAC,EATW,qBAAqB,KAArB,qBAAqB,QAShC;AAcD,qEAAqE;AACrE,MAAM,CAAN,IAAY,iBAmCX;AAnCD,WAAY,iBAAiB;IAC3B,qBAAqB;IACrB,sDAAiC,CAAA;IACjC,0BAA0B;IAC1B,gEAA2C,CAAA;IAC3C,oBAAoB;IACpB,oDAA+B,CAAA;IAC/B,gBAAgB;IAChB,4CAAuB,CAAA;IACvB,kBAAkB;IAClB,gDAA2B,CAAA;IAC3B,0BAA0B;IAC1B,gEAA2C,CAAA;IAC3C,qBAAqB;IACrB,sDAAiC,CAAA;IACjC,uBAAuB;IACvB,0DAAqC,CAAA;IACrC,gBAAgB;IAChB,4CAAuB,CAAA;IACvB,sBAAsB;IACtB,wDAAmC,CAAA;IACnC,iBAAiB;IACjB,8CAAyB,CAAA;IACzB,mBAAmB;IACnB,kDAA6B,CAAA;IAC7B,wBAAwB;IACxB,4DAAuC,CAAA;IACvC,aAAa;IACb,sCAAiB,CAAA;IACjB,gBAAgB;IAChB,4CAAuB,CAAA;IACvB,2BAA2B;IAC3B,kEAA6C,CAAA;IAC7C,8BAA8B;IAC9B,wEAAmD,CAAA;AACrD,CAAC,EAnCW,iBAAiB,KAAjB,iBAAiB,QAmC5B;AA2BD,mEAAmE;AACnE,MAAM,CAAN,IAAY,eA6CX;AA7CD,WAAY,eAAe;IACzB,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,4CAA4C;IAC5C,gCAAa,CAAA;IACb,4CAA4C;IAC5C,gCAAa,CAAA;IACb,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,yDAAyD;IACzD,wDAAqC,CAAA;IACrC,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,iDAAiD;IACjD,wCAAqB,CAAA;IACrB,0CAA0C;IAC1C,4BAAS,CAAA;IACT,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,oDAAoD;IACpD,8CAA2B,CAAA;IAC3B,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,2CAA2C;IAC3C,8BAAW,CAAA;IACX,kDAAkD;IAClD,0CAAuB,CAAA;IACvB,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,gDAAgD;IAChD,wCAAqB,CAAA;IACrB,oDAAoD;IACpD,8CAA2B,CAAA;IAC3B,oDAAoD;IACpD,8CAA2B,CAAA;IAC3B,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,uDAAuD;IACvD,oDAAiC,CAAA;IACjC,yDAAyD;IACzD,8BAAW,CAAA;AACb,CAAC,EA7CW,eAAe,KAAf,eAAe,QA6C1B;AAgCD,2EAA2E;AAC3E,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,eAAe;IACf,gDAAqB,CAAA;IACrB,gBAAgB;IAChB,gDAAqB,CAAA;IACrB,sBAAsB;IACtB,0DAA+B,CAAA;IAC/B,cAAc;IACd,8CAAmB,CAAA;AACrB,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAcD,4EAA4E;AAC5E,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,cAAc;IACd,+CAAmB,CAAA;AACrB,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAWD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBAOX;AAPD,WAAY,oBAAoB;IAC9B,gBAAgB;IAChB,+CAAuB,CAAA;IACvB,cAAc;IACd,2CAAmB,CAAA;IACnB,eAAe;IACf,6CAAqB,CAAA;AACvB,CAAC,EAPW,oBAAoB,KAApB,oBAAoB,QAO/B;AAaD,yEAAyE;AACzE,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,cAAc;IACd,4CAAmB,CAAA;AACrB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAWD,+DAA+D;AAC/D,MAAM,CAAN,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,gBAAgB;IAChB,sCAAuB,CAAA;IACvB,eAAe;IACf,oCAAqB,CAAA;AACvB,CAAC,EALW,WAAW,KAAX,WAAW,QAKtB;AAYD,8EAA8E;AAC9E,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,eAAe;IACf,mDAAqB,CAAA;AACvB,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAWD,gFAAgF;AAChF,MAAM,CAAN,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,eAAe;IACf,qDAAqB,CAAA;AACvB,CAAC,EAHW,4BAA4B,KAA5B,4BAA4B,QAGvC;AAWD,sEAAsE;AACtE,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uEAAuE;IACvE,yEAAmD,CAAA;IACnD,gFAAgF;IAChF,qEAA+C,CAAA;IAC/C,kBAAkB;IAClB,iDAA2B,CAAA;AAC7B,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAaD,8EAA8E;AAC9E,MAAM,CAAN,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IACpC,wHAAwH;IACxH,+DAAiC,CAAA;IACjC,uCAAuC;IACvC,6DAA+B,CAAA;IAC/B,qCAAqC;IACrC,yDAA2B,CAAA;AAC7B,CAAC,EAPW,0BAA0B,KAA1B,0BAA0B,QAOrC;AAaD,mEAAmE;AACnE,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,kBAAkB;IAClB,8BAAW,CAAA;IACX,mBAAmB;IACnB,gCAAa,CAAA;IACb,8BAA8B;IAC9B,8CAA2B,CAAA;AAC7B,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAaD,qEAAqE;AACrE,MAAM,CAAN,IAAY,iBAOX;AAPD,WAAY,iBAAiB;IAC3B,4BAA4B;IAC5B,wCAAmB,CAAA;IACnB,gCAAgC;IAChC,8CAAyB,CAAA;IACzB,kBAAkB;IAClB,gDAA2B,CAAA;AAC7B,CAAC,EAPW,iBAAiB,KAAjB,iBAAiB,QAO5B;AAaD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBAeX;AAfD,WAAY,oBAAoB;IAC9B,2DAA2D;IAC3D,iDAAyB,CAAA;IACzB,kCAAkC;IAClC,6CAAqB,CAAA;IACrB,8CAA8C;IAC9C,iEAAyC,CAAA;IACzC,yCAAyC;IACzC,iDAAyB,CAAA;IACzB,2BAA2B;IAC3B,2CAAmB,CAAA;IACnB,2CAA2C;IAC3C,6DAAqC,CAAA;IACrC,yBAAyB;IACzB,mDAA2B,CAAA;AAC7B,CAAC,EAfW,oBAAoB,KAApB,oBAAoB,QAe/B;AAiBD,+EAA+E;AAC/E,MAAM,CAAN,IAAY,2BASX;AATD,WAAY,2BAA2B;IACrC,+CAA+C;IAC/C,4DAA6B,CAAA;IAC7B,iCAAiC;IACjC,4DAA6B,CAAA;IAC7B,mCAAmC;IACnC,gEAAiC,CAAA;IACjC,kCAAkC;IAClC,8DAA+B,CAAA;AACjC,CAAC,EATW,2BAA2B,KAA3B,2BAA2B,QAStC;AAcD,qFAAqF;AACrF,MAAM,CAAN,IAAY,iCASX;AATD,WAAY,iCAAiC;IAC3C,oDAAoD;IACpD,8EAAyC,CAAA;IACzC,wDAAwD;IACxD,oFAA+C,CAAA;IAC/C,sDAAsD;IACtD,gFAA2C,CAAA;IAC3C,gDAAgD;IAChD,sEAAiC,CAAA;AACnC,CAAC,EATW,iCAAiC,KAAjC,iCAAiC,QAS5C;AAcD,0EAA0E;AAC1E,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,uCAAuC;IACvC,uCAAa,CAAA;IACb,gDAAgD;IAChD,uDAA6B,CAAA;AAC/B,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAYD,kEAAkE;AAClE,MAAM,CAAN,IAAY,cAOX;AAPD,WAAY,cAAc;IACxB,yCAAyC;IACzC,qCAAmB,CAAA;IACnB,6CAA6C;IAC7C,+BAAa,CAAA;IACb,8CAA8C;IAC9C,iCAAe,CAAA;AACjB,CAAC,EAPW,cAAc,KAAd,cAAc,QAOzB;AAaD,uEAAuE;AACvE,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,6DAA6D;IAC7D,kCAAW,CAAA;IACX,gDAAgD;IAChD,wCAAiB,CAAA;IACjB,4BAA4B;IAC5B,wCAAiB,CAAA;AACnB,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAaD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBAOX;AAPD,WAAY,oBAAoB;IAC9B,mDAAmD;IACnD,2CAAmB,CAAA;IACnB,gGAAgG;IAChG,mCAAW,CAAA;IACX,gEAAgE;IAChE,qCAAa,CAAA;AACf,CAAC,EAPW,oBAAoB,KAApB,oBAAoB,QAO/B;AAaD,8EAA8E;AAC9E,MAAM,CAAN,IAAY,0BASX;AATD,WAAY,0BAA0B;IACpC,4FAA4F;IAC5F,6DAA+B,CAAA;IAC/B,0DAA0D;IAC1D,qDAAuB,CAAA;IACvB,+IAA+I;IAC/I,mDAAqB,CAAA;IACrB,+CAA+C;IAC/C,6CAAe,CAAA;AACjB,CAAC,EATW,0BAA0B,KAA1B,0BAA0B,QASrC;AAcD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBA6BX;AA7BD,WAAY,oBAAoB;IAC9B,yBAAyB;IACzB,2CAAmB,CAAA;IACnB,4UAA4U;IAC5U,2CAAmB,CAAA;IACnB,iSAAiS;IACjS,qDAA6B,CAAA;IAC7B,+XAA+X;IAC/X,mDAA2B,CAAA;IAC3B,kdAAkd;IACld,mEAA2C,CAAA;IAC3C,oRAAoR;IACpR,yDAAiC,CAAA;IACjC,oeAAoe;IACpe,6DAAqC,CAAA;IACrC,scAAsc;IACtc,+CAAuB,CAAA;IACvB,ykBAAykB;IACzkB,2DAAmC,CAAA;IACnC,oPAAoP;IACpP,+CAAuB,CAAA;IACvB,8QAA8Q;IAC9Q,iDAAyB,CAAA;IACzB,wQAAwQ;IACxQ,qDAA6B,CAAA;IAC7B,sIAAsI;IACtI,+DAAuC,CAAA;IACvC,gTAAgT;IAChT,yCAAiB,CAAA;AACnB,CAAC,EA7BW,oBAAoB,KAApB,oBAAoB,QA6B/B;AAwBD,sEAAsE;AACtE,MAAM,CAAN,IAAY,kBASX;AATD,WAAY,kBAAkB;IAC5B,oBAAoB;IACpB,mCAAa,CAAA;IACb,sBAAsB;IACtB,uCAAiB,CAAA;IACjB,mBAAmB;IACnB,iCAAW,CAAA;IACX,6BAA6B;IAC7B,qDAA+B,CAAA;AACjC,CAAC,EATW,kBAAkB,KAAlB,kBAAkB,QAS7B;AAcD,oEAAoE;AACpE,MAAM,CAAN,IAAY,gBAWX;AAXD,WAAY,gBAAgB;IAC1B,oBAAoB;IACpB,uCAAmB,CAAA;IACnB,gBAAgB;IAChB,+BAAW,CAAA;IACX,kCAAkC;IAClC,yCAAqB,CAAA;IACrB,wCAAwC;IACxC,2CAAuB,CAAA;IACvB,6BAA6B;IAC7B,6CAAyB,CAAA;AAC3B,CAAC,EAXW,gBAAgB,KAAhB,gBAAgB,QAW3B;AAeD,6DAA6D;AAC7D,MAAM,CAAN,IAAY,SAmCX;AAnCD,WAAY,SAAS;IACnB,oBAAoB;IACpB,4CAA+B,CAAA;IAC/B,eAAe;IACf,kCAAqB,CAAA;IACrB,eAAe;IACf,kCAAqB,CAAA;IACrB,uBAAuB;IACvB,kDAAqC,CAAA;IACrC,eAAe;IACf,kCAAqB,CAAA;IACrB,uBAAuB;IACvB,kDAAqC,CAAA;IACrC,4BAA4B;IAC5B,4DAA+C,CAAA;IAC/C,oBAAoB;IACpB,4CAA+B,CAAA;IAC/B,mBAAmB;IACnB,0CAA6B,CAAA;IAC7B,yBAAyB;IACzB,sDAAyC,CAAA;IACzC,aAAa;IACb,8BAAiB,CAAA;IACjB,gBAAgB;IAChB,oCAAuB,CAAA;IACvB,wBAAwB;IACxB,oDAAuC,CAAA;IACvC,eAAe;IACf,kCAAqB,CAAA;IACrB,oBAAoB;IACpB,4CAA+B,CAAA;IAC/B,+BAA+B;IAC/B,kEAAqD,CAAA;IACrD,qBAAqB;IACrB,8CAAiC,CAAA;AACnC,CAAC,EAnCW,SAAS,KAAT,SAAS,QAmCpB;AA2BD,mEAAmE;AACnE,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,qBAAqB;IACrB,oDAAiC,CAAA;IACjC,gBAAgB;IAChB,0CAAuB,CAAA;IACvB,eAAe;IACf,wCAAqB,CAAA;IACrB,uBAAuB;IACvB,wDAAqC,CAAA;AACvC,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B;AAcD,oEAAoE;AACpE,MAAM,CAAN,IAAY,gBAOX;AAPD,WAAY,gBAAgB;IAC1B,gBAAgB;IAChB,2CAAuB,CAAA;IACvB,cAAc;IACd,uCAAmB,CAAA;IACnB,gBAAgB;IAChB,2CAAuB,CAAA;AACzB,CAAC,EAPW,gBAAgB,KAAhB,gBAAgB,QAO3B;AAaD,iEAAiE;AACjE,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,UAAU;IACV,4BAAW,CAAA;IACX,SAAS;IACT,0BAAS,CAAA;AACX,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAYD,wFAAwF;AACxF,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,cAAc;IACd,2DAAmB,CAAA;AACrB,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAWD,oEAAoE;AACpE,MAAM,CAAN,IAAY,gBASX;AATD,WAAY,gBAAgB;IAC1B,gBAAgB;IAChB,2CAAuB,CAAA;IACvB,aAAa;IACb,qCAAiB,CAAA;IACjB,sBAAsB;IACtB,uDAAmC,CAAA;IACnC,WAAW;IACX,iCAAa,CAAA;AACf,CAAC,EATW,gBAAgB,KAAhB,gBAAgB,QAS3B;AAcD,iEAAiE;AACjE,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,aAAa;IACb,kCAAiB,CAAA;IACjB,aAAa;IACb,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAYD,gEAAgE;AAChE,MAAM,CAAN,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,SAAS;IACT,yBAAS,CAAA;IACT,SAAS;IACT,yBAAS,CAAA;AACX,CAAC,EALW,YAAY,KAAZ,YAAY,QAKvB;AAYD,oEAAoE;AACpE,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,mBAAmB;IACnB,iDAA6B,CAAA;IAC7B,eAAe;IACf,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAYD,8EAA8E;AAC9E,MAAM,CAAN,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IACpC,cAAc;IACd,iDAAmB,CAAA;IACnB,mBAAmB;IACnB,2DAA6B,CAAA;IAC7B,eAAe;IACf,mDAAqB,CAAA;AACvB,CAAC,EAPW,0BAA0B,KAA1B,0BAA0B,QAOrC;AAaD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBASX;AATD,WAAY,oBAAoB;IAC9B,iBAAiB;IACjB,kDAA0B,CAAA;IAC1B,gBAAgB;IAChB,+CAAuB,CAAA;IACvB,aAAa;IACb,yCAAiB,CAAA;IACjB,gBAAgB;IAChB,+CAAuB,CAAA;AACzB,CAAC,EATW,oBAAoB,KAApB,oBAAoB,QAS/B;AAcD,yEAAyE;AACzE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,cAAc;IACd,4CAAmB,CAAA;IACnB,eAAe;IACf,8CAAqB,CAAA;IACrB,aAAa;IACb,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAaD,2FAA2F;AAC3F,MAAM,CAAN,IAAY,uCAGX;AAHD,WAAY,uCAAuC;IACjD,qEAAqE;IACrE,kEAAuB,CAAA;AACzB,CAAC,EAHW,uCAAuC,KAAvC,uCAAuC,QAGlD;AAWD,8FAA8F;AAC9F,MAAM,CAAN,IAAY,0CAOX;AAPD,WAAY,0CAA0C;IACpD,eAAe;IACf,mEAAqB,CAAA;IACrB,gBAAgB;IAChB,qEAAuB,CAAA;IACvB,iBAAiB;IACjB,uEAAyB,CAAA;AAC3B,CAAC,EAPW,0CAA0C,KAA1C,0CAA0C,QAOrD;AAaD,mEAAmE;AACnE,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,gBAAgB;IAChB,2CAAwB,CAAA;IACxB,oBAAoB;IACpB,mDAAgC,CAAA;AAClC,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAYD,0EAA0E;AAC1E,MAAM,CAAN,IAAY,sBAyCX;AAzCD,WAAY,sBAAsB;IAChC,2BAA2B;IAC3B,uEAA6C,CAAA;IAC7C,0BAA0B;IAC1B,qEAA2C,CAAA;IAC3C,gCAAgC;IAChC,iFAAuD,CAAA;IACvD,yBAAyB;IACzB,mEAAyC,CAAA;IACzC,8BAA8B;IAC9B,6EAAmD,CAAA;IACnD,gBAAgB;IAChB,iDAAuB,CAAA;IACvB,gBAAgB;IAChB,iDAAuB,CAAA;IACvB,gBAAgB;IAChB,iDAAuB,CAAA;IACvB,uBAAuB;IACvB,+DAAqC,CAAA;IACrC,oBAAoB;IACpB,yDAA+B,CAAA;IAC/B,kCAAkC;IAClC,qFAA2D,CAAA;IAC3D,0BAA0B;IAC1B,qEAA2C,CAAA;IAC3C,oCAAoC;IACpC,yFAA+D,CAAA;IAC/D,gDAAgD;IAChD,iHAAuF,CAAA;IACvF,kBAAkB;IAClB,qDAA2B,CAAA;IAC3B,gCAAgC;IAChC,iFAAuD,CAAA;IACvD,kCAAkC;IAClC,qFAA2D,CAAA;IAC3D,gBAAgB;IAChB,iDAAuB,CAAA;IACvB,iBAAiB;IACjB,mDAAyB,CAAA;IACzB,UAAU;IACV,qCAAW,CAAA;AACb,CAAC,EAzCW,sBAAsB,KAAtB,sBAAsB,QAyCjC;AA8BD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBAOX;AAPD,WAAY,oBAAoB;IAC9B,YAAY;IACZ,uCAAe,CAAA;IACf,aAAa;IACb,yCAAiB,CAAA;IACjB,aAAa;IACb,yCAAiB,CAAA;AACnB,CAAC,EAPW,oBAAoB,KAApB,oBAAoB,QAO/B;AAaD,wFAAwF;AACxF,MAAM,CAAN,IAAY,oCAKX;AALD,WAAY,oCAAoC;IAC9C,YAAY;IACZ,uDAAe,CAAA;IACf,cAAc;IACd,2DAAmB,CAAA;AACrB,CAAC,EALW,oCAAoC,KAApC,oCAAoC,QAK/C;AAYD,kFAAkF;AAClF,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC,YAAY;IACZ,iDAAe,CAAA;IACf,cAAc;IACd,qDAAmB,CAAA;IACnB,cAAc;IACd,qDAAmB,CAAA;AACrB,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAaD,uEAAuE;AACvE,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,oEAAoE;IACpE,8CAAuB,CAAA;IACvB,wCAAwC;IACxC,8CAAuB,CAAA;IACvB,2CAA2C;IAC3C,oDAA6B,CAAA;AAC/B,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAaD,0EAA0E;AAC1E,MAAM,CAAN,IAAY,sBAqCX;AArCD,WAAY,sBAAsB;IAChC,+BAA+B;IAC/B,6CAAmB,CAAA;IACnB,uBAAuB;IACvB,uCAAa,CAAA;IACb,6BAA6B;IAC7B,mCAAS,CAAA;IACT,0BAA0B;IAC1B,6CAAmB,CAAA;IACnB,8BAA8B;IAC9B,uCAAa,CAAA;IACb,0BAA0B;IAC1B,6CAAmB,CAAA;IACnB,4BAA4B;IAC5B,+DAAqC,CAAA;IACrC,sBAAsB;IACtB,qCAAW,CAAA;IACX,iCAAiC;IACjC,yDAA+B,CAAA;IAC/B,4BAA4B;IAC5B,+CAAqB,CAAA;IACrB,+BAA+B;IAC/B,qDAA2B,CAAA;IAC3B,iCAAiC;IACjC,yDAA+B,CAAA;IAC/B,iCAAiC;IACjC,yDAA+B,CAAA;IAC/B,sBAAsB;IACtB,qCAAW,CAAA;IACX,0BAA0B;IAC1B,6CAAmB,CAAA;IACnB,+BAA+B;IAC/B,qDAA2B,CAAA;IAC3B,+BAA+B;IAC/B,qDAA2B,CAAA;IAC3B,kCAAkC;IAClC,2DAAiC,CAAA;AACnC,CAAC,EArCW,sBAAsB,KAAtB,sBAAsB,QAqCjC;AA4BD,qFAAqF;AACrF,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,kBAAkB;IAClB,gEAA2B,CAAA;IAC3B,qBAAqB;IACrB,sEAAiC,CAAA;AACnC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAYD,qFAAqF;AACrF,MAAM,CAAN,IAAY,iCAeX;AAfD,WAAY,iCAAiC;IAC3C,gCAAgC;IAChC,+FAA0D,CAAA;IAC1D,0BAA0B;IAC1B,kFAA6C,CAAA;IAC7C,oCAAoC;IACpC,uGAAkE,CAAA;IAClE,6CAA6C;IAC7C,0HAAqF,CAAA;IACrF,gCAAgC;IAChC,gGAA2D,CAAA;IAC3D,wCAAwC;IACxC,gHAA2E,CAAA;IAC3E,gDAAgD;IAChD,gIAA2F,CAAA;AAC7F,CAAC,EAfW,iCAAiC,KAAjC,iCAAiC,QAe5C;AAiBD,uEAAuE;AACvE,MAAM,CAAN,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,uEAAuE;IACvE,kDAA2B,CAAA;IAC3B,wEAAwE;IACxE,4CAAqB,CAAA;IACrB,8GAA8G;IAC9G,4CAAqB,CAAA;AACvB,CAAC,EAPW,mBAAmB,KAAnB,mBAAmB,QAO9B;AAaD,oEAAoE;AACpE,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,yBAAyB;IACzB,+CAA2B,CAAA;IAC3B,qBAAqB;IACrB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAYD,wGAAwG;AACxG,MAAM,CAAN,IAAY,oDAKX;AALD,WAAY,oDAAoD;IAC9D,yEAAyE;IACzE,mEAAW,CAAA;IACX,qFAAqF;IACrF,iEAAS,CAAA;AACX,CAAC,EALW,oDAAoD,KAApD,oDAAoD,QAK/D;AAYD,sHAAsH;AACtH,MAAM,CAAN,IAAY,kEASX;AATD,WAAY,kEAAkE;IAC5E,2CAA2C;IAC3C,uFAAiB,CAAA;IACjB,2CAA2C;IAC3C,uFAAiB,CAAA;IACjB,4CAA4C;IAC5C,yFAAmB,CAAA;IACnB,6CAA6C;IAC7C,2FAAqB,CAAA;AACvB,CAAC,EATW,kEAAkE,KAAlE,kEAAkE,QAS7E;AAcD,uHAAuH;AACvH,MAAM,CAAN,IAAY,mEAGX;AAHD,WAAY,mEAAmE;IAC7E,yDAAyD;IACzD,sFAAe,CAAA;AACjB,CAAC,EAHW,mEAAmE,KAAnE,mEAAmE,QAG9E;AAWD,+GAA+G;AAC/G,MAAM,CAAN,IAAY,2DAKX;AALD,WAAY,2DAA2D;IACrE,uDAAuD;IACvD,8FAA+B,CAAA;IAC/B,yDAAyD;IACzD,wGAAyC,CAAA;AAC3C,CAAC,EALW,2DAA2D,KAA3D,2DAA2D,QAKtE;AAYD,wHAAwH;AACxH,MAAM,CAAN,IAAY,oEAGX;AAHD,WAAY,oEAAoE;IAC9E,6DAA6D;IAC7D,2FAAmB,CAAA;AACrB,CAAC,EAHW,oEAAoE,KAApE,oEAAoE,QAG/E;AAWD,oHAAoH;AACpH,MAAM,CAAN,IAAY,gEAOX;AAPD,WAAY,gEAAgE;IAC1E,sDAAsD;IACtD,yGAAqC,CAAA;IACrC,oDAAoD;IACpD,qGAAiC,CAAA;IACjC,mDAAmD;IACnD,mGAA+B,CAAA;AACjC,CAAC,EAPW,gEAAgE,KAAhE,gEAAgE,QAO3E;AAaD,mHAAmH;AACnH,MAAM,CAAN,IAAY,+DAKX;AALD,WAAY,+DAA+D;IACzE,mEAAmE;IACnE,8FAA2B,CAAA;IAC3B,kEAAkE;IAClE,0FAAuB,CAAA;AACzB,CAAC,EALW,+DAA+D,KAA/D,+DAA+D,QAK1E;AAYD,yGAAyG;AACzG,MAAM,CAAN,IAAY,qDAiBX;AAjBD,WAAY,qDAAqD;IAC/D,4EAA4E;IAC5E,0EAAiB,CAAA;IACjB,2EAA2E;IAC3E,gFAAuB,CAAA;IACvB,8EAA8E;IAC9E,8EAAqB,CAAA;IACrB,6EAA6E;IAC7E,oFAA2B,CAAA;IAC3B,wEAAwE;IACxE,kFAAyB,CAAA;IACzB,gFAAgF;IAChF,wFAA+B,CAAA;IAC/B,sEAAsE;IACtE,8EAAqB,CAAA;IACrB,8EAA8E;IAC9E,oFAA2B,CAAA;AAC7B,CAAC,EAjBW,qDAAqD,KAArD,qDAAqD,QAiBhE;AAkBD,yGAAyG;AACzG,MAAM,CAAN,IAAY,qDAqHX;AArHD,WAAY,qDAAqD;IAC/D,gCAAgC;IAChC,wFAA+B,CAAA;IAC/B,sCAAsC;IACtC,oGAA2C,CAAA;IAC3C,mCAAmC;IACnC,8FAAqC,CAAA;IACrC,iCAAiC;IACjC,0FAAiC,CAAA;IACjC,oDAAoD;IACpD,0HAAiE,CAAA;IACjE,kCAAkC;IAClC,4FAAmC,CAAA;IACnC,iCAAiC;IACjC,wFAA+B,CAAA;IAC/B,wCAAwC;IACxC,sGAA6C,CAAA;IAC7C,wCAAwC;IACxC,4GAAmD,CAAA;IACnD,qCAAqC;IACrC,8GAAqD,CAAA;IACrD,uCAAuC;IACvC,kHAAyD,CAAA;IACzD,mDAAmD;IACnD,kGAAyC,CAAA;IACzC,iDAAiD;IACjD,8FAAqC,CAAA;IACrC,uBAAuB;IACvB,oFAA2B,CAAA;IAC3B,sCAAsC;IACtC,4FAAmC,CAAA;IACnC,0DAA0D;IAC1D,oFAA2B,CAAA;IAC3B,sCAAsC;IACtC,kFAAyB,CAAA;IACzB,oCAAoC;IACpC,gGAAuC,CAAA;IACvC,6CAA6C;IAC7C,8FAAqC,CAAA;IACrC,2CAA2C;IAC3C,gGAAuC,CAAA;IACvC,yCAAyC;IACzC,sGAA6C,CAAA;IAC7C,4BAA4B;IAC5B,4GAAmD,CAAA;IACnD,yCAAyC;IACzC,oHAA2D,CAAA;IAC3D,uCAAuC;IACvC,wGAA+C,CAAA;IAC/C,iCAAiC;IACjC,4GAAmD,CAAA;IACnD,iCAAiC;IACjC,wFAA+B,CAAA;IAC/B,mCAAmC;IACnC,wFAA+B,CAAA;IAC/B,iCAAiC;IACjC,8EAAqB,CAAA;IACrB,0BAA0B;IAC1B,wFAA+B,CAAA;IAC/B,iCAAiC;IACjC,oFAA2B,CAAA;IAC3B,mCAAmC;IACnC,8EAAqB,CAAA;IACrB,4BAA4B;IAC5B,4FAAmC,CAAA;IACnC,yBAAyB;IACzB,sFAA6B,CAAA;IAC7B,gCAAgC;IAChC,wFAA+B,CAAA;IAC/B,yBAAyB;IACzB,oFAA2B,CAAA;IAC3B,0BAA0B;IAC1B,wFAA+B,CAAA;IAC/B,0BAA0B;IAC1B,wFAA+B,CAAA;IAC/B,4BAA4B;IAC5B,4FAAmC,CAAA;IACnC,2BAA2B;IAC3B,0FAAiC,CAAA;IACjC,sCAAsC;IACtC,8GAAqD,CAAA;IACrD,qBAAqB;IACrB,gFAAuB,CAAA;IACvB,+BAA+B;IAC/B,kGAAyC,CAAA;IACzC,kCAAkC;IAClC,wGAA+C,CAAA;IAC/C,sCAAsC;IACtC,kFAAyB,CAAA;IACzB,uCAAuC;IACvC,gHAAuD,CAAA;IACvD,yCAAyC;IACzC,oHAA2D,CAAA;IAC3D,iCAAiC;IACjC,sGAA6C,CAAA;IAC7C,yCAAyC;IACzC,oGAA2C,CAAA;IAC3C,+BAA+B;IAC/B,kGAAyC,CAAA;IACzC,iCAAiC;IACjC,oGAA2C,CAAA;IAC3C,iCAAiC;IACjC,oGAA2C,CAAA;IAC3C,2BAA2B;IAC3B,4FAAmC,CAAA;IACnC,uBAAuB;IACvB,oFAA2B,CAAA;IAC3B,yCAAyC;IACzC,kGAAyC,CAAA;IACzC,qBAAqB;IACrB,gFAAuB,CAAA;IACvB,4BAA4B;IAC5B,oFAA2B,CAAA;IAC3B,gEAAgE;IAChE,gGAAuC,CAAA;IACvC,cAAc;IACd,oEAAW,CAAA;AACb,CAAC,EArHW,qDAAqD,KAArD,qDAAqD,QAqHhE;AAoED,mEAAmE;AACnE,MAAM,CAAN,IAAY,eA6CX;AA7CD,WAAY,eAAe;IACzB,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,4CAA4C;IAC5C,gCAAa,CAAA;IACb,4CAA4C;IAC5C,gCAAa,CAAA;IACb,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,yDAAyD;IACzD,wDAAqC,CAAA;IACrC,2CAA2C;IAC3C,8BAAW,CAAA;IACX,iDAAiD;IACjD,wCAAqB,CAAA;IACrB,0CAA0C;IAC1C,4BAAS,CAAA;IACT,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,oDAAoD;IACpD,8CAA2B,CAAA;IAC3B,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,2CAA2C;IAC3C,8BAAW,CAAA;IACX,kDAAkD;IAClD,0CAAuB,CAAA;IACvB,sDAAsD;IACtD,kDAA+B,CAAA;IAC/B,uDAAuD;IACvD,sDAAmC,CAAA;IACnC,oDAAoD;IACpD,8CAA2B,CAAA;IAC3B,oDAAoD;IACpD,8CAA2B,CAAA;IAC3B,+CAA+C;IAC/C,sCAAmB,CAAA;IACnB,uDAAuD;IACvD,oDAAiC,CAAA;IACjC,yDAAyD;IACzD,8BAAW,CAAA;AACb,CAAC,EA7CW,eAAe,KAAf,eAAe,QA6C1B;AAgCD,mEAAmE;AACnE,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,aAAa;IACb,oCAAiB,CAAA;IACjB,aAAa;IACb,oCAAiB,CAAA;IACjB,WAAW;IACX,gCAAa,CAAA;IACb,aAAa;IACb,oCAAiB,CAAA;AACnB,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B;AAcD,uEAAuE;AACvE,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,iDAAiD;IACjD,gDAAyB,CAAA;IACzB,gDAAgD;IAChD,8CAAuB,CAAA;AACzB,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAYD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,sBAAsB;IACtB,2DAAmC,CAAA;IACnC,2BAA2B;IAC3B,qEAA6C,CAAA;AAC/C,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAYD,wEAAwE;AACxE,MAAM,CAAN,IAAY,oBASX;AATD,WAAY,oBAAoB;IAC9B,gBAAgB;IAChB,+CAAuB,CAAA;IACvB,oBAAoB;IACpB,uDAA+B,CAAA;IAC/B,oBAAoB;IACpB,uDAA+B,CAAA;IAC/B,iBAAiB;IACjB,iDAAyB,CAAA;AAC3B,CAAC,EATW,oBAAoB,KAApB,oBAAoB,QAS/B;AAcD,sEAAsE;AACtE,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,cAAc;IACd,yCAAmB,CAAA;IACnB,eAAe;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAYD,yEAAyE;AACzE,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,oBAAoB;IACpB,oDAA2B,CAAA;IAC3B,mBAAmB;IACnB,kDAAyB,CAAA;IACzB,iBAAiB;IACjB,8CAAqB,CAAA;AACvB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAaD,yEAAyE;AACzE,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,uBAAuB;IACvB,8DAAqC,CAAA;AACvC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAWD,qEAAqE;AACrE,MAAM,CAAN,IAAY,iBAaX;AAbD,WAAY,iBAAiB;IAC3B,4CAA4C;IAC5C,sGAAiF,CAAA;IACjF,6CAA6C;IAC7C,wGAAmF,CAAA;IACnF,wDAAwD;IACxD,+HAA0G,CAAA;IAC1G,wCAAwC;IACxC,8FAAyE,CAAA;IACzE,uDAAuD;IACvD,6HAAwG,CAAA;IACxG,8CAA8C;IAC9C,0GAAqF,CAAA;AACvF,CAAC,EAbW,iBAAiB,KAAjB,iBAAiB,QAa5B;AAgBD,gFAAgF;AAChF,MAAM,CAAN,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IACtC,oBAAoB;IACpB,+DAA+B,CAAA;IAC/B,mBAAmB;IACnB,6DAA6B,CAAA;IAC7B,gBAAgB;IAChB,uDAAuB,CAAA;AACzB,CAAC,EAPW,4BAA4B,KAA5B,4BAA4B,QAOvC;AAaD,oEAAoE;AACpE,MAAM,CAAN,IAAY,gBAOX;AAPD,WAAY,gBAAgB;IAC1B,oBAAoB;IACpB,mDAA+B,CAAA;IAC/B,4BAA4B;IAC5B,mEAA+C,CAAA;IAC/C,kBAAkB;IAClB,+CAA2B,CAAA;AAC7B,CAAC,EAPW,gBAAgB,KAAhB,gBAAgB,QAO3B;AAaD,0EAA0E;AAC1E,MAAM,CAAN,IAAY,sBAWX;AAXD,WAAY,sBAAsB;IAChC,6BAA6B;IAC7B,6CAAmB,CAAA;IACnB,oBAAoB;IACpB,qCAAW,CAAA;IACX,qBAAqB;IACrB,uCAAa,CAAA;IACb,uBAAuB;IACvB,2CAAiB,CAAA;IACjB,oCAAoC;IACpC,+CAAqB,CAAA;AACvB,CAAC,EAXW,sBAAsB,KAAtB,sBAAsB,QAWjC;AAeD,yEAAyE;AACzE,MAAM,CAAN,IAAY,qBASX;AATD,WAAY,qBAAqB;IAC/B,8BAA8B;IAC9B,4CAAmB,CAAA;IACnB,UAAU;IACV,oCAAW,CAAA;IACX,aAAa;IACb,0CAAiB,CAAA;IACjB,WAAW;IACX,sCAAa,CAAA;AACf,CAAC,EATW,qBAAqB,KAArB,qBAAqB,QAShC;AAcD,8EAA8E;AAC9E,MAAM,CAAN,IAAY,0BASX;AATD,WAAY,0BAA0B;IACpC,cAAc;IACd,iDAAmB,CAAA;IACnB,cAAc;IACd,iDAAmB,CAAA;IACnB,eAAe;IACf,mDAAqB,CAAA;IACrB,eAAe;IACf,mDAAqB,CAAA;AACvB,CAAC,EATW,0BAA0B,KAA1B,0BAA0B,QASrC;AAcD,qEAAqE;AACrE,MAAM,CAAN,IAAY,iBAqBX;AArBD,WAAY,iBAAiB;IAC3B,yBAAyB;IACzB,4DAAuC,CAAA;IACvC,wBAAwB;IACxB,0DAAqC,CAAA;IACrC,0BAA0B;IAC1B,8DAAyC,CAAA;IACzC,iBAAiB;IACjB,6CAAwB,CAAA;IACxB,uCAAuC;IACvC,sFAAiE,CAAA;IACjE,4BAA4B;IAC5B,kEAA6C,CAAA;IAC7C,+BAA+B;IAC/B,wEAAmD,CAAA;IACnD,4BAA4B;IAC5B,kEAA6C,CAAA;IAC7C,aAAa;IACb,qCAAgB,CAAA;IAChB,wBAAwB;IACxB,0DAAqC,CAAA;AACvC,CAAC,EArBW,iBAAiB,KAAjB,iBAAiB,QAqB5B;AAoBD,0EAA0E;AAC1E,MAAM,CAAN,IAAY,sBAiBX;AAjBD,WAAY,sBAAsB;IAChC,WAAW;IACX,uCAAa,CAAA;IACb,yBAAyB;IACzB,6CAAmB,CAAA;IACnB,wBAAwB;IACxB,2CAAiB,CAAA;IACjB,8BAA8B;IAC9B,uDAA6B,CAAA;IAC7B,wBAAwB;IACxB,2CAAiB,CAAA;IACjB,uBAAuB;IACvB,yCAAe,CAAA;IACf,6BAA6B;IAC7B,qDAA2B,CAAA;IAC3B,uBAAuB;IACvB,yCAAe,CAAA;AACjB,CAAC,EAjBW,sBAAsB,KAAtB,sBAAsB,QAiBjC","sourcesContent":["/*\n * Copyright (c) Microsoft Corporation.\n * Licensed under the MIT License.\n *\n * Code generated by Microsoft (R) AutoRest Code Generator.\n * Changes may cause incorrect behavior and will be lost if the code is regenerated.\n */\n\nimport * as coreClient from \"@azure/core-client\";\n\nexport type AutomationRuleConditionUnion =\n  | AutomationRuleCondition\n  | BooleanConditionProperties\n  | PropertyArrayChangedConditionProperties\n  | PropertyArrayConditionProperties\n  | PropertyChangedConditionProperties\n  | PropertyConditionProperties;\nexport type AutomationRuleActionUnion =\n  | AutomationRuleAction\n  | AutomationRuleModifyPropertiesAction\n  | AutomationRuleRunPlaybookAction;\nexport type EntityTimelineItemUnion =\n  | EntityTimelineItem\n  | ActivityTimelineItem\n  | BookmarkTimelineItem\n  | AnomalyTimelineItem\n  | SecurityAlertTimelineItem;\nexport type EntityQueryItemUnion = EntityQueryItem | InsightQueryItem;\nexport type DataConnectorsCheckRequirementsUnion =\n  | DataConnectorsCheckRequirements\n  | AADCheckRequirements\n  | AatpCheckRequirements\n  | ASCCheckRequirements\n  | AwsCloudTrailCheckRequirements\n  | AwsS3CheckRequirements\n  | Dynamics365CheckRequirements\n  | McasCheckRequirements\n  | MdatpCheckRequirements\n  | MstiCheckRequirements\n  | MtpCheckRequirements\n  | OfficeATPCheckRequirements\n  | OfficeIRMCheckRequirements\n  | Office365ProjectCheckRequirements\n  | OfficePowerBICheckRequirements\n  | TICheckRequirements\n  | TiTaxiiCheckRequirements\n  | IoTCheckRequirements;\nexport type AlertRuleTemplateUnion =\n  | AlertRuleTemplate\n  | MLBehaviorAnalyticsAlertRuleTemplate\n  | FusionAlertRuleTemplate\n  | ThreatIntelligenceAlertRuleTemplate\n  | MicrosoftSecurityIncidentCreationAlertRuleTemplate\n  | ScheduledAlertRuleTemplate\n  | NrtAlertRuleTemplate;\nexport type EntityUnion =\n  | Entity\n  | SecurityAlert\n  | HuntingBookmark\n  | AccountEntity\n  | AzureResourceEntity\n  | CloudApplicationEntity\n  | DnsEntity\n  | FileEntity\n  | FileHashEntity\n  | HostEntity\n  | IoTDeviceEntity\n  | IpEntity\n  | MailboxEntity\n  | MailClusterEntity\n  | MailMessageEntity\n  | MalwareEntity\n  | ProcessEntity\n  | RegistryKeyEntity\n  | RegistryValueEntity\n  | SecurityGroupEntity\n  | SubmissionMailEntity\n  | UrlEntity\n  | NicEntity;\nexport type EntityQueryTemplateUnion =\n  | EntityQueryTemplate\n  | ActivityEntityQueryTemplate;\nexport type AlertRuleUnion =\n  | AlertRule\n  | MLBehaviorAnalyticsAlertRule\n  | FusionAlertRule\n  | ThreatIntelligenceAlertRule\n  | MicrosoftSecurityIncidentCreationAlertRule\n  | ScheduledAlertRule\n  | NrtAlertRule;\nexport type EntityQueryUnion =\n  | EntityQuery\n  | ExpansionEntityQuery\n  | ActivityEntityQuery;\nexport type CustomEntityQueryUnion =\n  | CustomEntityQuery\n  | ActivityCustomEntityQuery;\nexport type SecurityMLAnalyticsSettingUnion =\n  | SecurityMLAnalyticsSetting\n  | AnomalySecurityMLAnalyticsSettings;\nexport type SettingsUnion =\n  | Settings\n  | Anomalies\n  | EyesOn\n  | EntityAnalytics\n  | Ueba;\nexport type ThreatIntelligenceInformationUnion =\n  | ThreatIntelligenceInformation\n  | ThreatIntelligenceIndicatorModel;\nexport type DataConnectorUnion =\n  | DataConnector\n  | AADDataConnector\n  | MstiDataConnector\n  | MTPDataConnector\n  | AatpDataConnector\n  | ASCDataConnector\n  | AwsCloudTrailDataConnector\n  | AwsS3DataConnector\n  | McasDataConnector\n  | Dynamics365DataConnector\n  | OfficeATPDataConnector\n  | Office365ProjectDataConnector\n  | OfficePowerBIDataConnector\n  | OfficeIRMDataConnector\n  | MdatpDataConnector\n  | OfficeDataConnector\n  | TIDataConnector\n  | TiTaxiiDataConnector\n  | IoTDataConnector\n  | CodelessUiDataConnector\n  | CodelessApiPollingDataConnector;\n\n/** List all the alert rules. */\nexport interface AlertRulesList {\n  /**\n   * URL to fetch the next set of alert rules.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of alert rules. */\n  value: AlertRuleUnion[];\n}\n\n/** Common fields that are returned in the response for all Azure Resource Manager resources */\nexport interface Resource {\n  /**\n   * Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly id?: string;\n  /**\n   * The name of the resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly name?: string;\n  /**\n   * The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or \"Microsoft.Storage/storageAccounts\"\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly type?: string;\n  /**\n   * Azure Resource Manager metadata containing createdBy and modifiedBy information.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly systemData?: SystemData;\n}\n\n/** Metadata pertaining to creation and last modification of the resource. */\nexport interface SystemData {\n  /** The identity that created the resource. */\n  createdBy?: string;\n  /** The type of identity that created the resource. */\n  createdByType?: CreatedByType;\n  /** The timestamp of resource creation (UTC). */\n  createdAt?: Date;\n  /** The identity that last modified the resource. */\n  lastModifiedBy?: string;\n  /** The type of identity that last modified the resource. */\n  lastModifiedByType?: CreatedByType;\n  /** The timestamp of resource last modification (UTC) */\n  lastModifiedAt?: Date;\n}\n\n/** Error response structure. */\nexport interface CloudError {\n  /** Error data */\n  error?: CloudErrorBody;\n}\n\n/** Error details. */\nexport interface CloudErrorBody {\n  /**\n   * An identifier for the error. Codes are invariant and are intended to be consumed programmatically.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly code?: string;\n  /**\n   * A message describing the error, intended to be suitable for display in a user interface.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly message?: string;\n}\n\n/** List all the actions. */\nexport interface ActionsList {\n  /**\n   * URL to fetch the next set of actions.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of actions. */\n  value: ActionResponse[];\n}\n\n/** Action property bag base. */\nexport interface ActionPropertiesBase {\n  /** Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. */\n  logicAppResourceId: string;\n}\n\n/** List all the alert rule templates. */\nexport interface AlertRuleTemplatesList {\n  /**\n   * URL to fetch the next set of alert rule templates.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of alert rule templates. */\n  value: AlertRuleTemplateUnion[];\n}\n\n/** Describes automation rule triggering logic. */\nexport interface AutomationRuleTriggeringLogic {\n  /** Determines whether the automation rule is enabled or disabled. */\n  isEnabled: boolean;\n  /** Determines when the automation rule should automatically expire and be disabled. */\n  expirationTimeUtc?: Date;\n  triggersOn: TriggersOn;\n  triggersWhen: TriggersWhen;\n  /** The conditions to evaluate to determine if the automation rule should be triggered on a given object. */\n  conditions?: AutomationRuleConditionUnion[];\n}\n\n/** Describes an automation rule condition. */\nexport interface AutomationRuleCondition {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  conditionType:\n    | \"Boolean\"\n    | \"PropertyArrayChanged\"\n    | \"PropertyArray\"\n    | \"PropertyChanged\"\n    | \"Property\";\n}\n\n/** Describes an automation rule action. */\nexport interface AutomationRuleAction {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  actionType: \"ModifyProperties\" | \"RunPlaybook\";\n  order: number;\n}\n\n/** Information on the client (user or application) that made some action */\nexport interface ClientInfo {\n  /** The email of the client. */\n  email?: string;\n  /** The name of the client. */\n  name?: string;\n  /** The object id of the client. */\n  objectId?: string;\n  /** The user principal name of the client. */\n  userPrincipalName?: string;\n}\n\nexport interface AutomationRulesList {\n  value?: AutomationRule[];\n  nextLink?: string;\n}\n\nexport interface ManualTriggerRequestBody {\n  tenantId?: string;\n  logicAppsResourceId: string;\n}\n\n/** List all the bookmarks. */\nexport interface BookmarkList {\n  /**\n   * URL to fetch the next set of bookmarks.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of bookmarks. */\n  value: Bookmark[];\n}\n\n/** User information that made some action */\nexport interface UserInfo {\n  /**\n   * The email of the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly email?: string;\n  /**\n   * The name of the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly name?: string;\n  /** The object id of the user. */\n  objectId?: string;\n}\n\n/** Describes related incident information for the bookmark */\nexport interface IncidentInfo {\n  /** Incident Id */\n  incidentId?: string;\n  /** The severity of the incident */\n  severity?: IncidentSeverity;\n  /** The title of the incident */\n  title?: string;\n  /** Relation Name */\n  relationName?: string;\n}\n\n/** Describes the entity mappings of a single entity */\nexport interface BookmarkEntityMappings {\n  /** The entity type */\n  entityType?: string;\n  /** Array of fields mapping for that entity type */\n  fieldMappings?: EntityFieldMapping[];\n}\n\n/** Map identifiers of a single entity */\nexport interface EntityFieldMapping {\n  /** Alert V3 identifier */\n  identifier?: string;\n  /** The value of the identifier */\n  value?: string;\n}\n\n/** List of relations. */\nexport interface RelationList {\n  /**\n   * URL to fetch the next set of relations.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of relations. */\n  value: Relation[];\n}\n\n/** The parameters required to execute an expand operation on the given bookmark. */\nexport interface BookmarkExpandParameters {\n  /** The end date filter, so the only expansion results returned are before this date. */\n  endTime?: Date;\n  /** The Id of the expansion to perform. */\n  expansionId?: string;\n  /** The start date filter, so the only expansion results returned are after this date. */\n  startTime?: Date;\n}\n\n/** The entity expansion result operation response. */\nexport interface BookmarkExpandResponse {\n  /** The metadata from the expansion operation results. */\n  metaData?: ExpansionResultsMetadata;\n  /** The expansion result values. */\n  value?: BookmarkExpandResponseValue;\n}\n\n/** Expansion result metadata. */\nexport interface ExpansionResultsMetadata {\n  /** Information of the aggregated nodes in the expansion result. */\n  aggregations?: ExpansionResultAggregation[];\n}\n\n/** Information of a specific aggregation in the expansion result. */\nexport interface ExpansionResultAggregation {\n  /** The common type of the aggregation. (for e.g. entity field name) */\n  aggregationType?: string;\n  /** Total number of aggregations of the given kind (and aggregationType if given) in the expansion result. */\n  count: number;\n  /** The display name of the aggregation by type. */\n  displayName?: string;\n  /** The kind of the aggregated entity. */\n  entityKind: EntityKind;\n}\n\n/** The expansion result values. */\nexport interface BookmarkExpandResponseValue {\n  /** Array of the expansion result entities. */\n  entities?: EntityUnion[];\n  /** Array of expansion result connected entities */\n  edges?: ConnectedEntity[];\n}\n\n/** Expansion result connected entities */\nexport interface ConnectedEntity {\n  /** Entity Id of the connected entity */\n  targetEntityId?: string;\n  /** key-value pairs for a connected entity mapping */\n  additionalData?: Record<string, unknown>;\n}\n\n/** Geodata information for a given IP address */\nexport interface EnrichmentIpGeodata {\n  /** The autonomous system number associated with this IP address */\n  asn?: string;\n  /** The name of the carrier for this IP address */\n  carrier?: string;\n  /** The city this IP address is located in */\n  city?: string;\n  /** A numeric rating of confidence that the value in the 'city' field is correct, on a scale of 0-100 */\n  cityCf?: number;\n  /** The continent this IP address is located on */\n  continent?: string;\n  /** The county this IP address is located in */\n  country?: string;\n  /** A numeric rating of confidence that the value in the 'country' field is correct on a scale of 0-100 */\n  countryCf?: number;\n  /** The dotted-decimal or colon-separated string representation of the IP address */\n  ipAddr?: string;\n  /** A description of the connection type of this IP address */\n  ipRoutingType?: string;\n  /** The latitude of this IP address */\n  latitude?: string;\n  /** The longitude of this IP address */\n  longitude?: string;\n  /** The name of the organization for this IP address */\n  organization?: string;\n  /** The type of the organization for this IP address */\n  organizationType?: string;\n  /** The geographic region this IP address is located in */\n  region?: string;\n  /** The state this IP address is located in */\n  state?: string;\n  /** A numeric rating of confidence that the value in the 'state' field is correct on a scale of 0-100 */\n  stateCf?: number;\n  /** The abbreviated name for the state this IP address is located in */\n  stateCode?: string;\n}\n\n/** Whois information for a given domain and associated metadata */\nexport interface EnrichmentDomainWhois {\n  /** The domain for this whois record */\n  domain?: string;\n  /** The hostname of this registrar's whois server */\n  server?: string;\n  /** The timestamp at which this record was created */\n  created?: Date;\n  /** The timestamp at which this record was last updated */\n  updated?: Date;\n  /** The timestamp at which this record will expire */\n  expires?: Date;\n  /** The whois record for a given domain */\n  parsedWhois?: EnrichmentDomainWhoisDetails;\n}\n\n/** The whois record for a given domain */\nexport interface EnrichmentDomainWhoisDetails {\n  /** The registrar associated with this domain */\n  registrar?: EnrichmentDomainWhoisRegistrarDetails;\n  /** The set of contacts associated with this domain */\n  contacts?: EnrichmentDomainWhoisContacts;\n  /** A list of name servers associated with this domain */\n  nameServers?: string[];\n  /** The set of status flags for this whois record */\n  statuses?: string[];\n}\n\n/** The registrar associated with this domain */\nexport interface EnrichmentDomainWhoisRegistrarDetails {\n  /** The name of this registrar */\n  name?: string;\n  /** This registrar's abuse contact email */\n  abuseContactEmail?: string;\n  /** This registrar's abuse contact phone number */\n  abuseContactPhone?: string;\n  /** This registrar's Internet Assigned Numbers Authority id */\n  ianaId?: string;\n  /** This registrar's URL */\n  url?: string;\n  /** The hostname of this registrar's whois server */\n  whoisServer?: string;\n}\n\n/** The set of contacts associated with this domain */\nexport interface EnrichmentDomainWhoisContacts {\n  /** The admin contact for this whois record */\n  admin?: EnrichmentDomainWhoisContact;\n  /** The billing contact for this whois record */\n  billing?: EnrichmentDomainWhoisContact;\n  /** The registrant contact for this whois record */\n  registrant?: EnrichmentDomainWhoisContact;\n  /** The technical contact for this whois record */\n  tech?: EnrichmentDomainWhoisContact;\n}\n\n/** An individual contact associated with this domain */\nexport interface EnrichmentDomainWhoisContact {\n  /** The name of this contact */\n  name?: string;\n  /** The organization for this contact */\n  org?: string;\n  /** A list describing the street address for this contact */\n  street?: string[];\n  /** The city for this contact */\n  city?: string;\n  /** The state for this contact */\n  state?: string;\n  /** The postal code for this contact */\n  postal?: string;\n  /** The country for this contact */\n  country?: string;\n  /** The phone number for this contact */\n  phone?: string;\n  /** The fax number for this contact */\n  fax?: string;\n  /** The email address for this contact */\n  email?: string;\n}\n\n/** List of all the entities. */\nexport interface EntityList {\n  /**\n   * URL to fetch the next set of entities.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of entities. */\n  value: EntityUnion[];\n}\n\n/** The parameters required to execute an expand operation on the given entity. */\nexport interface EntityExpandParameters {\n  /** The end date filter, so the only expansion results returned are before this date. */\n  endTime?: Date;\n  /** The Id of the expansion to perform. */\n  expansionId?: string;\n  /** The start date filter, so the only expansion results returned are after this date. */\n  startTime?: Date;\n}\n\n/** The entity expansion result operation response. */\nexport interface EntityExpandResponse {\n  /** The metadata from the expansion operation results. */\n  metaData?: ExpansionResultsMetadata;\n  /** The expansion result values. */\n  value?: EntityExpandResponseValue;\n}\n\n/** The expansion result values. */\nexport interface EntityExpandResponseValue {\n  /** Array of the expansion result entities. */\n  entities?: EntityUnion[];\n  /** Array of edges that connects the entity to the list of entities. */\n  edges?: EntityEdges[];\n}\n\n/** The edge that connects the entity to the other entity. */\nexport interface EntityEdges {\n  /** The target entity Id. */\n  targetEntityId?: string;\n  /** A bag of custom fields that should be part of the entity and will be presented to the user. */\n  additionalData?: { [propertyName: string]: Record<string, unknown> };\n}\n\n/** The parameters required to execute s timeline operation on the given entity. */\nexport interface EntityTimelineParameters {\n  /** Array of timeline Item kinds. */\n  kinds?: EntityTimelineKind[];\n  /** The start timeline date, so the results returned are after this date. */\n  startTime: Date;\n  /** The end timeline date, so the results returned are before this date. */\n  endTime: Date;\n  /** The number of bucket for timeline queries aggregation. */\n  numberOfBucket?: number;\n}\n\n/** The entity timeline result operation response. */\nexport interface EntityTimelineResponse {\n  /** The metadata from the timeline operation results. */\n  metaData?: TimelineResultsMetadata;\n  /** The timeline result values. */\n  value?: EntityTimelineItemUnion[];\n}\n\n/** Expansion result metadata. */\nexport interface TimelineResultsMetadata {\n  /** the total items found for the timeline request */\n  totalCount: number;\n  /** timeline aggregation per kind */\n  aggregations: TimelineAggregation[];\n  /** information about the failure queries */\n  errors?: TimelineError[];\n}\n\n/** timeline aggregation information per kind */\nexport interface TimelineAggregation {\n  /** the total items found for a kind */\n  count: number;\n  /** the query kind */\n  kind: EntityTimelineKind;\n}\n\n/** Timeline Query Errors. */\nexport interface TimelineError {\n  /** the query kind */\n  kind: EntityTimelineKind;\n  /** the query id */\n  queryId?: string;\n  /** the error message */\n  errorMessage: string;\n}\n\n/** Entity timeline Item. */\nexport interface EntityTimelineItem {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Activity\" | \"Bookmark\" | \"Anomaly\" | \"SecurityAlert\";\n}\n\n/** Retrieve queries for entity result operation response. */\nexport interface GetQueriesResponse {\n  /** The query result values. */\n  value?: EntityQueryItemUnion[];\n}\n\n/** An abstract Query item for entity */\nexport interface EntityQueryItem {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Insight\";\n  /**\n   * Query Template ARM ID\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly id?: string;\n  /** Query Template ARM Name */\n  name?: string;\n  /** ARM Type */\n  type?: string;\n}\n\n/** The parameters required to execute insights operation on the given entity. */\nexport interface EntityGetInsightsParameters {\n  /** The start timeline date, so the results returned are after this date. */\n  startTime: Date;\n  /** The end timeline date, so the results returned are before this date. */\n  endTime: Date;\n  /** Indicates if query time range should be extended with default time range of the query. Default value is false */\n  addDefaultExtendedTimeRange?: boolean;\n  /** List of Insights Query Id. If empty, default value is all insights of this entity */\n  insightQueryIds?: string[];\n}\n\n/** The Get Insights result operation response. */\nexport interface EntityGetInsightsResponse {\n  /** The metadata from the get insights operation results. */\n  metaData?: GetInsightsResultsMetadata;\n  /** The insights result values. */\n  value?: EntityInsightItem[];\n}\n\n/** Get Insights result metadata. */\nexport interface GetInsightsResultsMetadata {\n  /** the total items found for the insights request */\n  totalCount: number;\n  /** information about the failed queries */\n  errors?: GetInsightsErrorKind[];\n}\n\n/** GetInsights Query Errors. */\nexport interface GetInsightsErrorKind {\n  /** the query kind */\n  kind: GetInsightsError;\n  /** the query id */\n  queryId?: string;\n  /** the error message */\n  errorMessage: string;\n}\n\n/** Entity insight Item. */\nexport interface EntityInsightItem {\n  /** The query id of the insight */\n  queryId?: string;\n  /** The Time interval that the query actually executed on. */\n  queryTimeInterval?: EntityInsightItemQueryTimeInterval;\n  /** Query results for table insights query. */\n  tableQueryResults?: InsightsTableResult;\n  /** Query results for table insights query. */\n  chartQueryResults?: InsightsTableResult[];\n}\n\n/** The Time interval that the query actually executed on. */\nexport interface EntityInsightItemQueryTimeInterval {\n  /** Insight query start time */\n  startTime?: Date;\n  /** Insight query end time */\n  endTime?: Date;\n}\n\n/** Query results for table insights query. */\nexport interface InsightsTableResult {\n  /** Columns Metadata of the table */\n  columns?: InsightsTableResultColumnsItem[];\n  /** Rows data of the table */\n  rows?: string[][];\n}\n\nexport interface InsightsTableResultColumnsItem {\n  /** the type of the colum */\n  type?: string;\n  /** the name of the colum */\n  name?: string;\n}\n\n/** List of all the entity queries. */\nexport interface EntityQueryList {\n  /**\n   * URL to fetch the next set of entity queries.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of entity queries. */\n  value: EntityQueryUnion[];\n}\n\n/** List of all the entity query templates. */\nexport interface EntityQueryTemplateList {\n  /**\n   * URL to fetch the next set of entity query templates.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of entity query templates. */\n  value: EntityQueryTemplateUnion[];\n}\n\n/** List all the file imports. */\nexport interface FileImportList {\n  /**\n   * URL to fetch the next set of file imports.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of file imports. */\n  value: FileImport[];\n}\n\n/** Represents a file. */\nexport interface FileMetadata {\n  /** The format of the file */\n  fileFormat?: FileFormat;\n  /** The name of the file. */\n  fileName?: string;\n  /** The size of the file. */\n  fileSize?: number;\n  /**\n   * A URI with a valid SAS token to allow uploading / downloading the file.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileContentUri?: string;\n  /**\n   * Indicates whether the file was deleted from the storage account.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deleteStatus?: DeleteStatus;\n}\n\n/** Describes an error encountered in the file during validation. */\nexport interface ValidationError {\n  /** The number of the record that has the error. */\n  recordIndex?: number;\n  /**\n   * A list of descriptions of the error.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly errorMessages?: string[];\n}\n\n/** List all the incidents. */\nexport interface IncidentList {\n  /**\n   * URL to fetch the next set of incidents.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of incidents. */\n  value: Incident[];\n}\n\n/** Incident additional data property bag. */\nexport interface IncidentAdditionalData {\n  /**\n   * The number of alerts in the incident\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertsCount?: number;\n  /**\n   * The number of bookmarks in the incident\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly bookmarksCount?: number;\n  /**\n   * The number of comments in the incident\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly commentsCount?: number;\n  /**\n   * List of product names of alerts in the incident\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertProductNames?: string[];\n  /**\n   * The provider incident url to the incident in Microsoft 365 Defender portal\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly providerIncidentUrl?: string;\n  /**\n   * The tactics associated with incident\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly tactics?: AttackTactic[];\n  /**\n   * The techniques associated with incident's tactics'\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly techniques?: string[];\n}\n\n/** Represents an incident label */\nexport interface IncidentLabel {\n  /** The name of the label */\n  labelName: string;\n  /**\n   * The type of the label\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly labelType?: IncidentLabelType;\n}\n\n/** Information on the user an incident is assigned to */\nexport interface IncidentOwnerInfo {\n  /** The email of the user the incident is assigned to. */\n  email?: string;\n  /** The name of the user the incident is assigned to. */\n  assignedTo?: string;\n  /** The object id of the user the incident is assigned to. */\n  objectId?: string;\n  /** The user principal name of the user the incident is assigned to. */\n  userPrincipalName?: string;\n  /** The type of the owner the incident is assigned to. */\n  ownerType?: OwnerType;\n}\n\n/** Describes team information */\nexport interface TeamInformation {\n  /**\n   * Team ID\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly teamId?: string;\n  /**\n   * The primary channel URL of the team\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly primaryChannelUrl?: string;\n  /**\n   * The time the team was created\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly teamCreationTimeUtc?: Date;\n  /**\n   * The name of the team\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly name?: string;\n  /**\n   * The description of the team\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly description?: string;\n}\n\n/** Describes team properties */\nexport interface TeamProperties {\n  /** The name of the team */\n  teamName: string;\n  /** The description of the team */\n  teamDescription?: string;\n  /** List of member IDs to add to the team */\n  memberIds?: string[];\n  /** List of group IDs to add their members to the team */\n  groupIds?: string[];\n}\n\n/** List of incident alerts. */\nexport interface IncidentAlertList {\n  /** Array of incident alerts. */\n  value: SecurityAlert[];\n}\n\n/** confidence reason item */\nexport interface SecurityAlertPropertiesConfidenceReasonsItem {\n  /**\n   * The reason's description\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly reason?: string;\n  /**\n   * The type (category) of the reason\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly reasonType?: string;\n}\n\n/** Entity common property bag. */\nexport interface EntityCommonProperties {\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n}\n\n/** List of incident bookmarks. */\nexport interface IncidentBookmarkList {\n  /** Array of incident bookmarks. */\n  value: HuntingBookmark[];\n}\n\n/** List of incident comments. */\nexport interface IncidentCommentList {\n  /**\n   * URL to fetch the next set of comments.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of comments. */\n  value: IncidentComment[];\n}\n\n/** The incident related entities response. */\nexport interface IncidentEntitiesResponse {\n  /** Array of the incident related entities. */\n  entities?: EntityUnion[];\n  /** The metadata from the incident related entities results. */\n  metaData?: IncidentEntitiesResultsMetadata[];\n}\n\n/** Information of a specific aggregation in the incident related entities result. */\nexport interface IncidentEntitiesResultsMetadata {\n  /** Total number of aggregations of the given kind in the incident related entities result. */\n  count: number;\n  /** The kind of the aggregated entity. */\n  entityKind: EntityKind;\n}\n\n/** List of all the metadata. */\nexport interface MetadataList {\n  /** Array of metadata. */\n  value: MetadataModel[];\n  /**\n   * URL to fetch the next page of metadata.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n}\n\n/** The original source of the content item, where it comes from. */\nexport interface MetadataSource {\n  /** Source type of the content */\n  kind: SourceKind;\n  /** Name of the content source.  The repo name, solution name, LA workspace name etc. */\n  name?: string;\n  /** ID of the content source.  The solution ID, workspace ID, etc */\n  sourceId?: string;\n}\n\n/** Publisher or creator of the content item. */\nexport interface MetadataAuthor {\n  /** Name of the author. Company or person. */\n  name?: string;\n  /** Email of author contact */\n  email?: string;\n  /** Link for author/vendor page */\n  link?: string;\n}\n\n/** Support information for the content item. */\nexport interface MetadataSupport {\n  /** Type of support for content item */\n  tier: SupportTier;\n  /** Name of the support contact. Company or person. */\n  name?: string;\n  /** Email of support contact */\n  email?: string;\n  /** Link for support help, like to support page to open a ticket etc. */\n  link?: string;\n}\n\n/** Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies. */\nexport interface MetadataDependencies {\n  /** Id of the content item we depend on */\n  contentId?: string;\n  /** Type of the content item we depend on */\n  kind?: Kind;\n  /** Version of the the content item we depend on.  Can be blank, * or missing to indicate any version fulfills the dependency.  If version does not match our defined numeric format then an exact match is required. */\n  version?: string;\n  /** Name of the content item */\n  name?: string;\n  /** Operator used for list of dependencies in criteria array. */\n  operator?: Operator;\n  /** This is the list of dependencies we must fulfill, according to the AND/OR operator */\n  criteria?: MetadataDependencies[];\n}\n\n/** ies for the solution content item */\nexport interface MetadataCategories {\n  /** domain for the solution content item */\n  domains?: string[];\n  /** Industry verticals for the solution content item */\n  verticals?: string[];\n}\n\n/** List of all the office365 consents. */\nexport interface OfficeConsentList {\n  /**\n   * URL to fetch the next set of office consents.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of the consents. */\n  value: OfficeConsent[];\n}\n\n/** List of the Sentinel onboarding states */\nexport interface SentinelOnboardingStatesList {\n  /** Array of Sentinel onboarding states */\n  value: SentinelOnboardingState[];\n}\n\n/** List all the SecurityMLAnalyticsSettings */\nexport interface SecurityMLAnalyticsSettingsList {\n  /**\n   * URL to fetch the next set of SecurityMLAnalyticsSettings.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of SecurityMLAnalyticsSettings */\n  value: SecurityMLAnalyticsSettingUnion[];\n}\n\n/** List of all the settings. */\nexport interface SettingList {\n  /** Array of settings. */\n  value: SettingsUnion[];\n}\n\n/** List all the source controls. */\nexport interface RepoList {\n  /**\n   * URL to fetch the next set of repositories.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of repositories. */\n  value: Repo[];\n}\n\n/** Represents a repository. */\nexport interface Repo {\n  /** The url to access the repository. */\n  url?: string;\n  /** The name of the repository. */\n  fullName?: string;\n  /** Array of branches. */\n  branches?: string[];\n}\n\n/** List all the source controls. */\nexport interface SourceControlList {\n  /**\n   * URL to fetch the next set of source controls.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of source controls. */\n  value: SourceControl[];\n}\n\n/** metadata of a repository. */\nexport interface Repository {\n  /** Url of repository. */\n  url?: string;\n  /** Branch name of repository. */\n  branch?: string;\n  /** Display url of repository. */\n  displayUrl?: string;\n  /** Url to access repository action logs. */\n  deploymentLogsUrl?: string;\n  /** Dictionary of source control content type and path mapping. */\n  pathMapping?: ContentPathMap[];\n}\n\n/** The mapping of content type to a repo path. */\nexport interface ContentPathMap {\n  /** Content type. */\n  contentType?: ContentType;\n  /** The path to the content. */\n  path?: string;\n}\n\n/** Resources created in user's repository for the source-control. */\nexport interface RepositoryResourceInfo {\n  /** The webhook object created for the source-control. */\n  webhook?: Webhook;\n  /** Resources created in GitHub for this source-control. */\n  gitHubResourceInfo?: GitHubResourceInfo;\n  /** Resources created in Azure DevOps for this source-control. */\n  azureDevOpsResourceInfo?: AzureDevOpsResourceInfo;\n}\n\n/** Detail about the webhook object. */\nexport interface Webhook {\n  /** Unique identifier for the webhook. */\n  webhookId?: string;\n  /** URL that gets invoked by the webhook. */\n  webhookUrl?: string;\n  /** Time when the webhook secret was updated. */\n  webhookSecretUpdateTime?: string;\n  /** A flag to instruct the backend service to rotate webhook secret. */\n  rotateWebhookSecret?: boolean;\n}\n\n/** Resources created in GitHub repository. */\nexport interface GitHubResourceInfo {\n  /** GitHub application installation id. */\n  appInstallationId?: string;\n}\n\n/** Resources created in Azure DevOps repository. */\nexport interface AzureDevOpsResourceInfo {\n  /** Id of the pipeline created for the source-control. */\n  pipelineId?: string;\n  /** Id of the service-connection created for the source-control. */\n  serviceConnectionId?: string;\n}\n\n/** Information regarding a deployment. */\nexport interface DeploymentInfo {\n  /** Status while fetching the last deployment. */\n  deploymentFetchStatus?: DeploymentFetchStatus;\n  /** Deployment information. */\n  deployment?: Deployment;\n  /** Additional details about the deployment that can be shown to the user. */\n  message?: string;\n}\n\n/** Description about a deployment. */\nexport interface Deployment {\n  /** Deployment identifier. */\n  deploymentId?: string;\n  /** Current status of the deployment. */\n  deploymentState?: DeploymentState;\n  /** The outcome of the deployment. */\n  deploymentResult?: DeploymentResult;\n  /** The time when the deployment finished. */\n  deploymentTime?: Date;\n  /** Url to access repository action logs. */\n  deploymentLogsUrl?: string;\n}\n\n/** Describes threat kill chain phase entity */\nexport interface ThreatIntelligenceKillChainPhase {\n  /** Kill chainName name */\n  killChainName?: string;\n  /** Phase name */\n  phaseName?: string;\n}\n\n/** Describes parsed pattern entity */\nexport interface ThreatIntelligenceParsedPattern {\n  /** Pattern type key */\n  patternTypeKey?: string;\n  /** Pattern type keys */\n  patternTypeValues?: ThreatIntelligenceParsedPatternTypeValue[];\n}\n\n/** Describes threat kill chain phase entity */\nexport interface ThreatIntelligenceParsedPatternTypeValue {\n  /** Type of the value */\n  valueType?: string;\n  /** Value of parsed pattern */\n  value?: string;\n}\n\n/** Describes external reference */\nexport interface ThreatIntelligenceExternalReference {\n  /** External reference description */\n  description?: string;\n  /** External reference ID */\n  externalId?: string;\n  /** External reference source name */\n  sourceName?: string;\n  /** External reference URL */\n  url?: string;\n  /** External reference hashes */\n  hashes?: { [propertyName: string]: string };\n}\n\n/** Describes threat granular marking model entity */\nexport interface ThreatIntelligenceGranularMarkingModel {\n  /** Language granular marking model */\n  language?: string;\n  /** marking reference granular marking model */\n  markingRef?: number;\n  /** granular marking model selectors */\n  selectors?: string[];\n}\n\n/** List of all the threat intelligence information objects. */\nexport interface ThreatIntelligenceInformationList {\n  /**\n   * URL to fetch the next set of information objects.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of threat intelligence information objects. */\n  value: ThreatIntelligenceInformationUnion[];\n}\n\n/** Filtering criteria for querying threat intelligence indicators. */\nexport interface ThreatIntelligenceFilteringCriteria {\n  /** Page size */\n  pageSize?: number;\n  /** Minimum confidence. */\n  minConfidence?: number;\n  /** Maximum confidence. */\n  maxConfidence?: number;\n  /** Start time for ValidUntil filter. */\n  minValidUntil?: string;\n  /** End time for ValidUntil filter. */\n  maxValidUntil?: string;\n  /** Parameter to include/exclude disabled indicators. */\n  includeDisabled?: boolean;\n  /** Columns to sort by and sorting order */\n  sortBy?: ThreatIntelligenceSortingCriteria[];\n  /** Sources of threat intelligence indicators */\n  sources?: string[];\n  /** Pattern types */\n  patternTypes?: string[];\n  /** Threat types of threat intelligence indicators */\n  threatTypes?: string[];\n  /** Ids of threat intelligence indicators */\n  ids?: string[];\n  /** Keywords for searching threat intelligence indicators */\n  keywords?: string[];\n  /** Skip token. */\n  skipToken?: string;\n}\n\n/** List of available columns for sorting */\nexport interface ThreatIntelligenceSortingCriteria {\n  /** Column name */\n  itemKey?: string;\n  /** Sorting order (ascending/descending/unsorted). */\n  sortOrder?: ThreatIntelligenceSortingCriteriaEnum;\n}\n\n/** List of all the threat intelligence metric fields (type/threat type/source). */\nexport interface ThreatIntelligenceMetricsList {\n  /** Array of threat intelligence metric fields (type/threat type/source). */\n  value: ThreatIntelligenceMetrics[];\n}\n\n/** Threat intelligence metrics. */\nexport interface ThreatIntelligenceMetrics {\n  /** Threat intelligence metrics. */\n  properties?: ThreatIntelligenceMetric;\n}\n\n/** Describes threat intelligence metric */\nexport interface ThreatIntelligenceMetric {\n  /** Last updated indicator metric */\n  lastUpdatedTimeUtc?: string;\n  /** Threat type metrics */\n  threatTypeMetrics?: ThreatIntelligenceMetricEntity[];\n  /** Pattern type metrics */\n  patternTypeMetrics?: ThreatIntelligenceMetricEntity[];\n  /** Source metrics */\n  sourceMetrics?: ThreatIntelligenceMetricEntity[];\n}\n\n/** Describes threat intelligence metric entity */\nexport interface ThreatIntelligenceMetricEntity {\n  /** Metric name */\n  metricName?: string;\n  /** Metric value */\n  metricValue?: number;\n}\n\n/** Array of tags to be appended to the threat intelligence indicator. */\nexport interface ThreatIntelligenceAppendTags {\n  /** List of tags to be appended. */\n  threatIntelligenceTags?: string[];\n}\n\n/** List all the watchlists. */\nexport interface WatchlistList {\n  /**\n   * URL to fetch the next set of watchlists.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of watchlist. */\n  value: Watchlist[];\n}\n\n/** List all the watchlist items. */\nexport interface WatchlistItemList {\n  /**\n   * URL to fetch the next set of watchlist item.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of watchlist items. */\n  value: WatchlistItem[];\n}\n\n/** List all the data connectors. */\nexport interface DataConnectorList {\n  /**\n   * URL to fetch the next set of data connectors.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of data connectors. */\n  value: DataConnectorUnion[];\n}\n\n/** Represents Codeless API Polling data connector. */\nexport interface DataConnectorConnectBody {\n  /** The authentication kind used to poll the data */\n  kind?: ConnectAuthKind;\n  /** The API key of the audit server. */\n  apiKey?: string;\n  /** Used in v2 logs connector. Represents the data collection ingestion endpoint in log analytics. */\n  dataCollectionEndpoint?: string;\n  /** Used in v2 logs connector. The data collection rule immutable id, the rule defines the transformation and data destination. */\n  dataCollectionRuleImmutableId?: string;\n  /** Used in v2 logs connector. The stream we are sending the data to, this is the name of the streamDeclarations defined in the DCR. */\n  outputStream?: string;\n  /** The client secret of the OAuth 2.0 application. */\n  clientSecret?: string;\n  /** The client id of the OAuth 2.0 application. */\n  clientId?: string;\n  /** The authorization code used in OAuth 2.0 code flow to issue a token. */\n  authorizationCode?: string;\n  /** The user name in the audit log server. */\n  userName?: string;\n  /** The user password in the audit log server. */\n  password?: string;\n  requestConfigUserInputValues?: Record<string, unknown>[];\n}\n\n/** Data connector requirements properties. */\nexport interface DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind:\n    | \"AzureActiveDirectory\"\n    | \"AzureAdvancedThreatProtection\"\n    | \"AzureSecurityCenter\"\n    | \"AmazonWebServicesCloudTrail\"\n    | \"AmazonWebServicesS3\"\n    | \"Dynamics365\"\n    | \"MicrosoftCloudAppSecurity\"\n    | \"MicrosoftDefenderAdvancedThreatProtection\"\n    | \"MicrosoftThreatIntelligence\"\n    | \"MicrosoftThreatProtection\"\n    | \"OfficeATP\"\n    | \"OfficeIRM\"\n    | \"Office365Project\"\n    | \"OfficePowerBI\"\n    | \"ThreatIntelligence\"\n    | \"ThreatIntelligenceTaxii\"\n    | \"IOT\";\n}\n\n/** Data connector requirements status. */\nexport interface DataConnectorRequirementsState {\n  /** Authorization state for this connector */\n  authorizationState?: DataConnectorAuthorizationState;\n  /** License state for this connector */\n  licenseState?: DataConnectorLicenseState;\n}\n\n/** Lists the operations available in the SecurityInsights RP. */\nexport interface OperationsList {\n  /**\n   * URL to fetch the next set of operations.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nextLink?: string;\n  /** Array of operations */\n  value: Operation[];\n}\n\n/** Operation provided by provider */\nexport interface Operation {\n  /** Properties of the operation */\n  display?: OperationDisplay;\n  /** Name of the operation */\n  name?: string;\n  /** The origin of the operation */\n  origin?: string;\n  /** Indicates whether the operation is a data action */\n  isDataAction?: boolean;\n}\n\n/** Properties of the operation */\nexport interface OperationDisplay {\n  /** Description of the operation */\n  description?: string;\n  /** Operation name */\n  operation?: string;\n  /** Provider name */\n  provider?: string;\n  /** Resource name */\n  resource?: string;\n}\n\n/** alert rule template data sources */\nexport interface AlertRuleTemplateDataSource {\n  /** The connector id that provides the following data types */\n  connectorId?: string;\n  /** The data types used by the alert rule template */\n  dataTypes?: string[];\n}\n\n/** Base alert rule template property bag. */\nexport interface AlertRuleTemplatePropertiesBase {\n  /** the number of alert rules that were created by this template */\n  alertRulesCreatedByTemplateCount?: number;\n  /**\n   * The last time that this alert rule template has been updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastUpdatedDateUTC?: Date;\n  /**\n   * The time that this alert rule template has been added.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdDateUTC?: Date;\n  /** The description of the alert rule template. */\n  description?: string;\n  /** The display name for alert rule template. */\n  displayName?: string;\n  /** The required data sources for this template */\n  requiredDataConnectors?: AlertRuleTemplateDataSource[];\n  /** The alert rule template status. */\n  status?: TemplateStatus;\n}\n\n/** Query based alert rule template base property bag. */\nexport interface QueryBasedAlertRuleTemplateProperties {\n  /** The query that creates alerts for this rule. */\n  query?: string;\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n  /** The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>. */\n  version?: string;\n  /** Dictionary of string key-value pairs of columns to be attached to the alert */\n  customDetails?: { [propertyName: string]: string };\n  /** Array of the entity mappings of the alert rule */\n  entityMappings?: EntityMapping[];\n  /** The alert details override settings */\n  alertDetailsOverride?: AlertDetailsOverride;\n  /** The event grouping settings. */\n  eventGroupingSettings?: EventGroupingSettings;\n}\n\n/** Single entity mapping for the alert rule */\nexport interface EntityMapping {\n  /** The V3 type of the mapped entity */\n  entityType?: EntityMappingType;\n  /** array of field mappings for the given entity mapping */\n  fieldMappings?: FieldMapping[];\n}\n\n/** A single field mapping of the mapped entity */\nexport interface FieldMapping {\n  /** the V3 identifier of the entity */\n  identifier?: string;\n  /** the column name to be mapped to the identifier */\n  columnName?: string;\n}\n\n/** Settings for how to dynamically override alert static details */\nexport interface AlertDetailsOverride {\n  /** the format containing columns name(s) to override the alert name */\n  alertDisplayNameFormat?: string;\n  /** the format containing columns name(s) to override the alert description */\n  alertDescriptionFormat?: string;\n  /** the column name to take the alert tactics from */\n  alertTacticsColumnName?: string;\n  /** the column name to take the alert severity from */\n  alertSeverityColumnName?: string;\n}\n\n/** Event grouping settings property bag. */\nexport interface EventGroupingSettings {\n  /** The event grouping aggregation kinds */\n  aggregationKind?: EventGroupingAggregationKind;\n}\n\n/** Represents a supported source signal configuration in Fusion detection. */\nexport interface FusionSourceSettings {\n  /** Determines whether this source signal is enabled or disabled in Fusion detection. */\n  enabled: boolean;\n  /** Name of the Fusion source signal. Refer to Fusion alert rule template for supported values. */\n  sourceName: string;\n  /** Configuration for all source subtypes under this source signal consumed in fusion detection. */\n  sourceSubTypes?: FusionSourceSubTypeSetting[];\n}\n\n/** Represents a supported source subtype configuration under a source signal in Fusion detection. */\nexport interface FusionSourceSubTypeSetting {\n  /** Determines whether this source subtype under source signal is enabled or disabled in Fusion detection. */\n  enabled: boolean;\n  /** The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion alert rule template for supported values. */\n  sourceSubTypeName: string;\n  /**\n   * The display name of source subtype under a source signal consumed in Fusion detection.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sourceSubTypeDisplayName?: string;\n  /** Severity configuration for a source subtype consumed in fusion detection. */\n  severityFilters: FusionSubTypeSeverityFilter;\n}\n\n/** Represents severity configuration for a source subtype consumed in Fusion detection. */\nexport interface FusionSubTypeSeverityFilter {\n  /**\n   * Determines whether this source subtype supports severity configuration or not.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isSupported?: boolean;\n  /** Individual Severity configuration settings for a given source subtype consumed in Fusion detection. */\n  filters?: FusionSubTypeSeverityFiltersItem[];\n}\n\n/** Represents a Severity filter setting for a given source subtype consumed in Fusion detection. */\nexport interface FusionSubTypeSeverityFiltersItem {\n  /** The Severity for a given source subtype consumed in Fusion detection. */\n  severity: AlertSeverity;\n  /** Determines whether this severity is enabled or disabled for this source subtype consumed in Fusion detection. */\n  enabled: boolean;\n}\n\n/** Represents a Fusion scenario exclusion patterns in Fusion detection. */\nexport interface FusionScenarioExclusionPattern {\n  /** Scenario exclusion pattern. */\n  exclusionPattern: string;\n  /** DateTime when scenario exclusion pattern is added in UTC. */\n  dateAddedInUTC: string;\n}\n\n/** Represents a source signal consumed in Fusion detection. */\nexport interface FusionTemplateSourceSetting {\n  /** The name of a source signal consumed in Fusion detection. */\n  sourceName: string;\n  /** All supported source subtypes under this source signal consumed in fusion detection. */\n  sourceSubTypes?: FusionTemplateSourceSubType[];\n}\n\n/** Represents a source subtype under a source signal consumed in Fusion detection. */\nexport interface FusionTemplateSourceSubType {\n  /** The name of source subtype under a source signal consumed in Fusion detection. */\n  sourceSubTypeName: string;\n  /**\n   * The display name of source subtype under a source signal consumed in Fusion detection.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sourceSubTypeDisplayName?: string;\n  /** Severity configuration available for a source subtype consumed in fusion detection. */\n  severityFilter: FusionTemplateSubTypeSeverityFilter;\n}\n\n/** Represents severity configurations available for a source subtype consumed in Fusion detection. */\nexport interface FusionTemplateSubTypeSeverityFilter {\n  /** Determines whether severity configuration is supported for this source subtype consumed in Fusion detection. */\n  isSupported: boolean;\n  /** List of all supported severities for this source subtype consumed in Fusion detection. */\n  severityFilters?: AlertSeverity[];\n}\n\n/** MicrosoftSecurityIncidentCreation rule common property bag. */\nexport interface MicrosoftSecurityIncidentCreationAlertRuleCommonProperties {\n  /** the alerts' displayNames on which the cases will be generated */\n  displayNamesFilter?: string[];\n  /** the alerts' displayNames on which the cases will not be generated */\n  displayNamesExcludeFilter?: string[];\n  /** The alerts' productName on which the cases will be generated */\n  productFilter: MicrosoftSecurityProductName;\n  /** the alerts' severities on which the cases will be generated */\n  severitiesFilter?: AlertSeverity[];\n}\n\n/** Incident Configuration property bag. */\nexport interface IncidentConfiguration {\n  /** Create incidents from alerts triggered by this analytics rule */\n  createIncident: boolean;\n  /** Set how the alerts that are triggered by this analytics rule, are grouped into incidents */\n  groupingConfiguration?: GroupingConfiguration;\n}\n\n/** Grouping configuration property bag. */\nexport interface GroupingConfiguration {\n  /** Grouping enabled */\n  enabled: boolean;\n  /** Re-open closed matching incidents */\n  reopenClosedIncident: boolean;\n  /** Limit the group to alerts created within the lookback duration (in ISO 8601 duration format) */\n  lookbackDuration: string;\n  /** Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty. */\n  matchingMethod: MatchingMethod;\n  /** A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used. */\n  groupByEntities?: EntityMappingType[];\n  /** A list of alert details to group by (when matchingMethod is Selected) */\n  groupByAlertDetails?: AlertDetail[];\n  /** A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used. */\n  groupByCustomDetails?: string[];\n}\n\n/** Scheduled alert rule template property bag. */\nexport interface ScheduledAlertRuleCommonProperties {\n  /** The query that creates alerts for this rule. */\n  query?: string;\n  /** The frequency (in ISO 8601 duration format) for this alert rule to run. */\n  queryFrequency?: string;\n  /** The period (in ISO 8601 duration format) that this alert rule looks at. */\n  queryPeriod?: string;\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n  /** The operation against the threshold that triggers alert rule. */\n  triggerOperator?: TriggerOperator;\n  /** The threshold triggers this alert rule. */\n  triggerThreshold?: number;\n  /** The event grouping settings. */\n  eventGroupingSettings?: EventGroupingSettings;\n  /** Dictionary of string key-value pairs of columns to be attached to the alert */\n  customDetails?: { [propertyName: string]: string };\n  /** Array of the entity mappings of the alert rule */\n  entityMappings?: EntityMapping[];\n  /** The alert details override settings */\n  alertDetailsOverride?: AlertDetailsOverride;\n}\n\nexport interface AutomationRuleBooleanCondition {\n  operator?: AutomationRuleBooleanConditionSupportedOperator;\n  innerConditions?: AutomationRuleConditionUnion[];\n}\n\nexport interface IncidentPropertiesAction {\n  /** The severity of the incident */\n  severity?: IncidentSeverity;\n  /** The status of the incident */\n  status?: IncidentStatus;\n  /** The reason the incident was closed */\n  classification?: IncidentClassification;\n  /** The classification reason the incident was closed with */\n  classificationReason?: IncidentClassificationReason;\n  /** Describes the reason the incident was closed. */\n  classificationComment?: string;\n  /** Information on the user an incident is assigned to */\n  owner?: IncidentOwnerInfo;\n  /** List of labels to add to the incident. */\n  labels?: IncidentLabel[];\n}\n\nexport interface AutomationRulePropertyArrayChangedValuesCondition {\n  arrayType?: AutomationRulePropertyArrayChangedConditionSupportedArrayType;\n  changeType?: AutomationRulePropertyArrayChangedConditionSupportedChangeType;\n}\n\nexport interface AutomationRulePropertyArrayValuesCondition {\n  arrayType?: AutomationRulePropertyArrayConditionSupportedArrayType;\n  arrayConditionType?: AutomationRulePropertyArrayConditionSupportedArrayConditionType;\n  itemConditions?: AutomationRuleConditionUnion[];\n}\n\nexport interface AutomationRulePropertyValuesChangedCondition {\n  propertyName?: AutomationRulePropertyChangedConditionSupportedPropertyType;\n  changeType?: AutomationRulePropertyChangedConditionSupportedChangedType;\n  operator?: AutomationRulePropertyConditionSupportedOperator;\n  propertyValues?: string[];\n}\n\nexport interface AutomationRulePropertyValuesCondition {\n  /** The property to evaluate in an automation rule property condition. */\n  propertyName?: AutomationRulePropertyConditionSupportedProperty;\n  operator?: AutomationRulePropertyConditionSupportedOperator;\n  propertyValues?: string[];\n}\n\nexport interface PlaybookActionProperties {\n  /** The resource id of the playbook resource. */\n  logicAppResourceId?: string;\n  /** The tenant id of the playbook resource. */\n  tenantId?: string;\n}\n\n/** An properties abstract Query item for entity */\nexport interface EntityQueryItemProperties {\n  /** Data types for template */\n  dataTypes?: EntityQueryItemPropertiesDataTypesItem[];\n  /** The type of the entity */\n  inputEntityType?: EntityType;\n  /** Data types for template */\n  requiredInputFieldsSets?: string[][];\n  /** The query applied only to entities matching to all filters */\n  entitiesFilter?: Record<string, unknown>;\n}\n\nexport interface EntityQueryItemPropertiesDataTypesItem {\n  /** Data type name */\n  dataType?: string;\n}\n\n/** The insight table query. */\nexport interface InsightQueryItemPropertiesTableQuery {\n  /** List of insight column definitions. */\n  columnsDefinitions?: InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem[];\n  /** List of insight queries definitions. */\n  queriesDefinitions?: InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem[];\n}\n\nexport interface InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem {\n  /** Insight column header. */\n  header?: string;\n  /** Insights Column type. */\n  outputType?: OutputType;\n  /** Is query supports deep-link. */\n  supportDeepLink?: boolean;\n}\n\nexport interface InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem {\n  /** Insight column header. */\n  filter?: string;\n  /** Insight column header. */\n  summarize?: string;\n  /** Insight column header. */\n  project?: string;\n  /** Insight column header. */\n  linkColumnsDefinitions?: InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem[];\n}\n\nexport interface InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem {\n  /** Insight Link Definition Projected Name. */\n  projectedName?: string;\n  /** Insight Link Definition Query. */\n  query?: string;\n}\n\n/** The activity query definitions. */\nexport interface InsightQueryItemPropertiesAdditionalQuery {\n  /** The insight query. */\n  query?: string;\n  /** The insight text. */\n  text?: string;\n}\n\n/** The insight chart query. */\nexport interface InsightQueryItemPropertiesDefaultTimeRange {\n  /** The padding for the start time of the query. */\n  beforeRange?: string;\n  /** The padding for the end time of the query. */\n  afterRange?: string;\n}\n\n/** The insight chart query. */\nexport interface InsightQueryItemPropertiesReferenceTimeRange {\n  /** Additional query time for looking back. */\n  beforeRange?: string;\n}\n\n/** The Activity query definitions */\nexport interface ActivityEntityQueriesPropertiesQueryDefinitions {\n  /** The Activity query to run on a given entity */\n  query?: string;\n}\n\n/** The Activity query definitions */\nexport interface ActivityEntityQueryTemplatePropertiesQueryDefinitions {\n  /** The Activity query to run on a given entity */\n  query?: string;\n  /** The dimensions we want to summarize the timeline results on, this is comma separated list */\n  summarizeBy?: string;\n}\n\n/** The data type definition */\nexport interface DataTypeDefinitions {\n  /** The data type name */\n  dataType?: string;\n}\n\n/** security ml analytics settings data sources */\nexport interface SecurityMLAnalyticsSettingsDataSource {\n  /** The connector id that provides the following data types */\n  connectorId?: string;\n  /** The data types used by the security ml analytics settings */\n  dataTypes?: string[];\n}\n\n/** Properties data connector on tenant level. */\nexport interface DataConnectorTenantId {\n  /** The tenant id to connect to, and get the data from. */\n  tenantId: string;\n}\n\n/** Data connector properties. */\nexport interface DataConnectorWithAlertsProperties {\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n}\n\n/** Alerts data type for data connectors. */\nexport interface AlertsDataTypeOfDataConnector {\n  /** Alerts data type connection. */\n  alerts: DataConnectorDataTypeCommon;\n}\n\n/** Common field for data type in data connectors. */\nexport interface DataConnectorDataTypeCommon {\n  /** Describe whether this data type connection is enabled or not. */\n  state: DataTypeState;\n}\n\n/** The available data types for Microsoft Threat Intelligence Platforms data connector. */\nexport interface MstiDataConnectorDataTypes {\n  /** Data type for Microsoft Threat Intelligence Platforms data connector. */\n  bingSafetyPhishingURL: MstiDataConnectorDataTypesBingSafetyPhishingURL;\n  /** Data type for Microsoft Threat Intelligence Platforms data connector. */\n  microsoftEmergingThreatFeed: MstiDataConnectorDataTypesMicrosoftEmergingThreatFeed;\n}\n\n/** The available data types for Microsoft Threat Protection Platforms data connector. */\nexport interface MTPDataConnectorDataTypes {\n  /** Data type for Microsoft Threat Protection Platforms data connector. */\n  incidents: MTPDataConnectorDataTypesIncidents;\n}\n\n/** The available data types for Amazon Web Services CloudTrail data connector. */\nexport interface AwsCloudTrailDataConnectorDataTypes {\n  /** Logs data type. */\n  logs: AwsCloudTrailDataConnectorDataTypesLogs;\n}\n\n/** The available data types for Amazon Web Services S3 data connector. */\nexport interface AwsS3DataConnectorDataTypes {\n  /** Logs data type. */\n  logs: AwsS3DataConnectorDataTypesLogs;\n}\n\n/** The available data types for Dynamics365 data connector. */\nexport interface Dynamics365DataConnectorDataTypes {\n  /** Common Data Service data type connection. */\n  dynamics365CdsActivities: Dynamics365DataConnectorDataTypesDynamics365CdsActivities;\n}\n\n/** The available data types for Office Microsoft Project data connector. */\nexport interface Office365ProjectConnectorDataTypes {\n  /** Logs data type. */\n  logs: Office365ProjectConnectorDataTypesLogs;\n}\n\n/** The available data types for Office Microsoft PowerBI data connector. */\nexport interface OfficePowerBIConnectorDataTypes {\n  /** Logs data type. */\n  logs: OfficePowerBIConnectorDataTypesLogs;\n}\n\n/** The available data types for office data connector. */\nexport interface OfficeDataConnectorDataTypes {\n  /** Exchange data type connection. */\n  exchange: OfficeDataConnectorDataTypesExchange;\n  /** SharePoint data type connection. */\n  sharePoint: OfficeDataConnectorDataTypesSharePoint;\n  /** Teams data type connection. */\n  teams: OfficeDataConnectorDataTypesTeams;\n}\n\n/** The available data types for TI (Threat Intelligence) data connector. */\nexport interface TIDataConnectorDataTypes {\n  /** Data type for indicators connection. */\n  indicators: TIDataConnectorDataTypesIndicators;\n}\n\n/** The available data types for Threat Intelligence TAXII data connector. */\nexport interface TiTaxiiDataConnectorDataTypes {\n  /** Data type for TAXII connector. */\n  taxiiClient: TiTaxiiDataConnectorDataTypesTaxiiClient;\n}\n\n/** Config to describe the instructions blade */\nexport interface CodelessUiConnectorConfigProperties {\n  /** Connector blade title */\n  title: string;\n  /** Connector publisher name */\n  publisher: string;\n  /** Connector description */\n  descriptionMarkdown: string;\n  /** An optional custom image to be used when displaying the connector within Azure Sentinel's connector's gallery */\n  customImage?: string;\n  /** Name of the table the connector will insert the data to */\n  graphQueriesTableName: string;\n  /** The graph query to show the current data status */\n  graphQueries: CodelessUiConnectorConfigPropertiesGraphQueriesItem[];\n  /** The sample queries for the connector */\n  sampleQueries: CodelessUiConnectorConfigPropertiesSampleQueriesItem[];\n  /** Data types to check for last data received */\n  dataTypes: CodelessUiConnectorConfigPropertiesDataTypesItem[];\n  /** Define the way the connector check connectivity */\n  connectivityCriteria: CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem[];\n  /** Connector Availability Status */\n  availability: Availability;\n  /** Permissions required for the connector */\n  permissions: Permissions;\n  /** Instruction steps to enable the connector */\n  instructionSteps: CodelessUiConnectorConfigPropertiesInstructionStepsItem[];\n}\n\n/** The graph query to show the current data status */\nexport interface GraphQueries {\n  /** the metric that the query is checking */\n  metricName?: string;\n  /** The legend for the graph */\n  legend?: string;\n  /** The base query for the graph */\n  baseQuery?: string;\n}\n\n/** The sample queries for the connector */\nexport interface SampleQueries {\n  /** The sample query description */\n  description?: string;\n  /** the sample query */\n  query?: string;\n}\n\n/** Data type for last data received */\nexport interface LastDataReceivedDataType {\n  /** Name of the data type to show in the graph. can be use with {{graphQueriesTableName}} placeholder */\n  name?: string;\n  /** Query for indicate last data received */\n  lastDataReceivedQuery?: string;\n}\n\n/** Setting for the connector check connectivity */\nexport interface ConnectivityCriteria {\n  /** type of connectivity */\n  type?: ConnectivityType;\n  /** Queries for checking connectivity */\n  value?: string[];\n}\n\n/** Connector Availability Status */\nexport interface Availability {\n  /** The connector Availability Status */\n  status?: 1;\n  /** Set connector as preview */\n  isPreview?: boolean;\n}\n\n/** Permissions required for the connector */\nexport interface Permissions {\n  /** Resource provider permissions required for the connector */\n  resourceProvider?: PermissionsResourceProviderItem[];\n  /** Customs permissions required for the connector */\n  customs?: PermissionsCustomsItem[];\n}\n\n/** Resource provider permissions required for the connector */\nexport interface ResourceProvider {\n  /** Provider name */\n  provider?: ProviderName;\n  /** Permission description text */\n  permissionsDisplayText?: string;\n  /** Permission provider display name */\n  providerDisplayName?: string;\n  /** Permission provider scope */\n  scope?: PermissionProviderScope;\n  /** Required permissions for the connector */\n  requiredPermissions?: RequiredPermissions;\n}\n\n/** Required permissions for the connector */\nexport interface RequiredPermissions {\n  /** action permission */\n  action?: boolean;\n  /** write permission */\n  write?: boolean;\n  /** read permission */\n  read?: boolean;\n  /** delete permission */\n  delete?: boolean;\n}\n\n/** Customs permissions required for the connector */\nexport interface CustomsPermission {\n  /** Customs permissions name */\n  name?: string;\n  /** Customs permissions description */\n  description?: string;\n}\n\n/** Instruction steps to enable the connector */\nexport interface InstructionSteps {\n  /** Instruction step title */\n  title?: string;\n  /** Instruction step description */\n  description?: string;\n  /** Instruction step details */\n  instructions?: InstructionStepsInstructionsItem[];\n}\n\n/** Instruction step details */\nexport interface ConnectorInstructionModelBase {\n  /** The parameters for the setting */\n  parameters?: Record<string, unknown>;\n  /** The kind of the setting */\n  type: SettingType;\n}\n\n/** Config to describe the polling config for API poller connector */\nexport interface CodelessConnectorPollingConfigProperties {\n  /** The poller active status */\n  isActive?: boolean;\n  /** Describe the authentication type of the poller */\n  auth: CodelessConnectorPollingAuthProperties;\n  /** Describe the poll request config parameters of the poller */\n  request: CodelessConnectorPollingRequestProperties;\n  /** Describe the poll request paging config of the poller */\n  paging?: CodelessConnectorPollingPagingProperties;\n  /** Describe the response config parameters of the poller */\n  response?: CodelessConnectorPollingResponseProperties;\n}\n\n/** Describe the authentication properties needed to successfully authenticate with the server */\nexport interface CodelessConnectorPollingAuthProperties {\n  /** The authentication type */\n  authType: string;\n  /** The header name which the token is sent with */\n  apiKeyName?: string;\n  /** A prefix send in the header before the actual token */\n  apiKeyIdentifier?: string;\n  /** Marks if the key should sent in header */\n  isApiKeyInPostPayload?: string;\n  /** Describes the flow name, for example 'AuthCode' for Oauth 2.0 */\n  flowName?: string;\n  /** The endpoint used to issue a token, used in Oauth 2.0 flow */\n  tokenEndpoint?: string;\n  /** The endpoint used to authorize the user, used in Oauth 2.0 flow */\n  authorizationEndpoint?: string;\n  /** The query parameters used in authorization request, used in Oauth 2.0 flow */\n  authorizationEndpointQueryParameters?: Record<string, unknown>;\n  /** The redirect endpoint where we will get the authorization code, used in Oauth 2.0 flow */\n  redirectionEndpoint?: string;\n  /** The query headers used in token request, used in Oauth 2.0 flow */\n  tokenEndpointHeaders?: Record<string, unknown>;\n  /** The query parameters used in token request, used in Oauth 2.0 flow */\n  tokenEndpointQueryParameters?: Record<string, unknown>;\n  /** Marks if we should send the client secret in header or payload, used in Oauth 2.0 flow */\n  isClientSecretInHeader?: boolean;\n  /** The OAuth token scope */\n  scope?: string;\n}\n\n/** Describe the request properties needed to successfully pull from the server */\nexport interface CodelessConnectorPollingRequestProperties {\n  /** Describe the endpoint we should pull the data from */\n  apiEndpoint: string;\n  /** Defines the rate limit QPS */\n  rateLimitQps?: number;\n  /** The window interval we will use the pull the data */\n  queryWindowInMin: number;\n  /** The http method type we will use in the poll request, GET or POST */\n  httpMethod: string;\n  /** The time format will be used the query events in a specific window */\n  queryTimeFormat: string;\n  /** Describe the amount of time we should try and poll the data in case of failure */\n  retryCount?: number;\n  /** The number of seconds we will consider as a request timeout */\n  timeoutInSeconds?: number;\n  /** Describe the headers sent in the poll request */\n  headers?: Record<string, unknown>;\n  /** Describe the query parameters sent in the poll request */\n  queryParameters?: Record<string, unknown>;\n  /** For advanced scenarios for example user name/password embedded in nested JSON payload */\n  queryParametersTemplate?: string;\n  /** This will be used the query events from a start of the time window */\n  startTimeAttributeName?: string;\n  /** This will be used the query events from the end of the time window */\n  endTimeAttributeName?: string;\n}\n\n/** Describe the properties needed to make a pagination call */\nexport interface CodelessConnectorPollingPagingProperties {\n  /** Describes the type. could be 'None', 'PageToken', 'PageCount', 'TimeStamp' */\n  pagingType: string;\n  /** Defines the name of a next page attribute */\n  nextPageParaName?: string;\n  /** Defines the path to a next page token JSON */\n  nextPageTokenJsonPath?: string;\n  /** Defines the path to a page count attribute */\n  pageCountAttributePath?: string;\n  /** Defines the path to a page total count attribute */\n  pageTotalCountAttributePath?: string;\n  /** Defines the path to a paging time stamp attribute */\n  pageTimeStampAttributePath?: string;\n  /** Determines whether to search for the latest time stamp in the events list */\n  searchTheLatestTimeStampFromEventsList?: string;\n  /** Defines the name of the page size parameter */\n  pageSizeParaName?: string;\n  /** Defines the paging size */\n  pageSize?: number;\n}\n\n/** Describes the response from the external server */\nexport interface CodelessConnectorPollingResponseProperties {\n  /** Describes the path we should extract the data in the response */\n  eventsJsonPaths: string[];\n  /** Describes the path we should extract the status code in the response */\n  successStatusJsonPath?: string;\n  /** Describes the path we should extract the status value in the response */\n  successStatusValue?: string;\n  /** Describes if the data in the response is Gzip */\n  isGzipCompressed?: boolean;\n}\n\n/** ThreatIntelligence property bag. */\nexport interface ThreatIntelligence {\n  /**\n   * Confidence (must be between 0 and 1)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidence?: number;\n  /**\n   * Name of the provider from whom this Threat Intelligence information was received\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly providerName?: string;\n  /**\n   * Report link\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly reportLink?: string;\n  /**\n   * Threat description (free text)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatDescription?: string;\n  /**\n   * Threat name (e.g. \"Jedobot malware\")\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatName?: string;\n  /**\n   * Threat type (e.g. \"Botnet\")\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatType?: string;\n}\n\n/** The geo-location context attached to the ip entity */\nexport interface GeoLocation {\n  /**\n   * Autonomous System Number\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly asn?: number;\n  /**\n   * City name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly city?: string;\n  /**\n   * The country code according to ISO 3166 format\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countryCode?: string;\n  /**\n   * Country name according to ISO 3166 Alpha 2: the lowercase of the English Short Name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countryName?: string;\n  /**\n   * The longitude of the identified location, expressed as a floating point number with range of -180 to 180, with positive numbers representing East and negative numbers representing West. Latitude and longitude are derived from the city or postal code.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly latitude?: number;\n  /**\n   * The latitude of the identified location, expressed as a floating point number with range of - 90 to 90, with positive numbers representing North and negative numbers representing South. Latitude and longitude are derived from the city or postal code.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly longitude?: number;\n  /**\n   * State name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly state?: string;\n}\n\n/** An azure resource object with an Etag property */\nexport interface ResourceWithEtag extends Resource {\n  /** Etag of the azure resource */\n  etag?: string;\n}\n\n/** Alert rule template. */\nexport interface AlertRuleTemplate extends Resource {\n  /** The kind of the alert rule */\n  kind: AlertRuleKind;\n}\n\n/** Specific entity. */\nexport interface Entity extends Resource {\n  /** The kind of the entity. */\n  kind: EntityKind;\n}\n\n/** Specific entity query template. */\nexport interface EntityQueryTemplate extends Resource {\n  /** the entity query template kind */\n  kind: EntityQueryTemplateKind;\n}\n\n/** Represents a file import in Azure Security Insights. */\nexport interface FileImport extends Resource {\n  /** Describes how to ingest the records in the file. */\n  ingestionMode?: IngestionMode;\n  /** The content type of this file. */\n  contentType?: FileImportContentType;\n  /**\n   * The time the file was imported.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdTimeUTC?: Date;\n  /**\n   * Represents the error file (if the import was ingested with errors or failed the validation).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly errorFile?: FileMetadata;\n  /**\n   * An ordered list of some of the errors that were encountered during validation.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly errorsPreview?: ValidationError[];\n  /** Represents the imported file. */\n  importFile?: FileMetadata;\n  /**\n   * The number of records that have been successfully ingested.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ingestedRecordCount?: number;\n  /** The source for the data in the file. */\n  source?: string;\n  /**\n   * The state of the file import.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly state?: FileImportState;\n  /**\n   * The number of records in the file.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly totalRecordCount?: number;\n  /**\n   * The number of records that have passed validation.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly validRecordCount?: number;\n  /**\n   * The time the files associated with this import are deleted from the storage account.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly filesValidUntilTimeUTC?: Date;\n  /**\n   * The time the file import record is soft deleted from the database and history.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly importValidUntilTimeUTC?: Date;\n}\n\n/** Consent for Office365 tenant that already made. */\nexport interface OfficeConsent extends Resource {\n  /** The tenantId of the Office365 with the consent. */\n  tenantId?: string;\n  /** Help to easily cascade among the data layers. */\n  consentId?: string;\n}\n\n/** Action property bag. */\nexport interface ActionResponseProperties extends ActionPropertiesBase {\n  /** The name of the logic app's workflow. */\n  workflowId?: string;\n}\n\n/** Action property bag. */\nexport interface ActionRequestProperties extends ActionPropertiesBase {\n  /** Logic App Callback URL for this specific workflow. */\n  triggerUri: string;\n}\n\n/** Describes an automation rule condition that applies a boolean operator (e.g AND, OR) to conditions */\nexport interface BooleanConditionProperties extends AutomationRuleCondition {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  conditionType: \"Boolean\";\n  conditionProperties?: AutomationRuleBooleanCondition;\n}\n\n/** Describes an automation rule condition that evaluates an array property's value change */\nexport interface PropertyArrayChangedConditionProperties\n  extends AutomationRuleCondition {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  conditionType: \"PropertyArrayChanged\";\n  conditionProperties?: AutomationRulePropertyArrayChangedValuesCondition;\n}\n\n/** Describes an automation rule condition that evaluates an array property's value */\nexport interface PropertyArrayConditionProperties\n  extends AutomationRuleCondition {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  conditionType: \"PropertyArray\";\n  conditionProperties?: AutomationRulePropertyArrayValuesCondition;\n}\n\n/** Describes an automation rule condition that evaluates a property's value change */\nexport interface PropertyChangedConditionProperties\n  extends AutomationRuleCondition {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  conditionType: \"PropertyChanged\";\n  conditionProperties?: AutomationRulePropertyValuesChangedCondition;\n}\n\n/** Describes an automation rule condition that evaluates a property's value */\nexport interface PropertyConditionProperties extends AutomationRuleCondition {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  conditionType: \"Property\";\n  conditionProperties?: AutomationRulePropertyValuesCondition;\n}\n\n/** Describes an automation rule action to modify an object's properties */\nexport interface AutomationRuleModifyPropertiesAction\n  extends AutomationRuleAction {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  actionType: \"ModifyProperties\";\n  actionConfiguration?: IncidentPropertiesAction;\n}\n\n/** Describes an automation rule action to run a playbook */\nexport interface AutomationRuleRunPlaybookAction extends AutomationRuleAction {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  actionType: \"RunPlaybook\";\n  actionConfiguration?: PlaybookActionProperties;\n}\n\n/** Represents Activity timeline item. */\nexport interface ActivityTimelineItem extends EntityTimelineItem {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Activity\";\n  /** The activity query id. */\n  queryId: string;\n  /** The grouping bucket start time. */\n  bucketStartTimeUTC: Date;\n  /** The grouping bucket end time. */\n  bucketEndTimeUTC: Date;\n  /** The time of the first activity in the grouping bucket. */\n  firstActivityTimeUTC: Date;\n  /** The time of the last activity in the grouping bucket. */\n  lastActivityTimeUTC: Date;\n  /** The activity timeline content. */\n  content: string;\n  /** The activity timeline title. */\n  title: string;\n}\n\n/** Represents bookmark timeline item. */\nexport interface BookmarkTimelineItem extends EntityTimelineItem {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Bookmark\";\n  /** The bookmark azure resource id. */\n  azureResourceId: string;\n  /** The bookmark display name. */\n  displayName?: string;\n  /** The notes of the bookmark */\n  notes?: string;\n  /** The bookmark end time. */\n  endTimeUtc?: Date;\n  /** The bookmark start time. */\n  startTimeUtc?: Date;\n  /** The bookmark event time. */\n  eventTime?: Date;\n  /** Describes a user that created the bookmark */\n  createdBy?: UserInfo;\n  /** List of labels relevant to this bookmark */\n  labels?: string[];\n}\n\n/** Represents anomaly timeline item. */\nexport interface AnomalyTimelineItem extends EntityTimelineItem {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Anomaly\";\n  /** The anomaly azure resource id. */\n  azureResourceId: string;\n  /** The anomaly product name. */\n  productName?: string;\n  /** The anomaly description. */\n  description?: string;\n  /** The anomaly name. */\n  displayName: string;\n  /** The anomaly end time. */\n  endTimeUtc: Date;\n  /** The anomaly start time. */\n  startTimeUtc: Date;\n  /** The anomaly generated time. */\n  timeGenerated: Date;\n  /** The name of the anomaly vendor. */\n  vendor?: string;\n  /** The intent of the anomaly. */\n  intent?: string;\n  /** The techniques of the anomaly. */\n  techniques?: string[];\n  /** The reasons that cause the anomaly. */\n  reasons?: string[];\n}\n\n/** Represents security alert timeline item. */\nexport interface SecurityAlertTimelineItem extends EntityTimelineItem {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"SecurityAlert\";\n  /** The alert azure resource id. */\n  azureResourceId: string;\n  /** The alert product name. */\n  productName?: string;\n  /** The alert description. */\n  description?: string;\n  /** The alert name. */\n  displayName: string;\n  /** The alert severity. */\n  severity: AlertSeverity;\n  /** The alert end time. */\n  endTimeUtc: Date;\n  /** The alert start time. */\n  startTimeUtc: Date;\n  /** The alert generated time. */\n  timeGenerated: Date;\n  /** The name of the alert type. */\n  alertType: string;\n}\n\n/** Represents Insight Query. */\nexport interface InsightQueryItem extends EntityQueryItem {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Insight\";\n  /** Properties bag for InsightQueryItem */\n  properties?: InsightQueryItemProperties;\n}\n\n/** SecurityAlert entity property bag. */\nexport interface SecurityAlertProperties extends EntityCommonProperties {\n  /**\n   * The display name of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertDisplayName?: string;\n  /**\n   * The type name of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertType?: string;\n  /**\n   * Display name of the main entity being reported on.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly compromisedEntity?: string;\n  /**\n   * The confidence level of this alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceLevel?: ConfidenceLevel;\n  /**\n   * The confidence reasons\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceReasons?: SecurityAlertPropertiesConfidenceReasonsItem[];\n  /**\n   * The confidence score of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceScore?: number;\n  /**\n   * The confidence score calculation status, i.e. indicating if score calculation is pending for this alert, not applicable or final.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceScoreStatus?: ConfidenceScoreStatus;\n  /**\n   * Alert description.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly description?: string;\n  /**\n   * The impact end time of the alert (the time of the last event contributing to the alert).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly endTimeUtc?: Date;\n  /**\n   * Holds the alert intent stage(s) mapping for this alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly intent?: KillChainIntent;\n  /**\n   * The identifier of the alert inside the product which generated the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly providerAlertId?: string;\n  /**\n   * The time the alert was made available for consumption.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly processingEndTime?: Date;\n  /**\n   * The name of a component inside the product which generated the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly productComponentName?: string;\n  /**\n   * The name of the product which published this alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly productName?: string;\n  /**\n   * The version of the product generating the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly productVersion?: string;\n  /**\n   * Manual action items to take to remediate the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly remediationSteps?: string[];\n  /** The severity of the alert */\n  severity?: AlertSeverity;\n  /**\n   * The impact start time of the alert (the time of the first event contributing to the alert).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly startTimeUtc?: Date;\n  /**\n   * The lifecycle status of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly status?: AlertStatus;\n  /**\n   * Holds the product identifier of the alert for the product.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly systemAlertId?: string;\n  /**\n   * The tactics of the alert\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly tactics?: AttackTactic[];\n  /**\n   * The time the alert was generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly timeGenerated?: Date;\n  /**\n   * The name of the vendor that raise the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly vendorName?: string;\n  /**\n   * The uri link of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertLink?: string;\n  /**\n   * The list of resource identifiers of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly resourceIdentifiers?: Record<string, unknown>[];\n}\n\n/** Describes bookmark properties */\nexport interface HuntingBookmarkProperties extends EntityCommonProperties {\n  /** The time the bookmark was created */\n  created?: Date;\n  /** Describes a user that created the bookmark */\n  createdBy?: UserInfo;\n  /** The display name of the bookmark */\n  displayName: string;\n  /** The time of the event */\n  eventTime?: Date;\n  /** List of labels relevant to this bookmark */\n  labels?: string[];\n  /** The notes of the bookmark */\n  notes?: string;\n  /** The query of the bookmark. */\n  query: string;\n  /** The query result of the bookmark. */\n  queryResult?: string;\n  /** The last time the bookmark was updated */\n  updated?: Date;\n  /** Describes a user that updated the bookmark */\n  updatedBy?: UserInfo;\n  /** Describes an incident that relates to bookmark */\n  incidentInfo?: IncidentInfo;\n}\n\n/** Describes threat intelligence entity properties */\nexport interface ThreatIntelligenceIndicatorProperties\n  extends EntityCommonProperties {\n  /** List of tags */\n  threatIntelligenceTags?: string[];\n  /** Last updated time in UTC */\n  lastUpdatedTimeUtc?: string;\n  /** Source of a threat intelligence entity */\n  source?: string;\n  /** Display name of a threat intelligence entity */\n  displayName?: string;\n  /** Description of a threat intelligence entity */\n  description?: string;\n  /** Indicator types of threat intelligence entities */\n  indicatorTypes?: string[];\n  /** Pattern of a threat intelligence entity */\n  pattern?: string;\n  /** Pattern type of a threat intelligence entity */\n  patternType?: string;\n  /** Pattern version of a threat intelligence entity */\n  patternVersion?: string;\n  /** Kill chain phases */\n  killChainPhases?: ThreatIntelligenceKillChainPhase[];\n  /** Parsed patterns */\n  parsedPattern?: ThreatIntelligenceParsedPattern[];\n  /** External ID of threat intelligence entity */\n  externalId?: string;\n  /** Created by reference of threat intelligence entity */\n  createdByRef?: string;\n  /** Is threat intelligence entity defanged */\n  defanged?: boolean;\n  /** External last updated time in UTC */\n  externalLastUpdatedTimeUtc?: string;\n  /** External References */\n  externalReferences?: ThreatIntelligenceExternalReference[];\n  /** Granular Markings */\n  granularMarkings?: ThreatIntelligenceGranularMarkingModel[];\n  /** Labels  of threat intelligence entity */\n  labels?: string[];\n  /** Is threat intelligence entity revoked */\n  revoked?: boolean;\n  /** Confidence of threat intelligence entity */\n  confidence?: number;\n  /** Threat intelligence entity object marking references */\n  objectMarkingRefs?: string[];\n  /** Language of threat intelligence entity */\n  language?: string;\n  /** Threat types */\n  threatTypes?: string[];\n  /** Valid from */\n  validFrom?: string;\n  /** Valid until */\n  validUntil?: string;\n  /** Created by */\n  created?: string;\n  /** Modified by */\n  modified?: string;\n  /** Extensions map */\n  extensions?: { [propertyName: string]: any };\n}\n\n/** Account entity property bag. */\nexport interface AccountEntityProperties extends EntityCommonProperties {\n  /**\n   * The Azure Active Directory tenant id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly aadTenantId?: string;\n  /**\n   * The Azure Active Directory user id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly aadUserId?: string;\n  /**\n   * The name of the account. This field should hold only the name without any domain added to it, i.e. administrator.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly accountName?: string;\n  /**\n   * The display name of the account.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly displayName?: string;\n  /**\n   * The Host entity id that contains the account in case it is a local account (not domain joined)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n  /**\n   * Determines whether this is a domain account.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isDomainJoined?: boolean;\n  /**\n   * The NetBIOS domain name as it appears in the alert format domain/username. Examples: NT AUTHORITY.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ntDomain?: string;\n  /**\n   * The objectGUID attribute is a single-value attribute that is the unique identifier for the object, assigned by active directory.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly objectGuid?: string;\n  /**\n   * The Azure Active Directory Passport User ID.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly puid?: string;\n  /**\n   * The account security identifier, e.g. S-1-5-18.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sid?: string;\n  /**\n   * The user principal name suffix for the account, in some cases it is also the domain name. Examples: contoso.com.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly upnSuffix?: string;\n  /**\n   * The fully qualified domain DNS name.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly dnsDomain?: string;\n}\n\n/** AzureResource entity property bag. */\nexport interface AzureResourceEntityProperties extends EntityCommonProperties {\n  /**\n   * The azure resource id of the resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly resourceId?: string;\n  /**\n   * The subscription id of the resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly subscriptionId?: string;\n}\n\n/** CloudApplication entity property bag. */\nexport interface CloudApplicationEntityProperties\n  extends EntityCommonProperties {\n  /**\n   * The technical identifier of the application.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly appId?: number;\n  /**\n   * The name of the related cloud application.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly appName?: string;\n  /**\n   * The user defined instance name of the cloud application. It is often used to distinguish between several applications of the same type that a customer has.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly instanceName?: string;\n}\n\n/** Dns entity property bag. */\nexport interface DnsEntityProperties extends EntityCommonProperties {\n  /**\n   * An ip entity id for the dns server resolving the request\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly dnsServerIpEntityId?: string;\n  /**\n   * The name of the dns record associated with the alert\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly domainName?: string;\n  /**\n   * An ip entity id for the dns request client\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostIpAddressEntityId?: string;\n  /**\n   * Ip entity identifiers for the resolved ip address.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ipAddressEntityIds?: string[];\n}\n\n/** File entity property bag. */\nexport interface FileEntityProperties extends EntityCommonProperties {\n  /**\n   * The full path to the file.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly directory?: string;\n  /**\n   * The file hash entity identifiers associated with this file\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileHashEntityIds?: string[];\n  /**\n   * The file name without path (some alerts might not include path).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileName?: string;\n  /**\n   * The Host entity id which the file belongs to\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n}\n\n/** FileHash entity property bag. */\nexport interface FileHashEntityProperties extends EntityCommonProperties {\n  /**\n   * The hash algorithm type.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly algorithm?: FileHashAlgorithm;\n  /**\n   * The file hash value.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hashValue?: string;\n}\n\n/** Host entity property bag. */\nexport interface HostEntityProperties extends EntityCommonProperties {\n  /**\n   * The azure resource id of the VM.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly azureID?: string;\n  /**\n   * The DNS domain that this host belongs to. Should contain the compete DNS suffix for the domain\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly dnsDomain?: string;\n  /**\n   * The hostname without the domain suffix.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostName?: string;\n  /**\n   * Determines whether this host belongs to a domain.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isDomainJoined?: boolean;\n  /**\n   * The host name (pre-windows2000).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly netBiosName?: string;\n  /**\n   * The NT domain that this host belongs to.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ntDomain?: string;\n  /**\n   * The OMS agent id, if the host has OMS agent installed.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly omsAgentID?: string;\n  /** The operating system type. */\n  osFamily?: OSFamily;\n  /**\n   * A free text representation of the operating system. This field is meant to hold specific versions the are more fine grained than OSFamily or future values not supported by OSFamily enumeration\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly osVersion?: string;\n}\n\n/** IoTDevice entity property bag. */\nexport interface IoTDeviceEntityProperties extends EntityCommonProperties {\n  /**\n   * The ID of the IoT Device in the IoT Hub\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceId?: string;\n  /**\n   * The friendly name of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceName?: string;\n  /**\n   * The source of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly source?: string;\n  /**\n   * The ID of the security agent running on the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly iotSecurityAgentId?: string;\n  /**\n   * The type of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceType?: string;\n  /**\n   * The vendor of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly vendor?: string;\n  /**\n   * The ID of the edge device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly edgeId?: string;\n  /**\n   * The MAC address of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly macAddress?: string;\n  /**\n   * The model of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly model?: string;\n  /**\n   * The serial number of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly serialNumber?: string;\n  /**\n   * The firmware version of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly firmwareVersion?: string;\n  /**\n   * The operating system of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly operatingSystem?: string;\n  /**\n   * The AzureResource entity id of the IoT Hub\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly iotHubEntityId?: string;\n  /**\n   * The Host entity id of this device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n  /**\n   * The IP entity if of this device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ipAddressEntityId?: string;\n  /**\n   * A list of TI contexts attached to the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatIntelligence?: ThreatIntelligence[];\n  /**\n   * A list of protocols of the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly protocols?: string[];\n  /**\n   * A list of owners of the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly owners?: string[];\n  /**\n   * A list of Nic entity ids of the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nicEntityIds?: string[];\n  /**\n   * The site of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly site?: string;\n  /**\n   * The zone location of the device within a site\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly zone?: string;\n  /**\n   * The sensor the device is monitored by\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sensor?: string;\n  /**\n   * The subType of the device ('PLC', 'HMI', 'EWS', etc.)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceSubType?: string;\n  /** Device importance, determines if the device classified as 'crown jewel' */\n  importance?: DeviceImportance;\n  /**\n   * The Purdue Layer of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly purdueLayer?: string;\n  /**\n   * Determines whether the device classified as authorized device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isAuthorized?: boolean;\n  /**\n   * Determines whether the device classified as programming device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isProgramming?: boolean;\n  /**\n   * Is the device classified as a scanner device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isScanner?: boolean;\n}\n\n/** Ip entity property bag. */\nexport interface IpEntityProperties extends EntityCommonProperties {\n  /**\n   * The IP address as string, e.g. 127.0.0.1 (either in Ipv4 or Ipv6)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly address?: string;\n  /**\n   * The geo-location context attached to the ip entity\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly location?: GeoLocation;\n  /**\n   * A list of TI contexts attached to the ip entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatIntelligence?: ThreatIntelligence[];\n}\n\n/** Mailbox entity property bag. */\nexport interface MailboxEntityProperties extends EntityCommonProperties {\n  /**\n   * The mailbox's primary address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly mailboxPrimaryAddress?: string;\n  /**\n   * The mailbox's display name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly displayName?: string;\n  /**\n   * The mailbox's UPN\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly upn?: string;\n  /**\n   * The AzureAD identifier of mailbox. Similar to AadUserId in account entity but this property is specific to mailbox object on office side\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly externalDirectoryObjectId?: string;\n}\n\n/** Mail cluster entity property bag. */\nexport interface MailClusterEntityProperties extends EntityCommonProperties {\n  /**\n   * The mail message IDs that are part of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly networkMessageIds?: string[];\n  /**\n   * Count of mail messages by DeliveryStatus string representation\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countByDeliveryStatus?: Record<string, unknown>;\n  /**\n   * Count of mail messages by ThreatType string representation\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countByThreatType?: Record<string, unknown>;\n  /**\n   * Count of mail messages by ProtectionStatus string representation\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countByProtectionStatus?: Record<string, unknown>;\n  /**\n   * The threats of mail messages that are part of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threats?: string[];\n  /**\n   * The query that was used to identify the messages of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly query?: string;\n  /**\n   * The query time\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly queryTime?: Date;\n  /**\n   * The number of mail messages that are part of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly mailCount?: number;\n  /**\n   * Is this a volume anomaly mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isVolumeAnomaly?: boolean;\n  /**\n   * The source of the mail cluster (default is 'O365 ATP')\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly source?: string;\n  /**\n   * The id of the cluster source\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterSourceIdentifier?: string;\n  /**\n   * The type of the cluster source\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterSourceType?: string;\n  /**\n   * The cluster query start time\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterQueryStartTime?: Date;\n  /**\n   * The cluster query end time\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterQueryEndTime?: Date;\n  /**\n   * The cluster group\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterGroup?: string;\n}\n\n/** Mail message entity property bag. */\nexport interface MailMessageEntityProperties extends EntityCommonProperties {\n  /**\n   * The File entity ids of this mail message's attachments\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileEntityIds?: string[];\n  /**\n   * The recipient of this mail message. Note that in case of multiple recipients the mail message is forked and each copy has one recipient\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly recipient?: string;\n  /**\n   * The Urls contained in this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly urls?: string[];\n  /**\n   * The threats of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threats?: string[];\n  /**\n   * The p1 sender's email address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p1Sender?: string;\n  /**\n   * The p1 sender's display name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p1SenderDisplayName?: string;\n  /**\n   * The p1 sender's domain\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p1SenderDomain?: string;\n  /**\n   * The sender's IP address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly senderIP?: string;\n  /**\n   * The p2 sender's email address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p2Sender?: string;\n  /**\n   * The p2 sender's display name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p2SenderDisplayName?: string;\n  /**\n   * The p2 sender's domain\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p2SenderDomain?: string;\n  /**\n   * The receive date of this message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly receiveDate?: Date;\n  /**\n   * The network message id of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly networkMessageId?: string;\n  /**\n   * The internet message id of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly internetMessageId?: string;\n  /**\n   * The subject of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly subject?: string;\n  /**\n   * The language of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly language?: string;\n  /**\n   * The threat detection methods\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatDetectionMethods?: string[];\n  /** The bodyFingerprintBin1 */\n  bodyFingerprintBin1?: number;\n  /** The bodyFingerprintBin2 */\n  bodyFingerprintBin2?: number;\n  /** The bodyFingerprintBin3 */\n  bodyFingerprintBin3?: number;\n  /** The bodyFingerprintBin4 */\n  bodyFingerprintBin4?: number;\n  /** The bodyFingerprintBin5 */\n  bodyFingerprintBin5?: number;\n  /** The directionality of this mail message */\n  antispamDirection?: AntispamMailDirection;\n  /** The delivery action of this mail message like Delivered, Blocked, Replaced etc */\n  deliveryAction?: DeliveryAction;\n  /** The delivery location of this mail message like Inbox, JunkFolder etc */\n  deliveryLocation?: DeliveryLocation;\n}\n\n/** Malware entity property bag. */\nexport interface MalwareEntityProperties extends EntityCommonProperties {\n  /**\n   * The malware category by the vendor, e.g. Trojan\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly category?: string;\n  /**\n   * List of linked file entity identifiers on which the malware was found\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileEntityIds?: string[];\n  /**\n   * The malware name by the vendor, e.g. Win32/Toga!rfn\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly malwareName?: string;\n  /**\n   * List of linked process entity identifiers on which the malware was found.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly processEntityIds?: string[];\n}\n\n/** Process entity property bag. */\nexport interface ProcessEntityProperties extends EntityCommonProperties {\n  /**\n   * The account entity id running the processes.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly accountEntityId?: string;\n  /**\n   * The command line used to create the process\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly commandLine?: string;\n  /**\n   * The time when the process started to run\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly creationTimeUtc?: Date;\n  /** The elevation token associated with the process. */\n  elevationToken?: ElevationToken;\n  /**\n   * The host entity id on which the process was running\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n  /**\n   * The session entity id in which the process was running\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostLogonSessionEntityId?: string;\n  /**\n   * Image file entity id\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly imageFileEntityId?: string;\n  /**\n   * The parent process entity id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly parentProcessEntityId?: string;\n  /**\n   * The process ID\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly processId?: string;\n}\n\n/** RegistryKey entity property bag. */\nexport interface RegistryKeyEntityProperties extends EntityCommonProperties {\n  /**\n   * the hive that holds the registry key.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hive?: RegistryHive;\n  /**\n   * The registry key path.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly key?: string;\n}\n\n/** RegistryValue entity property bag. */\nexport interface RegistryValueEntityProperties extends EntityCommonProperties {\n  /**\n   * The registry key entity id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly keyEntityId?: string;\n  /**\n   * String formatted representation of the value data.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly valueData?: string;\n  /**\n   * The registry value name.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly valueName?: string;\n  /**\n   * Specifies the data types to use when storing values in the registry, or identifies the data type of a value in the registry.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly valueType?: RegistryValueKind;\n}\n\n/** SecurityGroup entity property bag. */\nexport interface SecurityGroupEntityProperties extends EntityCommonProperties {\n  /**\n   * The group distinguished name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly distinguishedName?: string;\n  /**\n   * A single-value attribute that is the unique identifier for the object, assigned by active directory.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly objectGuid?: string;\n  /**\n   * The SID attribute is a single-value attribute that specifies the security identifier (SID) of the group\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sid?: string;\n}\n\n/** Submission mail entity property bag. */\nexport interface SubmissionMailEntityProperties extends EntityCommonProperties {\n  /**\n   * The network message id of email to which submission belongs\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly networkMessageId?: string;\n  /**\n   * The submission id\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly submissionId?: string;\n  /**\n   * The submitter\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly submitter?: string;\n  /**\n   * The submission date\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly submissionDate?: Date;\n  /**\n   * The Time stamp when the message is received (Mail)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly timestamp?: Date;\n  /**\n   * The recipient of the mail\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly recipient?: string;\n  /**\n   * The sender of the mail\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sender?: string;\n  /**\n   * The sender's IP\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly senderIp?: string;\n  /**\n   * The subject of submission mail\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly subject?: string;\n  /**\n   * The submission type for the given instance. This maps to Junk, Phish, Malware or NotJunk.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly reportType?: string;\n}\n\n/** Url entity property bag. */\nexport interface UrlEntityProperties extends EntityCommonProperties {\n  /**\n   * A full URL the entity points to\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly url?: string;\n}\n\n/** Nic entity property bag. */\nexport interface NicEntityProperties extends EntityCommonProperties {\n  /**\n   * The MAC address of this network interface\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly macAddress?: string;\n  /**\n   * The IP entity id of this network interface\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ipAddressEntityId?: string;\n  /**\n   * A list of VLANs of the network interface entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly vlans?: string[];\n}\n\n/** Represents AAD (Azure Active Directory) requirements check request. */\nexport interface AADCheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AzureActiveDirectory\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents AATP (Azure Advanced Threat Protection) requirements check request. */\nexport interface AatpCheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AzureAdvancedThreatProtection\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents ASC (Azure Security Center) requirements check request. */\nexport interface ASCCheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AzureSecurityCenter\";\n  /** The subscription id to connect to, and get the data from. */\n  subscriptionId?: string;\n}\n\n/** Amazon Web Services CloudTrail requirements check request. */\nexport interface AwsCloudTrailCheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AmazonWebServicesCloudTrail\";\n}\n\n/** Amazon Web Services S3 requirements check request. */\nexport interface AwsS3CheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AmazonWebServicesS3\";\n}\n\n/** Represents Dynamics365 requirements check request. */\nexport interface Dynamics365CheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Dynamics365\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents MCAS (Microsoft Cloud App Security) requirements check request. */\nexport interface McasCheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftCloudAppSecurity\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents MDATP (Microsoft Defender Advanced Threat Protection) requirements check request. */\nexport interface MdatpCheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftDefenderAdvancedThreatProtection\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents Microsoft Threat Intelligence requirements check request. */\nexport interface MstiCheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftThreatIntelligence\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents MTP (Microsoft Threat Protection) requirements check request. */\nexport interface MtpCheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftThreatProtection\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents OfficeATP (Office 365 Advanced Threat Protection) requirements check request. */\nexport interface OfficeATPCheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"OfficeATP\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents OfficeIRM (Microsoft Insider Risk Management) requirements check request. */\nexport interface OfficeIRMCheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"OfficeIRM\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents Office365 Project requirements check request. */\nexport interface Office365ProjectCheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Office365Project\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents Office PowerBI requirements check request. */\nexport interface OfficePowerBICheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"OfficePowerBI\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Threat Intelligence Platforms data connector check requirements */\nexport interface TICheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"ThreatIntelligence\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Threat Intelligence TAXII data connector check requirements */\nexport interface TiTaxiiCheckRequirements\n  extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"ThreatIntelligenceTaxii\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n}\n\n/** Represents IoT requirements check request. */\nexport interface IoTCheckRequirements extends DataConnectorsCheckRequirements {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"IOT\";\n  /** The subscription id to connect to, and get the data from. */\n  subscriptionId?: string;\n}\n\n/** Alert rule template with MITRE property bag. */\nexport interface AlertRuleTemplateWithMitreProperties\n  extends AlertRuleTemplatePropertiesBase {\n  /** The tactics of the alert rule */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n}\n\n/** MicrosoftSecurityIncidentCreation rule template properties */\nexport interface MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties\n  extends AlertRuleTemplatePropertiesBase {\n  /** the alerts' displayNames on which the cases will be generated */\n  displayNamesFilter?: string[];\n  /** the alerts' displayNames on which the cases will not be generated */\n  displayNamesExcludeFilter?: string[];\n  /** The alerts' productName on which the cases will be generated */\n  productFilter?: MicrosoftSecurityProductName;\n  /** the alerts' severities on which the cases will be generated */\n  severitiesFilter?: AlertSeverity[];\n}\n\n/** NRT alert rule template properties */\nexport interface NrtAlertRuleTemplateProperties\n  extends AlertRuleTemplateWithMitreProperties,\n    QueryBasedAlertRuleTemplateProperties {}\n\n/** MicrosoftSecurityIncidentCreation rule property bag. */\nexport interface MicrosoftSecurityIncidentCreationAlertRuleProperties\n  extends MicrosoftSecurityIncidentCreationAlertRuleCommonProperties {\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /** The description of the alert rule. */\n  description?: string;\n  /** The display name for alerts created by this alert rule. */\n  displayName: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled: boolean;\n  /**\n   * The last time that this alert has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n}\n\n/** Scheduled alert rule base property bag. */\nexport interface ScheduledAlertRuleProperties\n  extends ScheduledAlertRuleCommonProperties {\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /** The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2> */\n  templateVersion?: string;\n  /** The description of the alert rule. */\n  description?: string;\n  /** The display name for alerts created by this alert rule. */\n  displayName: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled: boolean;\n  /**\n   * The last time that this alert rule has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n  /** The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. */\n  suppressionDuration: string;\n  /** Determines whether the suppression for this alert rule is enabled or disabled. */\n  suppressionEnabled: boolean;\n  /** The tactics of the alert rule */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** The settings of the incidents that created from alerts triggered by this analytics rule */\n  incidentConfiguration?: IncidentConfiguration;\n}\n\n/** Represents Insight Query. */\nexport interface InsightQueryItemProperties extends EntityQueryItemProperties {\n  /** The insight display name. */\n  displayName?: string;\n  /** The insight description. */\n  description?: string;\n  /** The base query of the insight. */\n  baseQuery?: string;\n  /** The insight table query. */\n  tableQuery?: InsightQueryItemPropertiesTableQuery;\n  /** The insight chart query. */\n  chartQuery?: Record<string, unknown>;\n  /** The activity query definitions. */\n  additionalQuery?: InsightQueryItemPropertiesAdditionalQuery;\n  /** The insight chart query. */\n  defaultTimeRange?: InsightQueryItemPropertiesDefaultTimeRange;\n  /** The insight chart query. */\n  referenceTimeRange?: InsightQueryItemPropertiesReferenceTimeRange;\n}\n\n/** AAD (Azure Active Directory) requirements check properties. */\nexport interface AADCheckRequirementsProperties extends DataConnectorTenantId {}\n\n/** AATP (Azure Advanced Threat Protection) requirements check properties. */\nexport interface AatpCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** Dynamics365 requirements check properties. */\nexport interface Dynamics365CheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** MCAS (Microsoft Cloud App Security) requirements check properties. */\nexport interface McasCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** MDATP (Microsoft Defender Advanced Threat Protection) requirements check properties. */\nexport interface MdatpCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** Microsoft Threat Intelligence requirements check properties. */\nexport interface MstiCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** MTP (Microsoft Threat Protection) requirements check properties. */\nexport interface MTPCheckRequirementsProperties extends DataConnectorTenantId {}\n\n/** OfficeATP (Office 365 Advanced Threat Protection) requirements check properties. */\nexport interface OfficeATPCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** OfficeIRM (Microsoft Insider Risk Management) requirements check properties. */\nexport interface OfficeIRMCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** Office365 Project requirements check properties. */\nexport interface Office365ProjectCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** Office PowerBI requirements check properties. */\nexport interface OfficePowerBICheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** Threat Intelligence Platforms data connector required properties. */\nexport interface TICheckRequirementsProperties extends DataConnectorTenantId {}\n\n/** Threat Intelligence TAXII data connector required properties. */\nexport interface TiTaxiiCheckRequirementsProperties\n  extends DataConnectorTenantId {}\n\n/** AAD (Azure Active Directory) data connector properties. */\nexport interface AADDataConnectorProperties\n  extends DataConnectorTenantId,\n    DataConnectorWithAlertsProperties {}\n\n/** Microsoft Threat Intelligence data connector properties. */\nexport interface MstiDataConnectorProperties extends DataConnectorTenantId {\n  /** The available data types for the connector. */\n  dataTypes: MstiDataConnectorDataTypes;\n}\n\n/** MTP (Microsoft Threat Protection) data connector properties. */\nexport interface MTPDataConnectorProperties extends DataConnectorTenantId {\n  /** The available data types for the connector. */\n  dataTypes: MTPDataConnectorDataTypes;\n}\n\n/** AATP (Azure Advanced Threat Protection) data connector properties. */\nexport interface AatpDataConnectorProperties\n  extends DataConnectorTenantId,\n    DataConnectorWithAlertsProperties {}\n\n/** MCAS (Microsoft Cloud App Security) data connector properties. */\nexport interface McasDataConnectorProperties extends DataConnectorTenantId {\n  /** The available data types for the connector. */\n  dataTypes: McasDataConnectorDataTypes;\n}\n\n/** Dynamics365 data connector properties. */\nexport interface Dynamics365DataConnectorProperties\n  extends DataConnectorTenantId {\n  /** The available data types for the connector. */\n  dataTypes: Dynamics365DataConnectorDataTypes;\n}\n\n/** OfficeATP (Office 365 Advanced Threat Protection) data connector properties. */\nexport interface OfficeATPDataConnectorProperties\n  extends DataConnectorTenantId,\n    DataConnectorWithAlertsProperties {}\n\n/** Office Microsoft Project data connector properties. */\nexport interface Office365ProjectDataConnectorProperties\n  extends DataConnectorTenantId {\n  /** The available data types for the connector. */\n  dataTypes: Office365ProjectConnectorDataTypes;\n}\n\n/** Office Microsoft PowerBI data connector properties. */\nexport interface OfficePowerBIDataConnectorProperties\n  extends DataConnectorTenantId {\n  /** The available data types for the connector. */\n  dataTypes: OfficePowerBIConnectorDataTypes;\n}\n\n/** OfficeIRM (Microsoft Insider Risk Management) data connector properties. */\nexport interface OfficeIRMDataConnectorProperties\n  extends DataConnectorTenantId,\n    DataConnectorWithAlertsProperties {}\n\n/** MDATP (Microsoft Defender Advanced Threat Protection) data connector properties. */\nexport interface MdatpDataConnectorProperties\n  extends DataConnectorTenantId,\n    DataConnectorWithAlertsProperties {}\n\n/** Office data connector properties. */\nexport interface OfficeDataConnectorProperties extends DataConnectorTenantId {\n  /** The available data types for the connector. */\n  dataTypes: OfficeDataConnectorDataTypes;\n}\n\n/** TI (Threat Intelligence) data connector properties. */\nexport interface TIDataConnectorProperties extends DataConnectorTenantId {\n  /** The lookback period for the feed to be imported. */\n  tipLookbackPeriod?: Date;\n  /** The available data types for the connector. */\n  dataTypes: TIDataConnectorDataTypes;\n}\n\n/** Threat Intelligence TAXII data connector properties. */\nexport interface TiTaxiiDataConnectorProperties extends DataConnectorTenantId {\n  /** The workspace id. */\n  workspaceId?: string;\n  /** The friendly name for the TAXII server. */\n  friendlyName?: string;\n  /** The API root for the TAXII server. */\n  taxiiServer?: string;\n  /** The collection id of the TAXII server. */\n  collectionId?: string;\n  /** The userName for the TAXII server. */\n  userName?: string;\n  /** The password for the TAXII server. */\n  password?: string;\n  /** The lookback period for the TAXII server. */\n  taxiiLookbackPeriod?: Date;\n  /** The polling frequency for the TAXII server. */\n  pollingFrequency: PollingFrequency | null;\n  /** The available data types for Threat Intelligence TAXII data connector. */\n  dataTypes: TiTaxiiDataConnectorDataTypes;\n}\n\n/** ASC (Azure Security Center) data connector properties. */\nexport interface ASCDataConnectorProperties\n  extends DataConnectorWithAlertsProperties {\n  /** The subscription id to connect to, and get the data from. */\n  subscriptionId?: string;\n}\n\n/** IoT data connector properties. */\nexport interface IoTDataConnectorProperties\n  extends DataConnectorWithAlertsProperties {\n  /** The subscription id to connect to, and get the data from. */\n  subscriptionId?: string;\n}\n\n/** The available data types for MCAS (Microsoft Cloud App Security) data connector. */\nexport interface McasDataConnectorDataTypes\n  extends AlertsDataTypeOfDataConnector {\n  /** Discovery log data type connection. */\n  discoveryLogs?: DataConnectorDataTypeCommon;\n}\n\n/** Data type for Microsoft Threat Intelligence Platforms data connector. */\nexport interface MstiDataConnectorDataTypesBingSafetyPhishingURL\n  extends DataConnectorDataTypeCommon {\n  /** lookback period */\n  lookbackPeriod: string;\n}\n\n/** Data type for Microsoft Threat Intelligence Platforms data connector. */\nexport interface MstiDataConnectorDataTypesMicrosoftEmergingThreatFeed\n  extends DataConnectorDataTypeCommon {\n  /** lookback period */\n  lookbackPeriod: string;\n}\n\n/** Data type for Microsoft Threat Protection Platforms data connector. */\nexport interface MTPDataConnectorDataTypesIncidents\n  extends DataConnectorDataTypeCommon {}\n\n/** Logs data type. */\nexport interface AwsCloudTrailDataConnectorDataTypesLogs\n  extends DataConnectorDataTypeCommon {}\n\n/** Logs data type. */\nexport interface AwsS3DataConnectorDataTypesLogs\n  extends DataConnectorDataTypeCommon {}\n\n/** Common Data Service data type connection. */\nexport interface Dynamics365DataConnectorDataTypesDynamics365CdsActivities\n  extends DataConnectorDataTypeCommon {}\n\n/** Logs data type. */\nexport interface Office365ProjectConnectorDataTypesLogs\n  extends DataConnectorDataTypeCommon {}\n\n/** Logs data type. */\nexport interface OfficePowerBIConnectorDataTypesLogs\n  extends DataConnectorDataTypeCommon {}\n\n/** Exchange data type connection. */\nexport interface OfficeDataConnectorDataTypesExchange\n  extends DataConnectorDataTypeCommon {}\n\n/** SharePoint data type connection. */\nexport interface OfficeDataConnectorDataTypesSharePoint\n  extends DataConnectorDataTypeCommon {}\n\n/** Teams data type connection. */\nexport interface OfficeDataConnectorDataTypesTeams\n  extends DataConnectorDataTypeCommon {}\n\n/** Data type for indicators connection. */\nexport interface TIDataConnectorDataTypesIndicators\n  extends DataConnectorDataTypeCommon {}\n\n/** Data type for TAXII connector. */\nexport interface TiTaxiiDataConnectorDataTypesTaxiiClient\n  extends DataConnectorDataTypeCommon {}\n\nexport interface CodelessUiConnectorConfigPropertiesGraphQueriesItem\n  extends GraphQueries {}\n\nexport interface CodelessUiConnectorConfigPropertiesSampleQueriesItem\n  extends SampleQueries {}\n\nexport interface CodelessUiConnectorConfigPropertiesDataTypesItem\n  extends LastDataReceivedDataType {}\n\nexport interface CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem\n  extends ConnectivityCriteria {}\n\nexport interface PermissionsResourceProviderItem extends ResourceProvider {}\n\n/** Customs permissions required for the connector */\nexport interface Customs extends CustomsPermission {}\n\nexport interface CodelessUiConnectorConfigPropertiesInstructionStepsItem\n  extends InstructionSteps {}\n\nexport interface InstructionStepsInstructionsItem\n  extends ConnectorInstructionModelBase {}\n\n/** Alert rule. */\nexport interface AlertRule extends ResourceWithEtag {\n  /** The kind of the alert rule */\n  kind: AlertRuleKind;\n}\n\n/** Action for alert rule. */\nexport interface ActionResponse extends ResourceWithEtag {\n  /** Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. */\n  logicAppResourceId?: string;\n  /** The name of the logic app's workflow. */\n  workflowId?: string;\n}\n\n/** Action for alert rule. */\nexport interface ActionRequest extends ResourceWithEtag {\n  /** Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. */\n  logicAppResourceId?: string;\n  /** Logic App Callback URL for this specific workflow. */\n  triggerUri?: string;\n}\n\nexport interface AutomationRule extends ResourceWithEtag {\n  /** The display name of the automation rule. */\n  displayName: string;\n  /** The order of execution of the automation rule. */\n  order: number;\n  /** Describes automation rule triggering logic. */\n  triggeringLogic: AutomationRuleTriggeringLogic;\n  /** The actions to execute when the automation rule is triggered. */\n  actions: AutomationRuleActionUnion[];\n  /**\n   * The last time the automation rule was updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedTimeUtc?: Date;\n  /**\n   * The time the automation rule was created.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdTimeUtc?: Date;\n  /**\n   * Information on the client (user or application) that made some action\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedBy?: ClientInfo;\n  /**\n   * Information on the client (user or application) that made some action\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdBy?: ClientInfo;\n}\n\n/** Represents a bookmark in Azure Security Insights. */\nexport interface Bookmark extends ResourceWithEtag {\n  /** The time the bookmark was created */\n  created?: Date;\n  /** Describes a user that created the bookmark */\n  createdBy?: UserInfo;\n  /** The display name of the bookmark */\n  displayName?: string;\n  /** List of labels relevant to this bookmark */\n  labels?: string[];\n  /** The notes of the bookmark */\n  notes?: string;\n  /** The query of the bookmark. */\n  query?: string;\n  /** The query result of the bookmark. */\n  queryResult?: string;\n  /** The last time the bookmark was updated */\n  updated?: Date;\n  /** Describes a user that updated the bookmark */\n  updatedBy?: UserInfo;\n  /** The bookmark event time */\n  eventTime?: Date;\n  /** The start time for the query */\n  queryStartTime?: Date;\n  /** The end time for the query */\n  queryEndTime?: Date;\n  /** Describes an incident that relates to bookmark */\n  incidentInfo?: IncidentInfo;\n  /** Describes the entity mappings of the bookmark */\n  entityMappings?: BookmarkEntityMappings[];\n  /** A list of relevant mitre attacks */\n  tactics?: AttackTactic[];\n  /** A list of relevant mitre techniques */\n  techniques?: string[];\n}\n\n/** Represents a relation between two resources */\nexport interface Relation extends ResourceWithEtag {\n  /** The resource ID of the related resource */\n  relatedResourceId?: string;\n  /**\n   * The name of the related resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly relatedResourceName?: string;\n  /**\n   * The resource type of the related resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly relatedResourceType?: string;\n  /**\n   * The resource kind of the related resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly relatedResourceKind?: string;\n}\n\n/** Specific entity query. */\nexport interface EntityQuery extends ResourceWithEtag {\n  /** the entity query kind */\n  kind: EntityQueryKind;\n}\n\n/** Specific entity query that supports put requests. */\nexport interface CustomEntityQuery extends ResourceWithEtag {\n  /** the entity query kind */\n  kind: CustomEntityQueryKind;\n}\n\n/** Represents an incident in Azure Security Insights. */\nexport interface Incident extends ResourceWithEtag {\n  /**\n   * Additional data on the incident\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: IncidentAdditionalData;\n  /** The reason the incident was closed */\n  classification?: IncidentClassification;\n  /** Describes the reason the incident was closed */\n  classificationComment?: string;\n  /** The classification reason the incident was closed with */\n  classificationReason?: IncidentClassificationReason;\n  /**\n   * The time the incident was created\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdTimeUtc?: Date;\n  /** The description of the incident */\n  description?: string;\n  /** The time of the first activity in the incident */\n  firstActivityTimeUtc?: Date;\n  /**\n   * The deep-link url to the incident in Azure portal\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly incidentUrl?: string;\n  /**\n   * A sequential number\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly incidentNumber?: number;\n  /** List of labels relevant to this incident */\n  labels?: IncidentLabel[];\n  /** The name of the source provider that generated the incident */\n  providerName?: string;\n  /** The incident ID assigned by the incident provider */\n  providerIncidentId?: string;\n  /** The time of the last activity in the incident */\n  lastActivityTimeUtc?: Date;\n  /**\n   * The last time the incident was updated\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedTimeUtc?: Date;\n  /** Describes a user that the incident is assigned to */\n  owner?: IncidentOwnerInfo;\n  /**\n   * List of resource ids of Analytic rules related to the incident\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly relatedAnalyticRuleIds?: string[];\n  /** The severity of the incident */\n  severity?: IncidentSeverity;\n  /** The status of the incident */\n  status?: IncidentStatus;\n  /** Describes a team for the incident */\n  teamInformation?: TeamInformation;\n  /** The title of the incident */\n  title?: string;\n}\n\n/** Represents an incident comment */\nexport interface IncidentComment extends ResourceWithEtag {\n  /**\n   * The time the comment was created\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdTimeUtc?: Date;\n  /**\n   * The time the comment was updated\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedTimeUtc?: Date;\n  /** The comment message */\n  message?: string;\n  /**\n   * Describes the client that created the comment\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly author?: ClientInfo;\n}\n\n/** Metadata resource definition. */\nexport interface MetadataModel extends ResourceWithEtag {\n  /** Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name */\n  contentId?: string;\n  /** Full parent resource ID of the content item the metadata is for.  This is the full resource ID including the scope (subscription and resource group) */\n  parentId?: string;\n  /** Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices.  Can also be any string, but then we cannot guarantee any version checks */\n  version?: string;\n  /** The kind of content the metadata is for. */\n  kind?: Kind;\n  /** Source of the content.  This is where/how it was created. */\n  source?: MetadataSource;\n  /** The creator of the content item. */\n  author?: MetadataAuthor;\n  /** Support information for the metadata - type, name, contact information */\n  support?: MetadataSupport;\n  /** Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats. */\n  dependencies?: MetadataDependencies;\n  /** Categories for the solution content item */\n  categories?: MetadataCategories;\n  /** Providers for the solution content item */\n  providers?: string[];\n  /** first publish date solution content item */\n  firstPublishDate?: Date;\n  /** last publish date for the solution content item */\n  lastPublishDate?: Date;\n  /** The custom version of the content. A optional free text */\n  customVersion?: string;\n  /** Schema version of the content. Can be used to distinguish between different flow based on the schema version */\n  contentSchemaVersion?: string;\n  /** the icon identifier. this id can later be fetched from the solution template */\n  icon?: string;\n  /** the tactics the resource covers */\n  threatAnalysisTactics?: string[];\n  /** the techniques the resource covers, these have to be aligned with the tactics being used */\n  threatAnalysisTechniques?: string[];\n  /** preview image file names. These will be taken from the solution artifacts */\n  previewImages?: string[];\n  /** preview image file names. These will be taken from the solution artifacts. used for dark theme support */\n  previewImagesDark?: string[];\n}\n\n/** Metadata patch request body. */\nexport interface MetadataPatch extends ResourceWithEtag {\n  /** Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name */\n  contentId?: string;\n  /** Full parent resource ID of the content item the metadata is for.  This is the full resource ID including the scope (subscription and resource group) */\n  parentId?: string;\n  /** Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices.  Can also be any string, but then we cannot guarantee any version checks */\n  version?: string;\n  /** The kind of content the metadata is for. */\n  kind?: Kind;\n  /** Source of the content.  This is where/how it was created. */\n  source?: MetadataSource;\n  /** The creator of the content item. */\n  author?: MetadataAuthor;\n  /** Support information for the metadata - type, name, contact information */\n  support?: MetadataSupport;\n  /** Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats. */\n  dependencies?: MetadataDependencies;\n  /** Categories for the solution content item */\n  categories?: MetadataCategories;\n  /** Providers for the solution content item */\n  providers?: string[];\n  /** first publish date solution content item */\n  firstPublishDate?: Date;\n  /** last publish date for the solution content item */\n  lastPublishDate?: Date;\n  /** The custom version of the content. A optional free text */\n  customVersion?: string;\n  /** Schema version of the content. Can be used to distinguish between different flow based on the schema version */\n  contentSchemaVersion?: string;\n  /** the icon identifier. this id can later be fetched from the solution template */\n  icon?: string;\n  /** the tactics the resource covers */\n  threatAnalysisTactics?: string[];\n  /** the techniques the resource covers, these have to be aligned with the tactics being used */\n  threatAnalysisTechniques?: string[];\n  /** preview image file names. These will be taken from the solution artifacts */\n  previewImages?: string[];\n  /** preview image file names. These will be taken from the solution artifacts. used for dark theme support */\n  previewImagesDark?: string[];\n}\n\n/** Sentinel onboarding state */\nexport interface SentinelOnboardingState extends ResourceWithEtag {\n  /** Flag that indicates the status of the CMK setting */\n  customerManagedKey?: boolean;\n}\n\n/** Security ML Analytics Setting */\nexport interface SecurityMLAnalyticsSetting extends ResourceWithEtag {\n  /** The kind of security ML Analytics Settings */\n  kind: SecurityMLAnalyticsSettingsKind;\n}\n\n/** The Setting. */\nexport interface Settings extends ResourceWithEtag {\n  /** The kind of the setting */\n  kind: SettingKind;\n}\n\n/** Represents a SourceControl in Azure Security Insights. */\nexport interface SourceControl extends ResourceWithEtag {\n  /** The id (a Guid) of the source control */\n  idPropertiesId?: string;\n  /** The version number associated with the source control */\n  version?: Version;\n  /** The display name of the source control */\n  displayName?: string;\n  /** A description of the source control */\n  description?: string;\n  /** The repository type of the source control */\n  repoType?: RepoType;\n  /** Array of source control content types. */\n  contentTypes?: ContentType[];\n  /** Repository metadata. */\n  repository?: Repository;\n  /** Information regarding the resources created in user's repository. */\n  repositoryResourceInfo?: RepositoryResourceInfo;\n  /** Information regarding the latest deployment for the source control. */\n  lastDeploymentInfo?: DeploymentInfo;\n}\n\n/** Threat intelligence information object. */\nexport interface ThreatIntelligenceInformation extends ResourceWithEtag {\n  /** The kind of the entity. */\n  kind: ThreatIntelligenceResourceKindEnum;\n}\n\n/** Represents a Watchlist in Azure Security Insights. */\nexport interface Watchlist extends ResourceWithEtag {\n  /** The id (a Guid) of the watchlist */\n  watchlistId?: string;\n  /** The display name of the watchlist */\n  displayName?: string;\n  /** The provider of the watchlist */\n  provider?: string;\n  /** The filename of the watchlist, called 'source' */\n  source?: string;\n  /** The sourceType of the watchlist */\n  sourceType?: SourceType;\n  /** The time the watchlist was created */\n  created?: Date;\n  /** The last time the watchlist was updated */\n  updated?: Date;\n  /** Describes a user that created the watchlist */\n  createdBy?: UserInfo;\n  /** Describes a user that updated the watchlist */\n  updatedBy?: UserInfo;\n  /** A description of the watchlist */\n  description?: string;\n  /** The type of the watchlist */\n  watchlistType?: string;\n  /** The alias of the watchlist */\n  watchlistAlias?: string;\n  /** A flag that indicates if the watchlist is deleted or not */\n  isDeleted?: boolean;\n  /** List of labels relevant to this watchlist */\n  labels?: string[];\n  /** The default duration of a watchlist (in ISO 8601 duration format) */\n  defaultDuration?: string;\n  /** The tenantId where the watchlist belongs to */\n  tenantId?: string;\n  /** The number of lines in a csv/tsv content to skip before the header */\n  numberOfLinesToSkip?: number;\n  /** The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint */\n  rawContent?: string;\n  /** The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address. */\n  itemsSearchKey?: string;\n  /** The content type of the raw content. Example : text/csv or text/tsv */\n  contentType?: string;\n  /** The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted */\n  uploadStatus?: string;\n}\n\n/** Represents a Watchlist item in Azure Security Insights. */\nexport interface WatchlistItem extends ResourceWithEtag {\n  /** The type of the watchlist item */\n  watchlistItemType?: string;\n  /** The id (a Guid) of the watchlist item */\n  watchlistItemId?: string;\n  /** The tenantId to which the watchlist item belongs to */\n  tenantId?: string;\n  /** A flag that indicates if the watchlist item is deleted or not */\n  isDeleted?: boolean;\n  /** The time the watchlist item was created */\n  created?: Date;\n  /** The last time the watchlist item was updated */\n  updated?: Date;\n  /** Describes a user that created the watchlist item */\n  createdBy?: UserInfo;\n  /** Describes a user that updated the watchlist item */\n  updatedBy?: UserInfo;\n  /** key-value pairs for a watchlist item */\n  itemsKeyValue?: { [propertyName: string]: any };\n  /** key-value pairs for a watchlist item entity mapping */\n  entityMapping?: { [propertyName: string]: any };\n}\n\n/** Data connector */\nexport interface DataConnector extends ResourceWithEtag {\n  /** The data connector kind */\n  kind: DataConnectorKind;\n}\n\n/** Represents MLBehaviorAnalytics alert rule template. */\nexport interface MLBehaviorAnalyticsAlertRuleTemplate\n  extends AlertRuleTemplate {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MLBehaviorAnalytics\";\n  /** the number of alert rules that were created by this template */\n  alertRulesCreatedByTemplateCount?: number;\n  /**\n   * The last time that this alert rule template has been updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastUpdatedDateUTC?: Date;\n  /**\n   * The time that this alert rule template has been added.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdDateUTC?: Date;\n  /** The description of the alert rule template. */\n  description?: string;\n  /** The display name for alert rule template. */\n  displayName?: string;\n  /** The required data sources for this template */\n  requiredDataConnectors?: AlertRuleTemplateDataSource[];\n  /** The alert rule template status. */\n  status?: TemplateStatus;\n  /** The tactics of the alert rule */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n}\n\n/** Represents Fusion alert rule template. */\nexport interface FusionAlertRuleTemplate extends AlertRuleTemplate {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Fusion\";\n  /** the number of alert rules that were created by this template */\n  alertRulesCreatedByTemplateCount?: number;\n  /**\n   * The time that this alert rule template has been added.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdDateUTC?: Date;\n  /**\n   * The time that this alert rule template was last updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastUpdatedDateUTC?: Date;\n  /** The description of the alert rule template. */\n  description?: string;\n  /** The display name for alert rule template. */\n  displayName?: string;\n  /** The required data connectors for this template */\n  requiredDataConnectors?: AlertRuleTemplateDataSource[];\n  /** The alert rule template status. */\n  status?: TemplateStatus;\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n  /** The tactics of the alert rule template */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** All supported source signal configurations consumed in fusion detection. */\n  sourceSettings?: FusionTemplateSourceSetting[];\n}\n\n/** Represents Threat Intelligence alert rule template. */\nexport interface ThreatIntelligenceAlertRuleTemplate extends AlertRuleTemplate {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"ThreatIntelligence\";\n  /** the number of alert rules that were created by this template */\n  alertRulesCreatedByTemplateCount?: number;\n  /**\n   * The last time that this alert rule template has been updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastUpdatedDateUTC?: Date;\n  /**\n   * The time that this alert rule template has been added.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdDateUTC?: Date;\n  /** The description of the alert rule template. */\n  description?: string;\n  /** The display name for alert rule template. */\n  displayName?: string;\n  /** The required data sources for this template */\n  requiredDataConnectors?: AlertRuleTemplateDataSource[];\n  /** The alert rule template status. */\n  status?: TemplateStatus;\n  /** The tactics of the alert rule */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n}\n\n/** Represents MicrosoftSecurityIncidentCreation rule template. */\nexport interface MicrosoftSecurityIncidentCreationAlertRuleTemplate\n  extends AlertRuleTemplate {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftSecurityIncidentCreation\";\n  /** the number of alert rules that were created by this template */\n  alertRulesCreatedByTemplateCount?: number;\n  /**\n   * The last time that this alert rule template has been updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastUpdatedDateUTC?: Date;\n  /**\n   * The time that this alert rule template has been added.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdDateUTC?: Date;\n  /** The description of the alert rule template. */\n  description?: string;\n  /** The display name for alert rule template. */\n  displayName?: string;\n  /** The required data sources for this template */\n  requiredDataConnectors?: AlertRuleTemplateDataSource[];\n  /** The alert rule template status. */\n  status?: TemplateStatus;\n  /** the alerts' displayNames on which the cases will be generated */\n  displayNamesFilter?: string[];\n  /** the alerts' displayNames on which the cases will not be generated */\n  displayNamesExcludeFilter?: string[];\n  /** The alerts' productName on which the cases will be generated */\n  productFilter?: MicrosoftSecurityProductName;\n  /** the alerts' severities on which the cases will be generated */\n  severitiesFilter?: AlertSeverity[];\n}\n\n/** Represents scheduled alert rule template. */\nexport interface ScheduledAlertRuleTemplate extends AlertRuleTemplate {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Scheduled\";\n  /** the number of alert rules that were created by this template */\n  alertRulesCreatedByTemplateCount?: number;\n  /**\n   * The time that this alert rule template has been added.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdDateUTC?: Date;\n  /**\n   * The time that this alert rule template was last updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastUpdatedDateUTC?: Date;\n  /** The description of the alert rule template. */\n  description?: string;\n  /** The display name for alert rule template. */\n  displayName?: string;\n  /** The required data connectors for this template */\n  requiredDataConnectors?: AlertRuleTemplateDataSource[];\n  /** The alert rule template status. */\n  status?: TemplateStatus;\n  /** The query that creates alerts for this rule. */\n  query?: string;\n  /** The frequency (in ISO 8601 duration format) for this alert rule to run. */\n  queryFrequency?: string;\n  /** The period (in ISO 8601 duration format) that this alert rule looks at. */\n  queryPeriod?: string;\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n  /** The operation against the threshold that triggers alert rule. */\n  triggerOperator?: TriggerOperator;\n  /** The threshold triggers this alert rule. */\n  triggerThreshold?: number;\n  /** The tactics of the alert rule template */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>. */\n  version?: string;\n  /** The event grouping settings. */\n  eventGroupingSettings?: EventGroupingSettings;\n  /** Dictionary of string key-value pairs of columns to be attached to the alert */\n  customDetails?: { [propertyName: string]: string };\n  /** Array of the entity mappings of the alert rule */\n  entityMappings?: EntityMapping[];\n  /** The alert details override settings */\n  alertDetailsOverride?: AlertDetailsOverride;\n}\n\n/** Represents NRT alert rule template. */\nexport interface NrtAlertRuleTemplate extends AlertRuleTemplate {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"NRT\";\n  /** the number of alert rules that were created by this template */\n  alertRulesCreatedByTemplateCount?: number;\n  /**\n   * The last time that this alert rule template has been updated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastUpdatedDateUTC?: Date;\n  /**\n   * The time that this alert rule template has been added.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdDateUTC?: Date;\n  /** The description of the alert rule template. */\n  description?: string;\n  /** The display name for alert rule template. */\n  displayName?: string;\n  /** The required data sources for this template */\n  requiredDataConnectors?: AlertRuleTemplateDataSource[];\n  /** The alert rule template status. */\n  status?: TemplateStatus;\n  /** The tactics of the alert rule */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** The query that creates alerts for this rule. */\n  query?: string;\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n  /** The version of this template - in format <a.b.c>, where all are numbers. For example <1.0.2>. */\n  version?: string;\n  /** Dictionary of string key-value pairs of columns to be attached to the alert */\n  customDetails?: { [propertyName: string]: string };\n  /** Array of the entity mappings of the alert rule */\n  entityMappings?: EntityMapping[];\n  /** The alert details override settings */\n  alertDetailsOverride?: AlertDetailsOverride;\n  /** The event grouping settings. */\n  eventGroupingSettings?: EventGroupingSettings;\n}\n\n/** Represents a security alert entity. */\nexport interface SecurityAlert extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"SecurityAlert\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The display name of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertDisplayName?: string;\n  /**\n   * The type name of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertType?: string;\n  /**\n   * Display name of the main entity being reported on.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly compromisedEntity?: string;\n  /**\n   * The confidence level of this alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceLevel?: ConfidenceLevel;\n  /**\n   * The confidence reasons\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceReasons?: SecurityAlertPropertiesConfidenceReasonsItem[];\n  /**\n   * The confidence score of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceScore?: number;\n  /**\n   * The confidence score calculation status, i.e. indicating if score calculation is pending for this alert, not applicable or final.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly confidenceScoreStatus?: ConfidenceScoreStatus;\n  /**\n   * Alert description.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly description?: string;\n  /**\n   * The impact end time of the alert (the time of the last event contributing to the alert).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly endTimeUtc?: Date;\n  /**\n   * Holds the alert intent stage(s) mapping for this alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly intent?: KillChainIntent;\n  /**\n   * The identifier of the alert inside the product which generated the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly providerAlertId?: string;\n  /**\n   * The time the alert was made available for consumption.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly processingEndTime?: Date;\n  /**\n   * The name of a component inside the product which generated the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly productComponentName?: string;\n  /**\n   * The name of the product which published this alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly productName?: string;\n  /**\n   * The version of the product generating the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly productVersion?: string;\n  /**\n   * Manual action items to take to remediate the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly remediationSteps?: string[];\n  /** The severity of the alert */\n  severity?: AlertSeverity;\n  /**\n   * The impact start time of the alert (the time of the first event contributing to the alert).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly startTimeUtc?: Date;\n  /**\n   * The lifecycle status of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly status?: AlertStatus;\n  /**\n   * Holds the product identifier of the alert for the product.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly systemAlertId?: string;\n  /**\n   * The tactics of the alert\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly tactics?: AttackTactic[];\n  /**\n   * The time the alert was generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly timeGenerated?: Date;\n  /**\n   * The name of the vendor that raise the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly vendorName?: string;\n  /**\n   * The uri link of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly alertLink?: string;\n  /**\n   * The list of resource identifiers of the alert.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly resourceIdentifiers?: Record<string, unknown>[];\n}\n\n/** Represents a Hunting bookmark entity. */\nexport interface HuntingBookmark extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Bookmark\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /** The time the bookmark was created */\n  created?: Date;\n  /** Describes a user that created the bookmark */\n  createdBy?: UserInfo;\n  /** The display name of the bookmark */\n  displayName?: string;\n  /** The time of the event */\n  eventTime?: Date;\n  /** List of labels relevant to this bookmark */\n  labels?: string[];\n  /** The notes of the bookmark */\n  notes?: string;\n  /** The query of the bookmark. */\n  query?: string;\n  /** The query result of the bookmark. */\n  queryResult?: string;\n  /** The last time the bookmark was updated */\n  updated?: Date;\n  /** Describes a user that updated the bookmark */\n  updatedBy?: UserInfo;\n  /** Describes an incident that relates to bookmark */\n  incidentInfo?: IncidentInfo;\n}\n\n/** Represents an account entity. */\nexport interface AccountEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Account\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The Azure Active Directory tenant id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly aadTenantId?: string;\n  /**\n   * The Azure Active Directory user id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly aadUserId?: string;\n  /**\n   * The name of the account. This field should hold only the name without any domain added to it, i.e. administrator.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly accountName?: string;\n  /**\n   * The display name of the account.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly displayName?: string;\n  /**\n   * The Host entity id that contains the account in case it is a local account (not domain joined)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n  /**\n   * Determines whether this is a domain account.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isDomainJoined?: boolean;\n  /**\n   * The NetBIOS domain name as it appears in the alert format domain/username. Examples: NT AUTHORITY.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ntDomain?: string;\n  /**\n   * The objectGUID attribute is a single-value attribute that is the unique identifier for the object, assigned by active directory.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly objectGuid?: string;\n  /**\n   * The Azure Active Directory Passport User ID.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly puid?: string;\n  /**\n   * The account security identifier, e.g. S-1-5-18.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sid?: string;\n  /**\n   * The user principal name suffix for the account, in some cases it is also the domain name. Examples: contoso.com.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly upnSuffix?: string;\n  /**\n   * The fully qualified domain DNS name.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly dnsDomain?: string;\n}\n\n/** Represents an azure resource entity. */\nexport interface AzureResourceEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AzureResource\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The azure resource id of the resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly resourceId?: string;\n  /**\n   * The subscription id of the resource\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly subscriptionId?: string;\n}\n\n/** Represents a cloud application entity. */\nexport interface CloudApplicationEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"CloudApplication\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The technical identifier of the application.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly appId?: number;\n  /**\n   * The name of the related cloud application.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly appName?: string;\n  /**\n   * The user defined instance name of the cloud application. It is often used to distinguish between several applications of the same type that a customer has.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly instanceName?: string;\n}\n\n/** Represents a dns entity. */\nexport interface DnsEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"DnsResolution\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * An ip entity id for the dns server resolving the request\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly dnsServerIpEntityId?: string;\n  /**\n   * The name of the dns record associated with the alert\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly domainName?: string;\n  /**\n   * An ip entity id for the dns request client\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostIpAddressEntityId?: string;\n  /**\n   * Ip entity identifiers for the resolved ip address.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ipAddressEntityIds?: string[];\n}\n\n/** Represents a file entity. */\nexport interface FileEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"File\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The full path to the file.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly directory?: string;\n  /**\n   * The file hash entity identifiers associated with this file\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileHashEntityIds?: string[];\n  /**\n   * The file name without path (some alerts might not include path).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileName?: string;\n  /**\n   * The Host entity id which the file belongs to\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n}\n\n/** Represents a file hash entity. */\nexport interface FileHashEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"FileHash\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The hash algorithm type.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly algorithm?: FileHashAlgorithm;\n  /**\n   * The file hash value.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hashValue?: string;\n}\n\n/** Represents a host entity. */\nexport interface HostEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Host\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The azure resource id of the VM.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly azureID?: string;\n  /**\n   * The DNS domain that this host belongs to. Should contain the compete DNS suffix for the domain\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly dnsDomain?: string;\n  /**\n   * The hostname without the domain suffix.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostName?: string;\n  /**\n   * Determines whether this host belongs to a domain.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isDomainJoined?: boolean;\n  /**\n   * The host name (pre-windows2000).\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly netBiosName?: string;\n  /**\n   * The NT domain that this host belongs to.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ntDomain?: string;\n  /**\n   * The OMS agent id, if the host has OMS agent installed.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly omsAgentID?: string;\n  /** The operating system type. */\n  osFamily?: OSFamily;\n  /**\n   * A free text representation of the operating system. This field is meant to hold specific versions the are more fine grained than OSFamily or future values not supported by OSFamily enumeration\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly osVersion?: string;\n}\n\n/** Represents an IoT device entity. */\nexport interface IoTDeviceEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"IoTDevice\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The ID of the IoT Device in the IoT Hub\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceId?: string;\n  /**\n   * The friendly name of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceName?: string;\n  /**\n   * The source of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly source?: string;\n  /**\n   * The ID of the security agent running on the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly iotSecurityAgentId?: string;\n  /**\n   * The type of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceType?: string;\n  /**\n   * The vendor of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly vendor?: string;\n  /**\n   * The ID of the edge device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly edgeId?: string;\n  /**\n   * The MAC address of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly macAddress?: string;\n  /**\n   * The model of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly model?: string;\n  /**\n   * The serial number of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly serialNumber?: string;\n  /**\n   * The firmware version of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly firmwareVersion?: string;\n  /**\n   * The operating system of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly operatingSystem?: string;\n  /**\n   * The AzureResource entity id of the IoT Hub\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly iotHubEntityId?: string;\n  /**\n   * The Host entity id of this device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n  /**\n   * The IP entity if of this device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ipAddressEntityId?: string;\n  /**\n   * A list of TI contexts attached to the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatIntelligence?: ThreatIntelligence[];\n  /**\n   * A list of protocols of the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly protocols?: string[];\n  /**\n   * A list of owners of the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly owners?: string[];\n  /**\n   * A list of Nic entity ids of the IoTDevice entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly nicEntityIds?: string[];\n  /**\n   * The site of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly site?: string;\n  /**\n   * The zone location of the device within a site\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly zone?: string;\n  /**\n   * The sensor the device is monitored by\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sensor?: string;\n  /**\n   * The subType of the device ('PLC', 'HMI', 'EWS', etc.)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly deviceSubType?: string;\n  /** Device importance, determines if the device classified as 'crown jewel' */\n  importance?: DeviceImportance;\n  /**\n   * The Purdue Layer of the device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly purdueLayer?: string;\n  /**\n   * Determines whether the device classified as authorized device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isAuthorized?: boolean;\n  /**\n   * Determines whether the device classified as programming device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isProgramming?: boolean;\n  /**\n   * Is the device classified as a scanner device\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isScanner?: boolean;\n}\n\n/** Represents an ip entity. */\nexport interface IpEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Ip\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The IP address as string, e.g. 127.0.0.1 (either in Ipv4 or Ipv6)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly address?: string;\n  /**\n   * The geo-location context attached to the ip entity\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly location?: GeoLocation;\n  /**\n   * A list of TI contexts attached to the ip entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatIntelligence?: ThreatIntelligence[];\n}\n\n/** Represents a mailbox entity. */\nexport interface MailboxEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Mailbox\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The mailbox's primary address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly mailboxPrimaryAddress?: string;\n  /**\n   * The mailbox's display name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly displayName?: string;\n  /**\n   * The mailbox's UPN\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly upn?: string;\n  /**\n   * The AzureAD identifier of mailbox. Similar to AadUserId in account entity but this property is specific to mailbox object on office side\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly externalDirectoryObjectId?: string;\n}\n\n/** Represents a mail cluster entity. */\nexport interface MailClusterEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MailCluster\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The mail message IDs that are part of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly networkMessageIds?: string[];\n  /**\n   * Count of mail messages by DeliveryStatus string representation\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countByDeliveryStatus?: Record<string, unknown>;\n  /**\n   * Count of mail messages by ThreatType string representation\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countByThreatType?: Record<string, unknown>;\n  /**\n   * Count of mail messages by ProtectionStatus string representation\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly countByProtectionStatus?: Record<string, unknown>;\n  /**\n   * The threats of mail messages that are part of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threats?: string[];\n  /**\n   * The query that was used to identify the messages of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly query?: string;\n  /**\n   * The query time\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly queryTime?: Date;\n  /**\n   * The number of mail messages that are part of the mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly mailCount?: number;\n  /**\n   * Is this a volume anomaly mail cluster\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isVolumeAnomaly?: boolean;\n  /**\n   * The source of the mail cluster (default is 'O365 ATP')\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly source?: string;\n  /**\n   * The id of the cluster source\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterSourceIdentifier?: string;\n  /**\n   * The type of the cluster source\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterSourceType?: string;\n  /**\n   * The cluster query start time\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterQueryStartTime?: Date;\n  /**\n   * The cluster query end time\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterQueryEndTime?: Date;\n  /**\n   * The cluster group\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly clusterGroup?: string;\n}\n\n/** Represents a mail message entity. */\nexport interface MailMessageEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MailMessage\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The File entity ids of this mail message's attachments\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileEntityIds?: string[];\n  /**\n   * The recipient of this mail message. Note that in case of multiple recipients the mail message is forked and each copy has one recipient\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly recipient?: string;\n  /**\n   * The Urls contained in this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly urls?: string[];\n  /**\n   * The threats of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threats?: string[];\n  /**\n   * The p1 sender's email address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p1Sender?: string;\n  /**\n   * The p1 sender's display name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p1SenderDisplayName?: string;\n  /**\n   * The p1 sender's domain\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p1SenderDomain?: string;\n  /**\n   * The sender's IP address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly senderIP?: string;\n  /**\n   * The p2 sender's email address\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p2Sender?: string;\n  /**\n   * The p2 sender's display name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p2SenderDisplayName?: string;\n  /**\n   * The p2 sender's domain\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly p2SenderDomain?: string;\n  /**\n   * The receive date of this message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly receiveDate?: Date;\n  /**\n   * The network message id of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly networkMessageId?: string;\n  /**\n   * The internet message id of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly internetMessageId?: string;\n  /**\n   * The subject of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly subject?: string;\n  /**\n   * The language of this mail message\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly language?: string;\n  /**\n   * The threat detection methods\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly threatDetectionMethods?: string[];\n  /** The bodyFingerprintBin1 */\n  bodyFingerprintBin1?: number;\n  /** The bodyFingerprintBin2 */\n  bodyFingerprintBin2?: number;\n  /** The bodyFingerprintBin3 */\n  bodyFingerprintBin3?: number;\n  /** The bodyFingerprintBin4 */\n  bodyFingerprintBin4?: number;\n  /** The bodyFingerprintBin5 */\n  bodyFingerprintBin5?: number;\n  /** The directionality of this mail message */\n  antispamDirection?: AntispamMailDirection;\n  /** The delivery action of this mail message like Delivered, Blocked, Replaced etc */\n  deliveryAction?: DeliveryAction;\n  /** The delivery location of this mail message like Inbox, JunkFolder etc */\n  deliveryLocation?: DeliveryLocation;\n}\n\n/** Represents a malware entity. */\nexport interface MalwareEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Malware\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The malware category by the vendor, e.g. Trojan\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly category?: string;\n  /**\n   * List of linked file entity identifiers on which the malware was found\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly fileEntityIds?: string[];\n  /**\n   * The malware name by the vendor, e.g. Win32/Toga!rfn\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly malwareName?: string;\n  /**\n   * List of linked process entity identifiers on which the malware was found.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly processEntityIds?: string[];\n}\n\n/** Represents a process entity. */\nexport interface ProcessEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Process\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The account entity id running the processes.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly accountEntityId?: string;\n  /**\n   * The command line used to create the process\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly commandLine?: string;\n  /**\n   * The time when the process started to run\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly creationTimeUtc?: Date;\n  /** The elevation token associated with the process. */\n  elevationToken?: ElevationToken;\n  /**\n   * The host entity id on which the process was running\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostEntityId?: string;\n  /**\n   * The session entity id in which the process was running\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hostLogonSessionEntityId?: string;\n  /**\n   * Image file entity id\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly imageFileEntityId?: string;\n  /**\n   * The parent process entity id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly parentProcessEntityId?: string;\n  /**\n   * The process ID\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly processId?: string;\n}\n\n/** Represents a registry key entity. */\nexport interface RegistryKeyEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"RegistryKey\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * the hive that holds the registry key.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly hive?: RegistryHive;\n  /**\n   * The registry key path.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly key?: string;\n}\n\n/** Represents a registry value entity. */\nexport interface RegistryValueEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"RegistryValue\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The registry key entity id.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly keyEntityId?: string;\n  /**\n   * String formatted representation of the value data.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly valueData?: string;\n  /**\n   * The registry value name.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly valueName?: string;\n  /**\n   * Specifies the data types to use when storing values in the registry, or identifies the data type of a value in the registry.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly valueType?: RegistryValueKind;\n}\n\n/** Represents a security group entity. */\nexport interface SecurityGroupEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"SecurityGroup\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The group distinguished name\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly distinguishedName?: string;\n  /**\n   * A single-value attribute that is the unique identifier for the object, assigned by active directory.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly objectGuid?: string;\n  /**\n   * The SID attribute is a single-value attribute that specifies the security identifier (SID) of the group\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sid?: string;\n}\n\n/** Represents a submission mail entity. */\nexport interface SubmissionMailEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"SubmissionMail\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The network message id of email to which submission belongs\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly networkMessageId?: string;\n  /**\n   * The submission id\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly submissionId?: string;\n  /**\n   * The submitter\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly submitter?: string;\n  /**\n   * The submission date\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly submissionDate?: Date;\n  /**\n   * The Time stamp when the message is received (Mail)\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly timestamp?: Date;\n  /**\n   * The recipient of the mail\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly recipient?: string;\n  /**\n   * The sender of the mail\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly sender?: string;\n  /**\n   * The sender's IP\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly senderIp?: string;\n  /**\n   * The subject of submission mail\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly subject?: string;\n  /**\n   * The submission type for the given instance. This maps to Junk, Phish, Malware or NotJunk.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly reportType?: string;\n}\n\n/** Represents a url entity. */\nexport interface UrlEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Url\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * A full URL the entity points to\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly url?: string;\n}\n\n/** Represents an network interface entity. */\nexport interface NicEntity extends Entity {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Nic\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /**\n   * The MAC address of this network interface\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly macAddress?: string;\n  /**\n   * The IP entity id of this network interface\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly ipAddressEntityId?: string;\n  /**\n   * A list of VLANs of the network interface entity.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly vlans?: string[];\n}\n\n/** Represents Activity entity query. */\nexport interface ActivityEntityQueryTemplate extends EntityQueryTemplate {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Activity\";\n  /** The entity query title */\n  title?: string;\n  /** The entity query content to display in timeline */\n  content?: string;\n  /** The entity query description */\n  description?: string;\n  /** The Activity query definitions */\n  queryDefinitions?: ActivityEntityQueryTemplatePropertiesQueryDefinitions;\n  /** List of required data types for the given entity query template */\n  dataTypes?: DataTypeDefinitions[];\n  /** The type of the query's source entity */\n  inputEntityType?: EntityType;\n  /** List of the fields of the source entity that are required to run the query */\n  requiredInputFieldsSets?: string[][];\n  /** The query applied only to entities matching to all filters */\n  entitiesFilter?: { [propertyName: string]: string[] };\n}\n\n/** MLBehaviorAnalytics alert rule template properties. */\nexport interface MLBehaviorAnalyticsAlertRuleTemplateProperties\n  extends AlertRuleTemplateWithMitreProperties {\n  /** The severity for alerts created by this alert rule. */\n  severity: AlertSeverity;\n}\n\n/** Threat Intelligence alert rule template properties */\nexport interface ThreatIntelligenceAlertRuleTemplateProperties\n  extends AlertRuleTemplateWithMitreProperties {\n  /** The severity for alerts created by this alert rule. */\n  severity: AlertSeverity;\n}\n\nexport interface PermissionsCustomsItem extends Customs {}\n\n/** Represents MLBehaviorAnalytics alert rule. */\nexport interface MLBehaviorAnalyticsAlertRule extends AlertRule {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MLBehaviorAnalytics\";\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /**\n   * The description of the alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly description?: string;\n  /**\n   * The display name for alerts created by this alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly displayName?: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The last time that this alert rule has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n  /**\n   * The severity for alerts created by this alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly severity?: AlertSeverity;\n  /**\n   * The tactics of the alert rule\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly tactics?: AttackTactic[];\n  /**\n   * The techniques of the alert rule\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly techniques?: string[];\n}\n\n/** Represents Fusion alert rule. */\nexport interface FusionAlertRule extends AlertRule {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Fusion\";\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /**\n   * The description of the alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly description?: string;\n  /**\n   * The display name for alerts created by this alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly displayName?: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled?: boolean;\n  /** Configuration for all supported source signals in fusion detection. */\n  sourceSettings?: FusionSourceSettings[];\n  /** Configuration to exclude scenarios in fusion detection. */\n  scenarioExclusionPatterns?: FusionScenarioExclusionPattern[];\n  /**\n   * The last time that this alert has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n  /**\n   * The severity for alerts created by this alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly severity?: AlertSeverity;\n  /**\n   * The tactics of the alert rule\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly tactics?: AttackTactic[];\n  /**\n   * The techniques of the alert rule\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly techniques?: string[];\n}\n\n/** Represents Threat Intelligence alert rule. */\nexport interface ThreatIntelligenceAlertRule extends AlertRule {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"ThreatIntelligence\";\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /**\n   * The description of the alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly description?: string;\n  /**\n   * The display name for alerts created by this alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly displayName?: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The last time that this alert has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n  /**\n   * The severity for alerts created by this alert rule.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly severity?: AlertSeverity;\n  /**\n   * The tactics of the alert rule\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly tactics?: AttackTactic[];\n  /**\n   * The techniques of the alert rule\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly techniques?: string[];\n}\n\n/** Represents MicrosoftSecurityIncidentCreation rule. */\nexport interface MicrosoftSecurityIncidentCreationAlertRule extends AlertRule {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftSecurityIncidentCreation\";\n  /** the alerts' displayNames on which the cases will be generated */\n  displayNamesFilter?: string[];\n  /** the alerts' displayNames on which the cases will not be generated */\n  displayNamesExcludeFilter?: string[];\n  /** The alerts' productName on which the cases will be generated */\n  productFilter?: MicrosoftSecurityProductName;\n  /** the alerts' severities on which the cases will be generated */\n  severitiesFilter?: AlertSeverity[];\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /** The description of the alert rule. */\n  description?: string;\n  /** The display name for alerts created by this alert rule. */\n  displayName?: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The last time that this alert has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n}\n\n/** Represents scheduled alert rule. */\nexport interface ScheduledAlertRule extends AlertRule {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Scheduled\";\n  /** The query that creates alerts for this rule. */\n  query?: string;\n  /** The frequency (in ISO 8601 duration format) for this alert rule to run. */\n  queryFrequency?: string;\n  /** The period (in ISO 8601 duration format) that this alert rule looks at. */\n  queryPeriod?: string;\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n  /** The operation against the threshold that triggers alert rule. */\n  triggerOperator?: TriggerOperator;\n  /** The threshold triggers this alert rule. */\n  triggerThreshold?: number;\n  /** The event grouping settings. */\n  eventGroupingSettings?: EventGroupingSettings;\n  /** Dictionary of string key-value pairs of columns to be attached to the alert */\n  customDetails?: { [propertyName: string]: string };\n  /** Array of the entity mappings of the alert rule */\n  entityMappings?: EntityMapping[];\n  /** The alert details override settings */\n  alertDetailsOverride?: AlertDetailsOverride;\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /** The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2> */\n  templateVersion?: string;\n  /** The description of the alert rule. */\n  description?: string;\n  /** The display name for alerts created by this alert rule. */\n  displayName?: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The last time that this alert rule has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n  /** The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. */\n  suppressionDuration?: string;\n  /** Determines whether the suppression for this alert rule is enabled or disabled. */\n  suppressionEnabled?: boolean;\n  /** The tactics of the alert rule */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** The settings of the incidents that created from alerts triggered by this analytics rule */\n  incidentConfiguration?: IncidentConfiguration;\n}\n\n/** Represents NRT alert rule. */\nexport interface NrtAlertRule extends AlertRule {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"NRT\";\n  /** The Name of the alert rule template used to create this rule. */\n  alertRuleTemplateName?: string;\n  /** The version of the alert rule template used to create this rule - in format <a.b.c>, where all are numbers, for example 0 <1.0.2> */\n  templateVersion?: string;\n  /** The description of the alert rule. */\n  description?: string;\n  /** The query that creates alerts for this rule. */\n  query?: string;\n  /** The tactics of the alert rule */\n  tactics?: AttackTactic[];\n  /** The techniques of the alert rule */\n  techniques?: string[];\n  /** The display name for alerts created by this alert rule. */\n  displayName?: string;\n  /** Determines whether this alert rule is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The last time that this alert rule has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n  /** The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. */\n  suppressionDuration?: string;\n  /** Determines whether the suppression for this alert rule is enabled or disabled. */\n  suppressionEnabled?: boolean;\n  /** The severity for alerts created by this alert rule. */\n  severity?: AlertSeverity;\n  /** The settings of the incidents that created from alerts triggered by this analytics rule */\n  incidentConfiguration?: IncidentConfiguration;\n  /** Dictionary of string key-value pairs of columns to be attached to the alert */\n  customDetails?: { [propertyName: string]: string };\n  /** Array of the entity mappings of the alert rule */\n  entityMappings?: EntityMapping[];\n  /** The alert details override settings */\n  alertDetailsOverride?: AlertDetailsOverride;\n  /** The event grouping settings. */\n  eventGroupingSettings?: EventGroupingSettings;\n}\n\n/** Represents Expansion entity query. */\nexport interface ExpansionEntityQuery extends EntityQuery {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Expansion\";\n  /** List of the data sources that are required to run the query */\n  dataSources?: string[];\n  /** The query display name */\n  displayName?: string;\n  /** The type of the query's source entity */\n  inputEntityType?: EntityType;\n  /** List of the fields of the source entity that are required to run the query */\n  inputFields?: string[];\n  /** List of the desired output types to be constructed from the result */\n  outputEntityTypes?: EntityType[];\n  /** The template query string to be parsed and formatted */\n  queryTemplate?: string;\n}\n\n/** Represents Activity entity query. */\nexport interface ActivityEntityQuery extends EntityQuery {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Activity\";\n  /** The entity query title */\n  title?: string;\n  /** The entity query content to display in timeline */\n  content?: string;\n  /** The entity query description */\n  description?: string;\n  /** The Activity query definitions */\n  queryDefinitions?: ActivityEntityQueriesPropertiesQueryDefinitions;\n  /** The type of the query's source entity */\n  inputEntityType?: EntityType;\n  /** List of the fields of the source entity that are required to run the query */\n  requiredInputFieldsSets?: string[][];\n  /** The query applied only to entities matching to all filters */\n  entitiesFilter?: { [propertyName: string]: string[] };\n  /** The template id this activity was created from */\n  templateName?: string;\n  /** Determines whether this activity is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The time the activity was created\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdTimeUtc?: Date;\n  /**\n   * The last time the activity was updated\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedTimeUtc?: Date;\n}\n\n/** Represents Activity entity query. */\nexport interface ActivityCustomEntityQuery extends CustomEntityQuery {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Activity\";\n  /** The entity query title */\n  title?: string;\n  /** The entity query content to display in timeline */\n  content?: string;\n  /** The entity query description */\n  description?: string;\n  /** The Activity query definitions */\n  queryDefinitions?: ActivityEntityQueriesPropertiesQueryDefinitions;\n  /** The type of the query's source entity */\n  inputEntityType?: EntityType;\n  /** List of the fields of the source entity that are required to run the query */\n  requiredInputFieldsSets?: string[][];\n  /** The query applied only to entities matching to all filters */\n  entitiesFilter?: { [propertyName: string]: string[] };\n  /** The template id this activity was created from */\n  templateName?: string;\n  /** Determines whether this activity is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The time the activity was created\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly createdTimeUtc?: Date;\n  /**\n   * The last time the activity was updated\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedTimeUtc?: Date;\n}\n\n/** Represents Anomaly Security ML Analytics Settings */\nexport interface AnomalySecurityMLAnalyticsSettings\n  extends SecurityMLAnalyticsSetting {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Anomaly\";\n  /** The description of the SecurityMLAnalyticsSettings. */\n  description?: string;\n  /** The display name for settings created by this SecurityMLAnalyticsSettings. */\n  displayName?: string;\n  /** Determines whether this settings is enabled or disabled. */\n  enabled?: boolean;\n  /**\n   * The last time that this SecurityMLAnalyticsSettings has been modified.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly lastModifiedUtc?: Date;\n  /** The required data sources for this SecurityMLAnalyticsSettings */\n  requiredDataConnectors?: SecurityMLAnalyticsSettingsDataSource[];\n  /** The tactics of the SecurityMLAnalyticsSettings */\n  tactics?: AttackTactic[];\n  /** The techniques of the SecurityMLAnalyticsSettings */\n  techniques?: string[];\n  /** The anomaly version of the AnomalySecurityMLAnalyticsSettings. */\n  anomalyVersion?: string;\n  /** The customizable observations of the AnomalySecurityMLAnalyticsSettings. */\n  customizableObservations?: Record<string, unknown>;\n  /** The frequency that this SecurityMLAnalyticsSettings will be run. */\n  frequency?: string;\n  /** The anomaly SecurityMLAnalyticsSettings status */\n  settingsStatus?: SettingsStatus;\n  /** Determines whether this anomaly security ml analytics settings is a default settings */\n  isDefaultSettings?: boolean;\n  /** The anomaly settings version of the Anomaly security ml analytics settings that dictates whether job version gets updated or not. */\n  anomalySettingsVersion?: number;\n  /** The anomaly settings definition Id */\n  settingsDefinitionId?: string;\n}\n\n/** Settings with single toggle. */\nexport interface Anomalies extends Settings {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Anomalies\";\n  /**\n   * Determines whether the setting is enable or disabled.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isEnabled?: boolean;\n}\n\n/** Settings with single toggle. */\nexport interface EyesOn extends Settings {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"EyesOn\";\n  /**\n   * Determines whether the setting is enable or disabled.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly isEnabled?: boolean;\n}\n\n/** Settings with single toggle. */\nexport interface EntityAnalytics extends Settings {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"EntityAnalytics\";\n  /** The relevant entity providers that are synced */\n  entityProviders?: EntityProviders[];\n}\n\n/** Settings with single toggle. */\nexport interface Ueba extends Settings {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Ueba\";\n  /** The relevant data sources that enriched by ueba */\n  dataSources?: UebaDataSources[];\n}\n\n/** Threat intelligence indicator entity. */\nexport interface ThreatIntelligenceIndicatorModel\n  extends ThreatIntelligenceInformation {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"indicator\";\n  /**\n   * A bag of custom fields that should be part of the entity and will be presented to the user.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly additionalData?: { [propertyName: string]: Record<string, unknown> };\n  /**\n   * The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.\n   * NOTE: This property will not be serialized. It can only be populated by the server.\n   */\n  readonly friendlyName?: string;\n  /** List of tags */\n  threatIntelligenceTags?: string[];\n  /** Last updated time in UTC */\n  lastUpdatedTimeUtc?: string;\n  /** Source of a threat intelligence entity */\n  source?: string;\n  /** Display name of a threat intelligence entity */\n  displayName?: string;\n  /** Description of a threat intelligence entity */\n  description?: string;\n  /** Indicator types of threat intelligence entities */\n  indicatorTypes?: string[];\n  /** Pattern of a threat intelligence entity */\n  pattern?: string;\n  /** Pattern type of a threat intelligence entity */\n  patternType?: string;\n  /** Pattern version of a threat intelligence entity */\n  patternVersion?: string;\n  /** Kill chain phases */\n  killChainPhases?: ThreatIntelligenceKillChainPhase[];\n  /** Parsed patterns */\n  parsedPattern?: ThreatIntelligenceParsedPattern[];\n  /** External ID of threat intelligence entity */\n  externalId?: string;\n  /** Created by reference of threat intelligence entity */\n  createdByRef?: string;\n  /** Is threat intelligence entity defanged */\n  defanged?: boolean;\n  /** External last updated time in UTC */\n  externalLastUpdatedTimeUtc?: string;\n  /** External References */\n  externalReferences?: ThreatIntelligenceExternalReference[];\n  /** Granular Markings */\n  granularMarkings?: ThreatIntelligenceGranularMarkingModel[];\n  /** Labels  of threat intelligence entity */\n  labels?: string[];\n  /** Is threat intelligence entity revoked */\n  revoked?: boolean;\n  /** Confidence of threat intelligence entity */\n  confidence?: number;\n  /** Threat intelligence entity object marking references */\n  objectMarkingRefs?: string[];\n  /** Language of threat intelligence entity */\n  language?: string;\n  /** Threat types */\n  threatTypes?: string[];\n  /** Valid from */\n  validFrom?: string;\n  /** Valid until */\n  validUntil?: string;\n  /** Created by */\n  created?: string;\n  /** Modified by */\n  modified?: string;\n  /** Extensions map */\n  extensions?: { [propertyName: string]: any };\n}\n\n/** Represents AAD (Azure Active Directory) data connector. */\nexport interface AADDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AzureActiveDirectory\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n}\n\n/** Represents Microsoft Threat Intelligence data connector. */\nexport interface MstiDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftThreatIntelligence\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: MstiDataConnectorDataTypes;\n}\n\n/** Represents MTP (Microsoft Threat Protection) data connector. */\nexport interface MTPDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftThreatProtection\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: MTPDataConnectorDataTypes;\n}\n\n/** Represents AATP (Azure Advanced Threat Protection) data connector. */\nexport interface AatpDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AzureAdvancedThreatProtection\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n}\n\n/** Represents ASC (Azure Security Center) data connector. */\nexport interface ASCDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AzureSecurityCenter\";\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n  /** The subscription id to connect to, and get the data from. */\n  subscriptionId?: string;\n}\n\n/** Represents Amazon Web Services CloudTrail data connector. */\nexport interface AwsCloudTrailDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AmazonWebServicesCloudTrail\";\n  /** The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account. */\n  awsRoleArn?: string;\n  /** The available data types for the connector. */\n  dataTypes?: AwsCloudTrailDataConnectorDataTypes;\n}\n\n/** Represents Amazon Web Services S3 data connector. */\nexport interface AwsS3DataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"AmazonWebServicesS3\";\n  /** The logs destination table name in LogAnalytics. */\n  destinationTable?: string;\n  /** The AWS sqs urls for the connector. */\n  sqsUrls?: string[];\n  /** The Aws Role Arn that is used to access the Aws account. */\n  roleArn?: string;\n  /** The available data types for the connector. */\n  dataTypes?: AwsS3DataConnectorDataTypes;\n}\n\n/** Represents MCAS (Microsoft Cloud App Security) data connector. */\nexport interface McasDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftCloudAppSecurity\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: McasDataConnectorDataTypes;\n}\n\n/** Represents Dynamics365 data connector. */\nexport interface Dynamics365DataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Dynamics365\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: Dynamics365DataConnectorDataTypes;\n}\n\n/** Represents OfficeATP (Office 365 Advanced Threat Protection) data connector. */\nexport interface OfficeATPDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"OfficeATP\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n}\n\n/** Represents Office Microsoft Project data connector. */\nexport interface Office365ProjectDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Office365Project\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: Office365ProjectConnectorDataTypes;\n}\n\n/** Represents Office Microsoft PowerBI data connector. */\nexport interface OfficePowerBIDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"OfficePowerBI\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: OfficePowerBIConnectorDataTypes;\n}\n\n/** Represents OfficeIRM (Microsoft Insider Risk Management) data connector. */\nexport interface OfficeIRMDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"OfficeIRM\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n}\n\n/** Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector. */\nexport interface MdatpDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"MicrosoftDefenderAdvancedThreatProtection\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n}\n\n/** Represents office data connector. */\nexport interface OfficeDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"Office365\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The available data types for the connector. */\n  dataTypes?: OfficeDataConnectorDataTypes;\n}\n\n/** Represents threat intelligence data connector. */\nexport interface TIDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"ThreatIntelligence\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The lookback period for the feed to be imported. */\n  tipLookbackPeriod?: Date;\n  /** The available data types for the connector. */\n  dataTypes?: TIDataConnectorDataTypes;\n}\n\n/** Data connector to pull Threat intelligence data from TAXII 2.0/2.1 server */\nexport interface TiTaxiiDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"ThreatIntelligenceTaxii\";\n  /** The tenant id to connect to, and get the data from. */\n  tenantId?: string;\n  /** The workspace id. */\n  workspaceId?: string;\n  /** The friendly name for the TAXII server. */\n  friendlyName?: string;\n  /** The API root for the TAXII server. */\n  taxiiServer?: string;\n  /** The collection id of the TAXII server. */\n  collectionId?: string;\n  /** The userName for the TAXII server. */\n  userName?: string;\n  /** The password for the TAXII server. */\n  password?: string;\n  /** The lookback period for the TAXII server. */\n  taxiiLookbackPeriod?: Date;\n  /** The polling frequency for the TAXII server. */\n  pollingFrequency?: PollingFrequency;\n  /** The available data types for Threat Intelligence TAXII data connector. */\n  dataTypes?: TiTaxiiDataConnectorDataTypes;\n}\n\n/** Represents IoT data connector. */\nexport interface IoTDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"IOT\";\n  /** The available data types for the connector. */\n  dataTypes?: AlertsDataTypeOfDataConnector;\n  /** The subscription id to connect to, and get the data from. */\n  subscriptionId?: string;\n}\n\n/** Represents Codeless UI data connector. */\nexport interface CodelessUiDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"GenericUI\";\n  /** Config to describe the instructions blade */\n  connectorUiConfig?: CodelessUiConnectorConfigProperties;\n}\n\n/** Represents Codeless API Polling data connector. */\nexport interface CodelessApiPollingDataConnector extends DataConnector {\n  /** Polymorphic discriminator, which specifies the different types this object can be */\n  kind: \"APIPolling\";\n  /** Config to describe the instructions blade */\n  connectorUiConfig?: CodelessUiConnectorConfigProperties;\n  /** Config to describe the polling instructions */\n  pollingConfig?: CodelessConnectorPollingConfigProperties;\n}\n\n/** Defines headers for Watchlists_delete operation. */\nexport interface WatchlistsDeleteHeaders {\n  /** Contains the status URL on which clients are expected to poll the status of the delete operation. */\n  azureAsyncOperation?: string;\n}\n\n/** Defines headers for Watchlists_createOrUpdate operation. */\nexport interface WatchlistsCreateOrUpdateHeaders {\n  /** Contains the status URL on which clients are expected to poll the status of the operation. */\n  azureAsyncOperation?: string;\n}\n\n/** Known values of {@link AlertRuleKind} that the service accepts. */\nexport enum KnownAlertRuleKind {\n  /** Scheduled */\n  Scheduled = \"Scheduled\",\n  /** MicrosoftSecurityIncidentCreation */\n  MicrosoftSecurityIncidentCreation = \"MicrosoftSecurityIncidentCreation\",\n  /** Fusion */\n  Fusion = \"Fusion\",\n  /** MLBehaviorAnalytics */\n  MLBehaviorAnalytics = \"MLBehaviorAnalytics\",\n  /** ThreatIntelligence */\n  ThreatIntelligence = \"ThreatIntelligence\",\n  /** NRT */\n  NRT = \"NRT\"\n}\n\n/**\n * Defines values for AlertRuleKind. \\\n * {@link KnownAlertRuleKind} can be used interchangeably with AlertRuleKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Scheduled** \\\n * **MicrosoftSecurityIncidentCreation** \\\n * **Fusion** \\\n * **MLBehaviorAnalytics** \\\n * **ThreatIntelligence** \\\n * **NRT**\n */\nexport type AlertRuleKind = string;\n\n/** Known values of {@link CreatedByType} that the service accepts. */\nexport enum KnownCreatedByType {\n  /** User */\n  User = \"User\",\n  /** Application */\n  Application = \"Application\",\n  /** ManagedIdentity */\n  ManagedIdentity = \"ManagedIdentity\",\n  /** Key */\n  Key = \"Key\"\n}\n\n/**\n * Defines values for CreatedByType. \\\n * {@link KnownCreatedByType} can be used interchangeably with CreatedByType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **User** \\\n * **Application** \\\n * **ManagedIdentity** \\\n * **Key**\n */\nexport type CreatedByType = string;\n\n/** Known values of {@link TriggersOn} that the service accepts. */\nexport enum KnownTriggersOn {\n  /** Trigger on Incidents */\n  Incidents = \"Incidents\",\n  /** Trigger on Alerts */\n  Alerts = \"Alerts\"\n}\n\n/**\n * Defines values for TriggersOn. \\\n * {@link KnownTriggersOn} can be used interchangeably with TriggersOn,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Incidents**: Trigger on Incidents \\\n * **Alerts**: Trigger on Alerts\n */\nexport type TriggersOn = string;\n\n/** Known values of {@link TriggersWhen} that the service accepts. */\nexport enum KnownTriggersWhen {\n  /** Trigger on created objects */\n  Created = \"Created\",\n  /** Trigger on updated objects */\n  Updated = \"Updated\"\n}\n\n/**\n * Defines values for TriggersWhen. \\\n * {@link KnownTriggersWhen} can be used interchangeably with TriggersWhen,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Created**: Trigger on created objects \\\n * **Updated**: Trigger on updated objects\n */\nexport type TriggersWhen = string;\n\n/** Known values of {@link ConditionType} that the service accepts. */\nexport enum KnownConditionType {\n  /** Evaluate an object property value */\n  Property = \"Property\",\n  /** Evaluate an object array property value */\n  PropertyArray = \"PropertyArray\",\n  /** Evaluate an object property changed value */\n  PropertyChanged = \"PropertyChanged\",\n  /** Evaluate an object array property changed value */\n  PropertyArrayChanged = \"PropertyArrayChanged\",\n  /** Apply a boolean operator (e.g AND, OR) to conditions */\n  Boolean = \"Boolean\"\n}\n\n/**\n * Defines values for ConditionType. \\\n * {@link KnownConditionType} can be used interchangeably with ConditionType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Property**: Evaluate an object property value \\\n * **PropertyArray**: Evaluate an object array property value \\\n * **PropertyChanged**: Evaluate an object property changed value \\\n * **PropertyArrayChanged**: Evaluate an object array property changed value \\\n * **Boolean**: Apply a boolean operator (e.g AND, OR) to conditions\n */\nexport type ConditionType = string;\n\n/** Known values of {@link ActionType} that the service accepts. */\nexport enum KnownActionType {\n  /** Modify an object's properties */\n  ModifyProperties = \"ModifyProperties\",\n  /** Run a playbook on an object */\n  RunPlaybook = \"RunPlaybook\"\n}\n\n/**\n * Defines values for ActionType. \\\n * {@link KnownActionType} can be used interchangeably with ActionType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **ModifyProperties**: Modify an object's properties \\\n * **RunPlaybook**: Run a playbook on an object\n */\nexport type ActionType = string;\n\n/** Known values of {@link IncidentSeverity} that the service accepts. */\nexport enum KnownIncidentSeverity {\n  /** High severity */\n  High = \"High\",\n  /** Medium severity */\n  Medium = \"Medium\",\n  /** Low severity */\n  Low = \"Low\",\n  /** Informational severity */\n  Informational = \"Informational\"\n}\n\n/**\n * Defines values for IncidentSeverity. \\\n * {@link KnownIncidentSeverity} can be used interchangeably with IncidentSeverity,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **High**: High severity \\\n * **Medium**: Medium severity \\\n * **Low**: Low severity \\\n * **Informational**: Informational severity\n */\nexport type IncidentSeverity = string;\n\n/** Known values of {@link AttackTactic} that the service accepts. */\nexport enum KnownAttackTactic {\n  /** Reconnaissance */\n  Reconnaissance = \"Reconnaissance\",\n  /** ResourceDevelopment */\n  ResourceDevelopment = \"ResourceDevelopment\",\n  /** InitialAccess */\n  InitialAccess = \"InitialAccess\",\n  /** Execution */\n  Execution = \"Execution\",\n  /** Persistence */\n  Persistence = \"Persistence\",\n  /** PrivilegeEscalation */\n  PrivilegeEscalation = \"PrivilegeEscalation\",\n  /** DefenseEvasion */\n  DefenseEvasion = \"DefenseEvasion\",\n  /** CredentialAccess */\n  CredentialAccess = \"CredentialAccess\",\n  /** Discovery */\n  Discovery = \"Discovery\",\n  /** LateralMovement */\n  LateralMovement = \"LateralMovement\",\n  /** Collection */\n  Collection = \"Collection\",\n  /** Exfiltration */\n  Exfiltration = \"Exfiltration\",\n  /** CommandAndControl */\n  CommandAndControl = \"CommandAndControl\",\n  /** Impact */\n  Impact = \"Impact\",\n  /** PreAttack */\n  PreAttack = \"PreAttack\",\n  /** ImpairProcessControl */\n  ImpairProcessControl = \"ImpairProcessControl\",\n  /** InhibitResponseFunction */\n  InhibitResponseFunction = \"InhibitResponseFunction\"\n}\n\n/**\n * Defines values for AttackTactic. \\\n * {@link KnownAttackTactic} can be used interchangeably with AttackTactic,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Reconnaissance** \\\n * **ResourceDevelopment** \\\n * **InitialAccess** \\\n * **Execution** \\\n * **Persistence** \\\n * **PrivilegeEscalation** \\\n * **DefenseEvasion** \\\n * **CredentialAccess** \\\n * **Discovery** \\\n * **LateralMovement** \\\n * **Collection** \\\n * **Exfiltration** \\\n * **CommandAndControl** \\\n * **Impact** \\\n * **PreAttack** \\\n * **ImpairProcessControl** \\\n * **InhibitResponseFunction**\n */\nexport type AttackTactic = string;\n\n/** Known values of {@link EntityKind} that the service accepts. */\nexport enum KnownEntityKind {\n  /** Entity represents account in the system. */\n  Account = \"Account\",\n  /** Entity represents host in the system. */\n  Host = \"Host\",\n  /** Entity represents file in the system. */\n  File = \"File\",\n  /** Entity represents azure resource in the system. */\n  AzureResource = \"AzureResource\",\n  /** Entity represents cloud application in the system. */\n  CloudApplication = \"CloudApplication\",\n  /** Entity represents dns resolution in the system. */\n  DnsResolution = \"DnsResolution\",\n  /** Entity represents file hash in the system. */\n  FileHash = \"FileHash\",\n  /** Entity represents ip in the system. */\n  Ip = \"Ip\",\n  /** Entity represents malware in the system. */\n  Malware = \"Malware\",\n  /** Entity represents process in the system. */\n  Process = \"Process\",\n  /** Entity represents registry key in the system. */\n  RegistryKey = \"RegistryKey\",\n  /** Entity represents registry value in the system. */\n  RegistryValue = \"RegistryValue\",\n  /** Entity represents security group in the system. */\n  SecurityGroup = \"SecurityGroup\",\n  /** Entity represents url in the system. */\n  Url = \"Url\",\n  /** Entity represents IoT device in the system. */\n  IoTDevice = \"IoTDevice\",\n  /** Entity represents security alert in the system. */\n  SecurityAlert = \"SecurityAlert\",\n  /** Entity represents bookmark in the system. */\n  Bookmark = \"Bookmark\",\n  /** Entity represents mail cluster in the system. */\n  MailCluster = \"MailCluster\",\n  /** Entity represents mail message in the system. */\n  MailMessage = \"MailMessage\",\n  /** Entity represents mailbox in the system. */\n  Mailbox = \"Mailbox\",\n  /** Entity represents submission mail in the system. */\n  SubmissionMail = \"SubmissionMail\",\n  /** Entity represents network interface in the system. */\n  Nic = \"Nic\"\n}\n\n/**\n * Defines values for EntityKind. \\\n * {@link KnownEntityKind} can be used interchangeably with EntityKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Account**: Entity represents account in the system. \\\n * **Host**: Entity represents host in the system. \\\n * **File**: Entity represents file in the system. \\\n * **AzureResource**: Entity represents azure resource in the system. \\\n * **CloudApplication**: Entity represents cloud application in the system. \\\n * **DnsResolution**: Entity represents dns resolution in the system. \\\n * **FileHash**: Entity represents file hash in the system. \\\n * **Ip**: Entity represents ip in the system. \\\n * **Malware**: Entity represents malware in the system. \\\n * **Process**: Entity represents process in the system. \\\n * **RegistryKey**: Entity represents registry key in the system. \\\n * **RegistryValue**: Entity represents registry value in the system. \\\n * **SecurityGroup**: Entity represents security group in the system. \\\n * **Url**: Entity represents url in the system. \\\n * **IoTDevice**: Entity represents IoT device in the system. \\\n * **SecurityAlert**: Entity represents security alert in the system. \\\n * **Bookmark**: Entity represents bookmark in the system. \\\n * **MailCluster**: Entity represents mail cluster in the system. \\\n * **MailMessage**: Entity represents mail message in the system. \\\n * **Mailbox**: Entity represents mailbox in the system. \\\n * **SubmissionMail**: Entity represents submission mail in the system. \\\n * **Nic**: Entity represents network interface in the system.\n */\nexport type EntityKind = string;\n\n/** Known values of {@link EntityTimelineKind} that the service accepts. */\nexport enum KnownEntityTimelineKind {\n  /** activity */\n  Activity = \"Activity\",\n  /** bookmarks */\n  Bookmark = \"Bookmark\",\n  /** security alerts */\n  SecurityAlert = \"SecurityAlert\",\n  /** anomaly */\n  Anomaly = \"Anomaly\"\n}\n\n/**\n * Defines values for EntityTimelineKind. \\\n * {@link KnownEntityTimelineKind} can be used interchangeably with EntityTimelineKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Activity**: activity \\\n * **Bookmark**: bookmarks \\\n * **SecurityAlert**: security alerts \\\n * **Anomaly**: anomaly\n */\nexport type EntityTimelineKind = string;\n\n/** Known values of {@link EntityItemQueryKind} that the service accepts. */\nexport enum KnownEntityItemQueryKind {\n  /** insight */\n  Insight = \"Insight\"\n}\n\n/**\n * Defines values for EntityItemQueryKind. \\\n * {@link KnownEntityItemQueryKind} can be used interchangeably with EntityItemQueryKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Insight**: insight\n */\nexport type EntityItemQueryKind = string;\n\n/** Known values of {@link EntityQueryKind} that the service accepts. */\nexport enum KnownEntityQueryKind {\n  /** Expansion */\n  Expansion = \"Expansion\",\n  /** Insight */\n  Insight = \"Insight\",\n  /** Activity */\n  Activity = \"Activity\"\n}\n\n/**\n * Defines values for EntityQueryKind. \\\n * {@link KnownEntityQueryKind} can be used interchangeably with EntityQueryKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Expansion** \\\n * **Insight** \\\n * **Activity**\n */\nexport type EntityQueryKind = string;\n\n/** Known values of {@link GetInsightsError} that the service accepts. */\nexport enum KnownGetInsightsError {\n  /** Insight */\n  Insight = \"Insight\"\n}\n\n/**\n * Defines values for GetInsightsError. \\\n * {@link KnownGetInsightsError} can be used interchangeably with GetInsightsError,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Insight**\n */\nexport type GetInsightsError = string;\n\n/** Known values of {@link Enum13} that the service accepts. */\nexport enum KnownEnum13 {\n  /** Expansion */\n  Expansion = \"Expansion\",\n  /** Activity */\n  Activity = \"Activity\"\n}\n\n/**\n * Defines values for Enum13. \\\n * {@link KnownEnum13} can be used interchangeably with Enum13,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Expansion** \\\n * **Activity**\n */\nexport type Enum13 = string;\n\n/** Known values of {@link CustomEntityQueryKind} that the service accepts. */\nexport enum KnownCustomEntityQueryKind {\n  /** Activity */\n  Activity = \"Activity\"\n}\n\n/**\n * Defines values for CustomEntityQueryKind. \\\n * {@link KnownCustomEntityQueryKind} can be used interchangeably with CustomEntityQueryKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Activity**\n */\nexport type CustomEntityQueryKind = string;\n\n/** Known values of {@link EntityQueryTemplateKind} that the service accepts. */\nexport enum KnownEntityQueryTemplateKind {\n  /** Activity */\n  Activity = \"Activity\"\n}\n\n/**\n * Defines values for EntityQueryTemplateKind. \\\n * {@link KnownEntityQueryTemplateKind} can be used interchangeably with EntityQueryTemplateKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Activity**\n */\nexport type EntityQueryTemplateKind = string;\n\n/** Known values of {@link IngestionMode} that the service accepts. */\nexport enum KnownIngestionMode {\n  /** No records should be ingested when invalid records are detected. */\n  IngestOnlyIfAllAreValid = \"IngestOnlyIfAllAreValid\",\n  /** Valid records should still be ingested when invalid records are detected. */\n  IngestAnyValidRecords = \"IngestAnyValidRecords\",\n  /** Unspecified */\n  Unspecified = \"Unspecified\"\n}\n\n/**\n * Defines values for IngestionMode. \\\n * {@link KnownIngestionMode} can be used interchangeably with IngestionMode,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **IngestOnlyIfAllAreValid**: No records should be ingested when invalid records are detected. \\\n * **IngestAnyValidRecords**: Valid records should still be ingested when invalid records are detected. \\\n * **Unspecified**: Unspecified\n */\nexport type IngestionMode = string;\n\n/** Known values of {@link FileImportContentType} that the service accepts. */\nexport enum KnownFileImportContentType {\n  /** File containing records with the core fields of an indicator, plus the observables to construct the STIX pattern. */\n  BasicIndicator = \"BasicIndicator\",\n  /** File containing STIX indicators. */\n  StixIndicator = \"StixIndicator\",\n  /** File containing other records. */\n  Unspecified = \"Unspecified\"\n}\n\n/**\n * Defines values for FileImportContentType. \\\n * {@link KnownFileImportContentType} can be used interchangeably with FileImportContentType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **BasicIndicator**: File containing records with the core fields of an indicator, plus the observables to construct the STIX pattern. \\\n * **StixIndicator**: File containing STIX indicators. \\\n * **Unspecified**: File containing other records.\n */\nexport type FileImportContentType = string;\n\n/** Known values of {@link FileFormat} that the service accepts. */\nexport enum KnownFileFormat {\n  /** A CSV file. */\n  CSV = \"CSV\",\n  /** A JSON file. */\n  Json = \"JSON\",\n  /** A file of other format. */\n  Unspecified = \"Unspecified\"\n}\n\n/**\n * Defines values for FileFormat. \\\n * {@link KnownFileFormat} can be used interchangeably with FileFormat,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **CSV**: A CSV file. \\\n * **JSON**: A JSON file. \\\n * **Unspecified**: A file of other format.\n */\nexport type FileFormat = string;\n\n/** Known values of {@link DeleteStatus} that the service accepts. */\nexport enum KnownDeleteStatus {\n  /** The file was deleted. */\n  Deleted = \"Deleted\",\n  /** The file was not deleted. */\n  NotDeleted = \"NotDeleted\",\n  /** Unspecified */\n  Unspecified = \"Unspecified\"\n}\n\n/**\n * Defines values for DeleteStatus. \\\n * {@link KnownDeleteStatus} can be used interchangeably with DeleteStatus,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Deleted**: The file was deleted. \\\n * **NotDeleted**: The file was not deleted. \\\n * **Unspecified**: Unspecified\n */\nexport type DeleteStatus = string;\n\n/** Known values of {@link FileImportState} that the service accepts. */\nexport enum KnownFileImportState {\n  /** A fatal error has occurred while ingesting the file. */\n  FatalError = \"FatalError\",\n  /** The file has been ingested. */\n  Ingested = \"Ingested\",\n  /** The file has been ingested with errors. */\n  IngestedWithErrors = \"IngestedWithErrors\",\n  /** The file ingestion is in progress. */\n  InProgress = \"InProgress\",\n  /** The file is invalid. */\n  Invalid = \"Invalid\",\n  /** Waiting for the file to be uploaded. */\n  WaitingForUpload = \"WaitingForUpload\",\n  /** Unspecified state. */\n  Unspecified = \"Unspecified\"\n}\n\n/**\n * Defines values for FileImportState. \\\n * {@link KnownFileImportState} can be used interchangeably with FileImportState,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **FatalError**: A fatal error has occurred while ingesting the file. \\\n * **Ingested**: The file has been ingested. \\\n * **IngestedWithErrors**: The file has been ingested with errors. \\\n * **InProgress**: The file ingestion is in progress. \\\n * **Invalid**: The file is invalid. \\\n * **WaitingForUpload**: Waiting for the file to be uploaded. \\\n * **Unspecified**: Unspecified state.\n */\nexport type FileImportState = string;\n\n/** Known values of {@link IncidentClassification} that the service accepts. */\nexport enum KnownIncidentClassification {\n  /** Incident classification was undetermined */\n  Undetermined = \"Undetermined\",\n  /** Incident was true positive */\n  TruePositive = \"TruePositive\",\n  /** Incident was benign positive */\n  BenignPositive = \"BenignPositive\",\n  /** Incident was false positive */\n  FalsePositive = \"FalsePositive\"\n}\n\n/**\n * Defines values for IncidentClassification. \\\n * {@link KnownIncidentClassification} can be used interchangeably with IncidentClassification,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Undetermined**: Incident classification was undetermined \\\n * **TruePositive**: Incident was true positive \\\n * **BenignPositive**: Incident was benign positive \\\n * **FalsePositive**: Incident was false positive\n */\nexport type IncidentClassification = string;\n\n/** Known values of {@link IncidentClassificationReason} that the service accepts. */\nexport enum KnownIncidentClassificationReason {\n  /** Classification reason was suspicious activity */\n  SuspiciousActivity = \"SuspiciousActivity\",\n  /** Classification reason was suspicious but expected */\n  SuspiciousButExpected = \"SuspiciousButExpected\",\n  /** Classification reason was incorrect alert logic */\n  IncorrectAlertLogic = \"IncorrectAlertLogic\",\n  /** Classification reason was inaccurate data */\n  InaccurateData = \"InaccurateData\"\n}\n\n/**\n * Defines values for IncidentClassificationReason. \\\n * {@link KnownIncidentClassificationReason} can be used interchangeably with IncidentClassificationReason,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **SuspiciousActivity**: Classification reason was suspicious activity \\\n * **SuspiciousButExpected**: Classification reason was suspicious but expected \\\n * **IncorrectAlertLogic**: Classification reason was incorrect alert logic \\\n * **InaccurateData**: Classification reason was inaccurate data\n */\nexport type IncidentClassificationReason = string;\n\n/** Known values of {@link IncidentLabelType} that the service accepts. */\nexport enum KnownIncidentLabelType {\n  /** Label manually created by a user */\n  User = \"User\",\n  /** Label automatically created by the system */\n  AutoAssigned = \"AutoAssigned\"\n}\n\n/**\n * Defines values for IncidentLabelType. \\\n * {@link KnownIncidentLabelType} can be used interchangeably with IncidentLabelType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **User**: Label manually created by a user \\\n * **AutoAssigned**: Label automatically created by the system\n */\nexport type IncidentLabelType = string;\n\n/** Known values of {@link OwnerType} that the service accepts. */\nexport enum KnownOwnerType {\n  /** The incident owner type is unknown */\n  Unknown = \"Unknown\",\n  /** The incident owner type is an AAD user */\n  User = \"User\",\n  /** The incident owner type is an AAD group */\n  Group = \"Group\"\n}\n\n/**\n * Defines values for OwnerType. \\\n * {@link KnownOwnerType} can be used interchangeably with OwnerType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Unknown**: The incident owner type is unknown \\\n * **User**: The incident owner type is an AAD user \\\n * **Group**: The incident owner type is an AAD group\n */\nexport type OwnerType = string;\n\n/** Known values of {@link IncidentStatus} that the service accepts. */\nexport enum KnownIncidentStatus {\n  /** An active incident which isn't being handled currently */\n  New = \"New\",\n  /** An active incident which is being handled */\n  Active = \"Active\",\n  /** A non-active incident */\n  Closed = \"Closed\"\n}\n\n/**\n * Defines values for IncidentStatus. \\\n * {@link KnownIncidentStatus} can be used interchangeably with IncidentStatus,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **New**: An active incident which isn't being handled currently \\\n * **Active**: An active incident which is being handled \\\n * **Closed**: A non-active incident\n */\nexport type IncidentStatus = string;\n\n/** Known values of {@link ConfidenceLevel} that the service accepts. */\nexport enum KnownConfidenceLevel {\n  /** Unknown confidence, the is the default value */\n  Unknown = \"Unknown\",\n  /** Low confidence, meaning we have some doubts this is indeed malicious or part of an attack */\n  Low = \"Low\",\n  /** High confidence that the alert is true positive malicious */\n  High = \"High\"\n}\n\n/**\n * Defines values for ConfidenceLevel. \\\n * {@link KnownConfidenceLevel} can be used interchangeably with ConfidenceLevel,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Unknown**: Unknown confidence, the is the default value \\\n * **Low**: Low confidence, meaning we have some doubts this is indeed malicious or part of an attack \\\n * **High**: High confidence that the alert is true positive malicious\n */\nexport type ConfidenceLevel = string;\n\n/** Known values of {@link ConfidenceScoreStatus} that the service accepts. */\nexport enum KnownConfidenceScoreStatus {\n  /** Score will not be calculated for this alert as it is not supported by virtual analyst */\n  NotApplicable = \"NotApplicable\",\n  /** No score was set yet and calculation is in progress */\n  InProcess = \"InProcess\",\n  /** Score is calculated and shown as part of the alert, but may be updated again at a later time following the processing of additional data */\n  NotFinal = \"NotFinal\",\n  /** Final score was calculated and available */\n  Final = \"Final\"\n}\n\n/**\n * Defines values for ConfidenceScoreStatus. \\\n * {@link KnownConfidenceScoreStatus} can be used interchangeably with ConfidenceScoreStatus,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **NotApplicable**: Score will not be calculated for this alert as it is not supported by virtual analyst \\\n * **InProcess**: No score was set yet and calculation is in progress \\\n * **NotFinal**: Score is calculated and shown as part of the alert, but may be updated again at a later time following the processing of additional data \\\n * **Final**: Final score was calculated and available\n */\nexport type ConfidenceScoreStatus = string;\n\n/** Known values of {@link KillChainIntent} that the service accepts. */\nexport enum KnownKillChainIntent {\n  /** The default value. */\n  Unknown = \"Unknown\",\n  /** Probing could be an attempt to access a certain resource regardless of a malicious intent or a failed attempt to gain access to a target system to gather information prior to exploitation. This step is usually detected as an attempt originating from outside the network in attempt to scan the target system and find a way in. */\n  Probing = \"Probing\",\n  /** Exploitation is the stage where an attacker manage to get foothold on the attacked resource. This stage is applicable not only for compute hosts, but also for resources such as user accounts, certificates etc. Adversaries will often be able to control the resource after this stage. */\n  Exploitation = \"Exploitation\",\n  /** Persistence is any access, action, or configuration change to a system that gives an adversary a persistent presence on that system. Adversaries will often need to maintain access to systems through interruptions such as system restarts, loss of credentials, or other failures that would require a remote access tool to restart or alternate backdoor for them to regain access. */\n  Persistence = \"Persistence\",\n  /** Privilege escalation is the result of actions that allow an adversary to obtain a higher level of permissions on a system or network. Certain tools or actions require a higher level of privilege to work and are likely necessary at many points throughout an operation. User accounts with permissions to access specific systems or perform specific functions necessary for adversaries to achieve their objective may also be considered an escalation of privilege. */\n  PrivilegeEscalation = \"PrivilegeEscalation\",\n  /** Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation. */\n  DefenseEvasion = \"DefenseEvasion\",\n  /** Credential access represents techniques resulting in access to or control over system, domain, or service credentials that are used within an enterprise environment. Adversaries will likely attempt to obtain legitimate credentials from users or administrator accounts (local system administrator or domain users with administrator access) to use within the network. With sufficient access within a network, an adversary can create accounts for later use within the environment. */\n  CredentialAccess = \"CredentialAccess\",\n  /** Discovery consists of techniques that allow the adversary to gain knowledge about the system and internal network. When adversaries gain access to a new system, they must orient themselves to what they now have control of and what benefits operating from that system give to their current objective or overall goals during the intrusion. The operating system provides many native tools that aid in this post-compromise information-gathering phase. */\n  Discovery = \"Discovery\",\n  /** Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access tool. An adversary can use lateral movement for many purposes, including remote Execution of tools, pivoting to additional systems, access to specific information or files, access to additional credentials, or to cause an effect. */\n  LateralMovement = \"LateralMovement\",\n  /** The execution tactic represents techniques that result in execution of adversary-controlled code on a local or remote system. This tactic is often used in conjunction with lateral movement to expand access to remote systems on a network. */\n  Execution = \"Execution\",\n  /** Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers locations on a system or network where the adversary may look for information to exfiltrate. */\n  Collection = \"Collection\",\n  /** Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from a target network. This category also covers locations on a system or network where the adversary may look for information to exfiltrate. */\n  Exfiltration = \"Exfiltration\",\n  /** The command and control tactic represents how adversaries communicate with systems under their control within a target network. */\n  CommandAndControl = \"CommandAndControl\",\n  /** The impact intent primary objective is to directly reduce the availability or integrity of a system, service, or network; including manipulation of data to impact a business or operational process. This would often refer to techniques such as ransom-ware, defacement, data manipulation and others. */\n  Impact = \"Impact\"\n}\n\n/**\n * Defines values for KillChainIntent. \\\n * {@link KnownKillChainIntent} can be used interchangeably with KillChainIntent,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Unknown**: The default value. \\\n * **Probing**: Probing could be an attempt to access a certain resource regardless of a malicious intent or a failed attempt to gain access to a target system to gather information prior to exploitation. This step is usually detected as an attempt originating from outside the network in attempt to scan the target system and find a way in. \\\n * **Exploitation**: Exploitation is the stage where an attacker manage to get foothold on the attacked resource. This stage is applicable not only for compute hosts, but also for resources such as user accounts, certificates etc. Adversaries will often be able to control the resource after this stage. \\\n * **Persistence**: Persistence is any access, action, or configuration change to a system that gives an adversary a persistent presence on that system. Adversaries will often need to maintain access to systems through interruptions such as system restarts, loss of credentials, or other failures that would require a remote access tool to restart or alternate backdoor for them to regain access. \\\n * **PrivilegeEscalation**: Privilege escalation is the result of actions that allow an adversary to obtain a higher level of permissions on a system or network. Certain tools or actions require a higher level of privilege to work and are likely necessary at many points throughout an operation. User accounts with permissions to access specific systems or perform specific functions necessary for adversaries to achieve their objective may also be considered an escalation of privilege. \\\n * **DefenseEvasion**: Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation.  \\\n * **CredentialAccess**: Credential access represents techniques resulting in access to or control over system, domain, or service credentials that are used within an enterprise environment. Adversaries will likely attempt to obtain legitimate credentials from users or administrator accounts (local system administrator or domain users with administrator access) to use within the network. With sufficient access within a network, an adversary can create accounts for later use within the environment. \\\n * **Discovery**: Discovery consists of techniques that allow the adversary to gain knowledge about the system and internal network. When adversaries gain access to a new system, they must orient themselves to what they now have control of and what benefits operating from that system give to their current objective or overall goals during the intrusion. The operating system provides many native tools that aid in this post-compromise information-gathering phase. \\\n * **LateralMovement**: Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access tool. An adversary can use lateral movement for many purposes, including remote Execution of tools, pivoting to additional systems, access to specific information or files, access to additional credentials, or to cause an effect. \\\n * **Execution**: The execution tactic represents techniques that result in execution of adversary-controlled code on a local or remote system. This tactic is often used in conjunction with lateral movement to expand access to remote systems on a network. \\\n * **Collection**: Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers locations on a system or network where the adversary may look for information to exfiltrate. \\\n * **Exfiltration**: Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from a target network. This category also covers locations on a system or network where the adversary may look for information to exfiltrate. \\\n * **CommandAndControl**: The command and control tactic represents how adversaries communicate with systems under their control within a target network. \\\n * **Impact**: The impact intent primary objective is to directly reduce the availability or integrity of a system, service, or network; including manipulation of data to impact a business or operational process. This would often refer to techniques such as ransom-ware, defacement, data manipulation and others.\n */\nexport type KillChainIntent = string;\n\n/** Known values of {@link AlertSeverity} that the service accepts. */\nexport enum KnownAlertSeverity {\n  /** High severity */\n  High = \"High\",\n  /** Medium severity */\n  Medium = \"Medium\",\n  /** Low severity */\n  Low = \"Low\",\n  /** Informational severity */\n  Informational = \"Informational\"\n}\n\n/**\n * Defines values for AlertSeverity. \\\n * {@link KnownAlertSeverity} can be used interchangeably with AlertSeverity,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **High**: High severity \\\n * **Medium**: Medium severity \\\n * **Low**: Low severity \\\n * **Informational**: Informational severity\n */\nexport type AlertSeverity = string;\n\n/** Known values of {@link AlertStatus} that the service accepts. */\nexport enum KnownAlertStatus {\n  /** Unknown value */\n  Unknown = \"Unknown\",\n  /** New alert */\n  New = \"New\",\n  /** Alert closed after handling */\n  Resolved = \"Resolved\",\n  /** Alert dismissed as false positive */\n  Dismissed = \"Dismissed\",\n  /** Alert is being handled */\n  InProgress = \"InProgress\"\n}\n\n/**\n * Defines values for AlertStatus. \\\n * {@link KnownAlertStatus} can be used interchangeably with AlertStatus,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Unknown**: Unknown value \\\n * **New**: New alert \\\n * **Resolved**: Alert closed after handling \\\n * **Dismissed**: Alert dismissed as false positive \\\n * **InProgress**: Alert is being handled\n */\nexport type AlertStatus = string;\n\n/** Known values of {@link Kind} that the service accepts. */\nexport enum KnownKind {\n  /** DataConnector */\n  DataConnector = \"DataConnector\",\n  /** DataType */\n  DataType = \"DataType\",\n  /** Workbook */\n  Workbook = \"Workbook\",\n  /** WorkbookTemplate */\n  WorkbookTemplate = \"WorkbookTemplate\",\n  /** Playbook */\n  Playbook = \"Playbook\",\n  /** PlaybookTemplate */\n  PlaybookTemplate = \"PlaybookTemplate\",\n  /** AnalyticsRuleTemplate */\n  AnalyticsRuleTemplate = \"AnalyticsRuleTemplate\",\n  /** AnalyticsRule */\n  AnalyticsRule = \"AnalyticsRule\",\n  /** HuntingQuery */\n  HuntingQuery = \"HuntingQuery\",\n  /** InvestigationQuery */\n  InvestigationQuery = \"InvestigationQuery\",\n  /** Parser */\n  Parser = \"Parser\",\n  /** Watchlist */\n  Watchlist = \"Watchlist\",\n  /** WatchlistTemplate */\n  WatchlistTemplate = \"WatchlistTemplate\",\n  /** Solution */\n  Solution = \"Solution\",\n  /** AzureFunction */\n  AzureFunction = \"AzureFunction\",\n  /** LogicAppsCustomConnector */\n  LogicAppsCustomConnector = \"LogicAppsCustomConnector\",\n  /** AutomationRule */\n  AutomationRule = \"AutomationRule\"\n}\n\n/**\n * Defines values for Kind. \\\n * {@link KnownKind} can be used interchangeably with Kind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **DataConnector** \\\n * **DataType** \\\n * **Workbook** \\\n * **WorkbookTemplate** \\\n * **Playbook** \\\n * **PlaybookTemplate** \\\n * **AnalyticsRuleTemplate** \\\n * **AnalyticsRule** \\\n * **HuntingQuery** \\\n * **InvestigationQuery** \\\n * **Parser** \\\n * **Watchlist** \\\n * **WatchlistTemplate** \\\n * **Solution** \\\n * **AzureFunction** \\\n * **LogicAppsCustomConnector** \\\n * **AutomationRule**\n */\nexport type Kind = string;\n\n/** Known values of {@link SourceKind} that the service accepts. */\nexport enum KnownSourceKind {\n  /** LocalWorkspace */\n  LocalWorkspace = \"LocalWorkspace\",\n  /** Community */\n  Community = \"Community\",\n  /** Solution */\n  Solution = \"Solution\",\n  /** SourceRepository */\n  SourceRepository = \"SourceRepository\"\n}\n\n/**\n * Defines values for SourceKind. \\\n * {@link KnownSourceKind} can be used interchangeably with SourceKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **LocalWorkspace** \\\n * **Community** \\\n * **Solution** \\\n * **SourceRepository**\n */\nexport type SourceKind = string;\n\n/** Known values of {@link SupportTier} that the service accepts. */\nexport enum KnownSupportTier {\n  /** Microsoft */\n  Microsoft = \"Microsoft\",\n  /** Partner */\n  Partner = \"Partner\",\n  /** Community */\n  Community = \"Community\"\n}\n\n/**\n * Defines values for SupportTier. \\\n * {@link KnownSupportTier} can be used interchangeably with SupportTier,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Microsoft** \\\n * **Partner** \\\n * **Community**\n */\nexport type SupportTier = string;\n\n/** Known values of {@link Operator} that the service accepts. */\nexport enum KnownOperator {\n  /** AND */\n  AND = \"AND\",\n  /** OR */\n  OR = \"OR\"\n}\n\n/**\n * Defines values for Operator. \\\n * {@link KnownOperator} can be used interchangeably with Operator,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **AND** \\\n * **OR**\n */\nexport type Operator = string;\n\n/** Known values of {@link SecurityMLAnalyticsSettingsKind} that the service accepts. */\nexport enum KnownSecurityMLAnalyticsSettingsKind {\n  /** Anomaly */\n  Anomaly = \"Anomaly\"\n}\n\n/**\n * Defines values for SecurityMLAnalyticsSettingsKind. \\\n * {@link KnownSecurityMLAnalyticsSettingsKind} can be used interchangeably with SecurityMLAnalyticsSettingsKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Anomaly**\n */\nexport type SecurityMLAnalyticsSettingsKind = string;\n\n/** Known values of {@link SettingKind} that the service accepts. */\nexport enum KnownSettingKind {\n  /** Anomalies */\n  Anomalies = \"Anomalies\",\n  /** EyesOn */\n  EyesOn = \"EyesOn\",\n  /** EntityAnalytics */\n  EntityAnalytics = \"EntityAnalytics\",\n  /** Ueba */\n  Ueba = \"Ueba\"\n}\n\n/**\n * Defines values for SettingKind. \\\n * {@link KnownSettingKind} can be used interchangeably with SettingKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Anomalies** \\\n * **EyesOn** \\\n * **EntityAnalytics** \\\n * **Ueba**\n */\nexport type SettingKind = string;\n\n/** Known values of {@link RepoType} that the service accepts. */\nexport enum KnownRepoType {\n  /** Github */\n  Github = \"Github\",\n  /** DevOps */\n  DevOps = \"DevOps\"\n}\n\n/**\n * Defines values for RepoType. \\\n * {@link KnownRepoType} can be used interchangeably with RepoType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Github** \\\n * **DevOps**\n */\nexport type RepoType = string;\n\n/** Known values of {@link Version} that the service accepts. */\nexport enum KnownVersion {\n  /** V1 */\n  V1 = \"V1\",\n  /** V2 */\n  V2 = \"V2\"\n}\n\n/**\n * Defines values for Version. \\\n * {@link KnownVersion} can be used interchangeably with Version,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **V1** \\\n * **V2**\n */\nexport type Version = string;\n\n/** Known values of {@link ContentType} that the service accepts. */\nexport enum KnownContentType {\n  /** AnalyticRule */\n  AnalyticRule = \"AnalyticRule\",\n  /** Workbook */\n  Workbook = \"Workbook\"\n}\n\n/**\n * Defines values for ContentType. \\\n * {@link KnownContentType} can be used interchangeably with ContentType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **AnalyticRule** \\\n * **Workbook**\n */\nexport type ContentType = string;\n\n/** Known values of {@link DeploymentFetchStatus} that the service accepts. */\nexport enum KnownDeploymentFetchStatus {\n  /** Success */\n  Success = \"Success\",\n  /** Unauthorized */\n  Unauthorized = \"Unauthorized\",\n  /** NotFound */\n  NotFound = \"NotFound\"\n}\n\n/**\n * Defines values for DeploymentFetchStatus. \\\n * {@link KnownDeploymentFetchStatus} can be used interchangeably with DeploymentFetchStatus,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Success** \\\n * **Unauthorized** \\\n * **NotFound**\n */\nexport type DeploymentFetchStatus = string;\n\n/** Known values of {@link DeploymentState} that the service accepts. */\nexport enum KnownDeploymentState {\n  /** InProgress */\n  InProgress = \"In_Progress\",\n  /** Completed */\n  Completed = \"Completed\",\n  /** Queued */\n  Queued = \"Queued\",\n  /** Canceling */\n  Canceling = \"Canceling\"\n}\n\n/**\n * Defines values for DeploymentState. \\\n * {@link KnownDeploymentState} can be used interchangeably with DeploymentState,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **In_Progress** \\\n * **Completed** \\\n * **Queued** \\\n * **Canceling**\n */\nexport type DeploymentState = string;\n\n/** Known values of {@link DeploymentResult} that the service accepts. */\nexport enum KnownDeploymentResult {\n  /** Success */\n  Success = \"Success\",\n  /** Canceled */\n  Canceled = \"Canceled\",\n  /** Failed */\n  Failed = \"Failed\"\n}\n\n/**\n * Defines values for DeploymentResult. \\\n * {@link KnownDeploymentResult} can be used interchangeably with DeploymentResult,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Success** \\\n * **Canceled** \\\n * **Failed**\n */\nexport type DeploymentResult = string;\n\n/** Known values of {@link ThreatIntelligenceResourceKindEnum} that the service accepts. */\nexport enum KnownThreatIntelligenceResourceKindEnum {\n  /** Entity represents threat intelligence indicator in the system. */\n  Indicator = \"indicator\"\n}\n\n/**\n * Defines values for ThreatIntelligenceResourceKindEnum. \\\n * {@link KnownThreatIntelligenceResourceKindEnum} can be used interchangeably with ThreatIntelligenceResourceKindEnum,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **indicator**: Entity represents threat intelligence indicator in the system.\n */\nexport type ThreatIntelligenceResourceKindEnum = string;\n\n/** Known values of {@link ThreatIntelligenceSortingCriteriaEnum} that the service accepts. */\nexport enum KnownThreatIntelligenceSortingCriteriaEnum {\n  /** Unsorted */\n  Unsorted = \"unsorted\",\n  /** Ascending */\n  Ascending = \"ascending\",\n  /** Descending */\n  Descending = \"descending\"\n}\n\n/**\n * Defines values for ThreatIntelligenceSortingCriteriaEnum. \\\n * {@link KnownThreatIntelligenceSortingCriteriaEnum} can be used interchangeably with ThreatIntelligenceSortingCriteriaEnum,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **unsorted** \\\n * **ascending** \\\n * **descending**\n */\nexport type ThreatIntelligenceSortingCriteriaEnum = string;\n\n/** Known values of {@link SourceType} that the service accepts. */\nexport enum KnownSourceType {\n  /** LocalFile */\n  LocalFile = \"Local file\",\n  /** RemoteStorage */\n  RemoteStorage = \"Remote storage\"\n}\n\n/**\n * Defines values for SourceType. \\\n * {@link KnownSourceType} can be used interchangeably with SourceType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Local file** \\\n * **Remote storage**\n */\nexport type SourceType = string;\n\n/** Known values of {@link DataConnectorKind} that the service accepts. */\nexport enum KnownDataConnectorKind {\n  /** AzureActiveDirectory */\n  AzureActiveDirectory = \"AzureActiveDirectory\",\n  /** AzureSecurityCenter */\n  AzureSecurityCenter = \"AzureSecurityCenter\",\n  /** MicrosoftCloudAppSecurity */\n  MicrosoftCloudAppSecurity = \"MicrosoftCloudAppSecurity\",\n  /** ThreatIntelligence */\n  ThreatIntelligence = \"ThreatIntelligence\",\n  /** ThreatIntelligenceTaxii */\n  ThreatIntelligenceTaxii = \"ThreatIntelligenceTaxii\",\n  /** Office365 */\n  Office365 = \"Office365\",\n  /** OfficeATP */\n  OfficeATP = \"OfficeATP\",\n  /** OfficeIRM */\n  OfficeIRM = \"OfficeIRM\",\n  /** Office365Project */\n  Office365Project = \"Office365Project\",\n  /** OfficePowerBI */\n  OfficePowerBI = \"OfficePowerBI\",\n  /** AmazonWebServicesCloudTrail */\n  AmazonWebServicesCloudTrail = \"AmazonWebServicesCloudTrail\",\n  /** AmazonWebServicesS3 */\n  AmazonWebServicesS3 = \"AmazonWebServicesS3\",\n  /** AzureAdvancedThreatProtection */\n  AzureAdvancedThreatProtection = \"AzureAdvancedThreatProtection\",\n  /** MicrosoftDefenderAdvancedThreatProtection */\n  MicrosoftDefenderAdvancedThreatProtection = \"MicrosoftDefenderAdvancedThreatProtection\",\n  /** Dynamics365 */\n  Dynamics365 = \"Dynamics365\",\n  /** MicrosoftThreatProtection */\n  MicrosoftThreatProtection = \"MicrosoftThreatProtection\",\n  /** MicrosoftThreatIntelligence */\n  MicrosoftThreatIntelligence = \"MicrosoftThreatIntelligence\",\n  /** GenericUI */\n  GenericUI = \"GenericUI\",\n  /** APIPolling */\n  APIPolling = \"APIPolling\",\n  /** IOT */\n  IOT = \"IOT\"\n}\n\n/**\n * Defines values for DataConnectorKind. \\\n * {@link KnownDataConnectorKind} can be used interchangeably with DataConnectorKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **AzureActiveDirectory** \\\n * **AzureSecurityCenter** \\\n * **MicrosoftCloudAppSecurity** \\\n * **ThreatIntelligence** \\\n * **ThreatIntelligenceTaxii** \\\n * **Office365** \\\n * **OfficeATP** \\\n * **OfficeIRM** \\\n * **Office365Project** \\\n * **OfficePowerBI** \\\n * **AmazonWebServicesCloudTrail** \\\n * **AmazonWebServicesS3** \\\n * **AzureAdvancedThreatProtection** \\\n * **MicrosoftDefenderAdvancedThreatProtection** \\\n * **Dynamics365** \\\n * **MicrosoftThreatProtection** \\\n * **MicrosoftThreatIntelligence** \\\n * **GenericUI** \\\n * **APIPolling** \\\n * **IOT**\n */\nexport type DataConnectorKind = string;\n\n/** Known values of {@link ConnectAuthKind} that the service accepts. */\nexport enum KnownConnectAuthKind {\n  /** Basic */\n  Basic = \"Basic\",\n  /** OAuth2 */\n  OAuth2 = \"OAuth2\",\n  /** APIKey */\n  APIKey = \"APIKey\"\n}\n\n/**\n * Defines values for ConnectAuthKind. \\\n * {@link KnownConnectAuthKind} can be used interchangeably with ConnectAuthKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Basic** \\\n * **OAuth2** \\\n * **APIKey**\n */\nexport type ConnectAuthKind = string;\n\n/** Known values of {@link DataConnectorAuthorizationState} that the service accepts. */\nexport enum KnownDataConnectorAuthorizationState {\n  /** Valid */\n  Valid = \"Valid\",\n  /** Invalid */\n  Invalid = \"Invalid\"\n}\n\n/**\n * Defines values for DataConnectorAuthorizationState. \\\n * {@link KnownDataConnectorAuthorizationState} can be used interchangeably with DataConnectorAuthorizationState,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Valid** \\\n * **Invalid**\n */\nexport type DataConnectorAuthorizationState = string;\n\n/** Known values of {@link DataConnectorLicenseState} that the service accepts. */\nexport enum KnownDataConnectorLicenseState {\n  /** Valid */\n  Valid = \"Valid\",\n  /** Invalid */\n  Invalid = \"Invalid\",\n  /** Unknown */\n  Unknown = \"Unknown\"\n}\n\n/**\n * Defines values for DataConnectorLicenseState. \\\n * {@link KnownDataConnectorLicenseState} can be used interchangeably with DataConnectorLicenseState,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Valid** \\\n * **Invalid** \\\n * **Unknown**\n */\nexport type DataConnectorLicenseState = string;\n\n/** Known values of {@link TemplateStatus} that the service accepts. */\nexport enum KnownTemplateStatus {\n  /** Alert rule template installed. and can not use more then once */\n  Installed = \"Installed\",\n  /** Alert rule template is available. */\n  Available = \"Available\",\n  /** Alert rule template is not available */\n  NotAvailable = \"NotAvailable\"\n}\n\n/**\n * Defines values for TemplateStatus. \\\n * {@link KnownTemplateStatus} can be used interchangeably with TemplateStatus,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Installed**: Alert rule template installed. and can not use more then once \\\n * **Available**: Alert rule template is available. \\\n * **NotAvailable**: Alert rule template is not available\n */\nexport type TemplateStatus = string;\n\n/** Known values of {@link EntityMappingType} that the service accepts. */\nexport enum KnownEntityMappingType {\n  /** User account entity type */\n  Account = \"Account\",\n  /** Host entity type */\n  Host = \"Host\",\n  /** IP address entity type */\n  IP = \"IP\",\n  /** Malware entity type */\n  Malware = \"Malware\",\n  /** System file entity type */\n  File = \"File\",\n  /** Process entity type */\n  Process = \"Process\",\n  /** Cloud app entity type */\n  CloudApplication = \"CloudApplication\",\n  /** DNS entity type */\n  DNS = \"DNS\",\n  /** Azure resource entity type */\n  AzureResource = \"AzureResource\",\n  /** File-hash entity type */\n  FileHash = \"FileHash\",\n  /** Registry key entity type */\n  RegistryKey = \"RegistryKey\",\n  /** Registry value entity type */\n  RegistryValue = \"RegistryValue\",\n  /** Security group entity type */\n  SecurityGroup = \"SecurityGroup\",\n  /** URL entity type */\n  URL = \"URL\",\n  /** Mailbox entity type */\n  Mailbox = \"Mailbox\",\n  /** Mail cluster entity type */\n  MailCluster = \"MailCluster\",\n  /** Mail message entity type */\n  MailMessage = \"MailMessage\",\n  /** Submission mail entity type */\n  SubmissionMail = \"SubmissionMail\"\n}\n\n/**\n * Defines values for EntityMappingType. \\\n * {@link KnownEntityMappingType} can be used interchangeably with EntityMappingType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Account**: User account entity type \\\n * **Host**: Host entity type \\\n * **IP**: IP address entity type \\\n * **Malware**: Malware entity type \\\n * **File**: System file entity type \\\n * **Process**: Process entity type \\\n * **CloudApplication**: Cloud app entity type \\\n * **DNS**: DNS entity type \\\n * **AzureResource**: Azure resource entity type \\\n * **FileHash**: File-hash entity type \\\n * **RegistryKey**: Registry key entity type \\\n * **RegistryValue**: Registry value entity type \\\n * **SecurityGroup**: Security group entity type \\\n * **URL**: URL entity type \\\n * **Mailbox**: Mailbox entity type \\\n * **MailCluster**: Mail cluster entity type \\\n * **MailMessage**: Mail message entity type \\\n * **SubmissionMail**: Submission mail entity type\n */\nexport type EntityMappingType = string;\n\n/** Known values of {@link EventGroupingAggregationKind} that the service accepts. */\nexport enum KnownEventGroupingAggregationKind {\n  /** SingleAlert */\n  SingleAlert = \"SingleAlert\",\n  /** AlertPerResult */\n  AlertPerResult = \"AlertPerResult\"\n}\n\n/**\n * Defines values for EventGroupingAggregationKind. \\\n * {@link KnownEventGroupingAggregationKind} can be used interchangeably with EventGroupingAggregationKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **SingleAlert** \\\n * **AlertPerResult**\n */\nexport type EventGroupingAggregationKind = string;\n\n/** Known values of {@link MicrosoftSecurityProductName} that the service accepts. */\nexport enum KnownMicrosoftSecurityProductName {\n  /** MicrosoftCloudAppSecurity */\n  MicrosoftCloudAppSecurity = \"Microsoft Cloud App Security\",\n  /** AzureSecurityCenter */\n  AzureSecurityCenter = \"Azure Security Center\",\n  /** AzureAdvancedThreatProtection */\n  AzureAdvancedThreatProtection = \"Azure Advanced Threat Protection\",\n  /** AzureActiveDirectoryIdentityProtection */\n  AzureActiveDirectoryIdentityProtection = \"Azure Active Directory Identity Protection\",\n  /** AzureSecurityCenterForIoT */\n  AzureSecurityCenterForIoT = \"Azure Security Center for IoT\",\n  /** Office365AdvancedThreatProtection */\n  Office365AdvancedThreatProtection = \"Office 365 Advanced Threat Protection\",\n  /** MicrosoftDefenderAdvancedThreatProtection */\n  MicrosoftDefenderAdvancedThreatProtection = \"Microsoft Defender Advanced Threat Protection\"\n}\n\n/**\n * Defines values for MicrosoftSecurityProductName. \\\n * {@link KnownMicrosoftSecurityProductName} can be used interchangeably with MicrosoftSecurityProductName,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Microsoft Cloud App Security** \\\n * **Azure Security Center** \\\n * **Azure Advanced Threat Protection** \\\n * **Azure Active Directory Identity Protection** \\\n * **Azure Security Center for IoT** \\\n * **Office 365 Advanced Threat Protection** \\\n * **Microsoft Defender Advanced Threat Protection**\n */\nexport type MicrosoftSecurityProductName = string;\n\n/** Known values of {@link MatchingMethod} that the service accepts. */\nexport enum KnownMatchingMethod {\n  /** Grouping alerts into a single incident if all the entities match */\n  AllEntities = \"AllEntities\",\n  /** Grouping any alerts triggered by this rule into a single incident */\n  AnyAlert = \"AnyAlert\",\n  /** Grouping alerts into a single incident if the selected entities, custom details and alert details match */\n  Selected = \"Selected\"\n}\n\n/**\n * Defines values for MatchingMethod. \\\n * {@link KnownMatchingMethod} can be used interchangeably with MatchingMethod,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **AllEntities**: Grouping alerts into a single incident if all the entities match \\\n * **AnyAlert**: Grouping any alerts triggered by this rule into a single incident \\\n * **Selected**: Grouping alerts into a single incident if the selected entities, custom details and alert details match\n */\nexport type MatchingMethod = string;\n\n/** Known values of {@link AlertDetail} that the service accepts. */\nexport enum KnownAlertDetail {\n  /** Alert display name */\n  DisplayName = \"DisplayName\",\n  /** Alert severity */\n  Severity = \"Severity\"\n}\n\n/**\n * Defines values for AlertDetail. \\\n * {@link KnownAlertDetail} can be used interchangeably with AlertDetail,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **DisplayName**: Alert display name \\\n * **Severity**: Alert severity\n */\nexport type AlertDetail = string;\n\n/** Known values of {@link AutomationRuleBooleanConditionSupportedOperator} that the service accepts. */\nexport enum KnownAutomationRuleBooleanConditionSupportedOperator {\n  /** Evaluates as true if all the item conditions are evaluated as true */\n  And = \"And\",\n  /** Evaluates as true if at least one of the item conditions are evaluated as true */\n  Or = \"Or\"\n}\n\n/**\n * Defines values for AutomationRuleBooleanConditionSupportedOperator. \\\n * {@link KnownAutomationRuleBooleanConditionSupportedOperator} can be used interchangeably with AutomationRuleBooleanConditionSupportedOperator,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **And**: Evaluates as true if all the item conditions are evaluated as true \\\n * **Or**: Evaluates as true if at least one of the item conditions are evaluated as true\n */\nexport type AutomationRuleBooleanConditionSupportedOperator = string;\n\n/** Known values of {@link AutomationRulePropertyArrayChangedConditionSupportedArrayType} that the service accepts. */\nexport enum KnownAutomationRulePropertyArrayChangedConditionSupportedArrayType {\n  /** Evaluate the condition on the alerts */\n  Alerts = \"Alerts\",\n  /** Evaluate the condition on the labels */\n  Labels = \"Labels\",\n  /** Evaluate the condition on the tactics */\n  Tactics = \"Tactics\",\n  /** Evaluate the condition on the comments */\n  Comments = \"Comments\"\n}\n\n/**\n * Defines values for AutomationRulePropertyArrayChangedConditionSupportedArrayType. \\\n * {@link KnownAutomationRulePropertyArrayChangedConditionSupportedArrayType} can be used interchangeably with AutomationRulePropertyArrayChangedConditionSupportedArrayType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Alerts**: Evaluate the condition on the alerts \\\n * **Labels**: Evaluate the condition on the labels \\\n * **Tactics**: Evaluate the condition on the tactics \\\n * **Comments**: Evaluate the condition on the comments\n */\nexport type AutomationRulePropertyArrayChangedConditionSupportedArrayType = string;\n\n/** Known values of {@link AutomationRulePropertyArrayChangedConditionSupportedChangeType} that the service accepts. */\nexport enum KnownAutomationRulePropertyArrayChangedConditionSupportedChangeType {\n  /** Evaluate the condition on items added to the array */\n  Added = \"Added\"\n}\n\n/**\n * Defines values for AutomationRulePropertyArrayChangedConditionSupportedChangeType. \\\n * {@link KnownAutomationRulePropertyArrayChangedConditionSupportedChangeType} can be used interchangeably with AutomationRulePropertyArrayChangedConditionSupportedChangeType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Added**: Evaluate the condition on items added to the array\n */\nexport type AutomationRulePropertyArrayChangedConditionSupportedChangeType = string;\n\n/** Known values of {@link AutomationRulePropertyArrayConditionSupportedArrayType} that the service accepts. */\nexport enum KnownAutomationRulePropertyArrayConditionSupportedArrayType {\n  /** Evaluate the condition on the custom detail keys */\n  CustomDetails = \"CustomDetails\",\n  /** Evaluate the condition on a custom detail's values */\n  CustomDetailValues = \"CustomDetailValues\"\n}\n\n/**\n * Defines values for AutomationRulePropertyArrayConditionSupportedArrayType. \\\n * {@link KnownAutomationRulePropertyArrayConditionSupportedArrayType} can be used interchangeably with AutomationRulePropertyArrayConditionSupportedArrayType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **CustomDetails**: Evaluate the condition on the custom detail keys \\\n * **CustomDetailValues**: Evaluate the condition on a custom detail's values\n */\nexport type AutomationRulePropertyArrayConditionSupportedArrayType = string;\n\n/** Known values of {@link AutomationRulePropertyArrayConditionSupportedArrayConditionType} that the service accepts. */\nexport enum KnownAutomationRulePropertyArrayConditionSupportedArrayConditionType {\n  /** Evaluate the condition as true if any item fulfills it */\n  AnyItem = \"AnyItem\"\n}\n\n/**\n * Defines values for AutomationRulePropertyArrayConditionSupportedArrayConditionType. \\\n * {@link KnownAutomationRulePropertyArrayConditionSupportedArrayConditionType} can be used interchangeably with AutomationRulePropertyArrayConditionSupportedArrayConditionType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **AnyItem**: Evaluate the condition as true if any item fulfills it\n */\nexport type AutomationRulePropertyArrayConditionSupportedArrayConditionType = string;\n\n/** Known values of {@link AutomationRulePropertyChangedConditionSupportedPropertyType} that the service accepts. */\nexport enum KnownAutomationRulePropertyChangedConditionSupportedPropertyType {\n  /** Evaluate the condition on the incident severity */\n  IncidentSeverity = \"IncidentSeverity\",\n  /** Evaluate the condition on the incident status */\n  IncidentStatus = \"IncidentStatus\",\n  /** Evaluate the condition on the incident owner */\n  IncidentOwner = \"IncidentOwner\"\n}\n\n/**\n * Defines values for AutomationRulePropertyChangedConditionSupportedPropertyType. \\\n * {@link KnownAutomationRulePropertyChangedConditionSupportedPropertyType} can be used interchangeably with AutomationRulePropertyChangedConditionSupportedPropertyType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **IncidentSeverity**: Evaluate the condition on the incident severity \\\n * **IncidentStatus**: Evaluate the condition on the incident status \\\n * **IncidentOwner**: Evaluate the condition on the incident owner\n */\nexport type AutomationRulePropertyChangedConditionSupportedPropertyType = string;\n\n/** Known values of {@link AutomationRulePropertyChangedConditionSupportedChangedType} that the service accepts. */\nexport enum KnownAutomationRulePropertyChangedConditionSupportedChangedType {\n  /** Evaluate the condition on the previous value of the property */\n  ChangedFrom = \"ChangedFrom\",\n  /** Evaluate the condition on the updated value of the property */\n  ChangedTo = \"ChangedTo\"\n}\n\n/**\n * Defines values for AutomationRulePropertyChangedConditionSupportedChangedType. \\\n * {@link KnownAutomationRulePropertyChangedConditionSupportedChangedType} can be used interchangeably with AutomationRulePropertyChangedConditionSupportedChangedType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **ChangedFrom**: Evaluate the condition on the previous value of the property \\\n * **ChangedTo**: Evaluate the condition on the updated value of the property\n */\nexport type AutomationRulePropertyChangedConditionSupportedChangedType = string;\n\n/** Known values of {@link AutomationRulePropertyConditionSupportedOperator} that the service accepts. */\nexport enum KnownAutomationRulePropertyConditionSupportedOperator {\n  /** Evaluates if the property equals at least one of the condition values */\n  Equals = \"Equals\",\n  /** Evaluates if the property does not equal any of the condition values */\n  NotEquals = \"NotEquals\",\n  /** Evaluates if the property contains at least one of the condition values */\n  Contains = \"Contains\",\n  /** Evaluates if the property does not contain any of the condition values */\n  NotContains = \"NotContains\",\n  /** Evaluates if the property starts with any of the condition values */\n  StartsWith = \"StartsWith\",\n  /** Evaluates if the property does not start with any of the condition values */\n  NotStartsWith = \"NotStartsWith\",\n  /** Evaluates if the property ends with any of the condition values */\n  EndsWith = \"EndsWith\",\n  /** Evaluates if the property does not end with any of the condition values */\n  NotEndsWith = \"NotEndsWith\"\n}\n\n/**\n * Defines values for AutomationRulePropertyConditionSupportedOperator. \\\n * {@link KnownAutomationRulePropertyConditionSupportedOperator} can be used interchangeably with AutomationRulePropertyConditionSupportedOperator,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Equals**: Evaluates if the property equals at least one of the condition values \\\n * **NotEquals**: Evaluates if the property does not equal any of the condition values \\\n * **Contains**: Evaluates if the property contains at least one of the condition values \\\n * **NotContains**: Evaluates if the property does not contain any of the condition values \\\n * **StartsWith**: Evaluates if the property starts with any of the condition values \\\n * **NotStartsWith**: Evaluates if the property does not start with any of the condition values \\\n * **EndsWith**: Evaluates if the property ends with any of the condition values \\\n * **NotEndsWith**: Evaluates if the property does not end with any of the condition values\n */\nexport type AutomationRulePropertyConditionSupportedOperator = string;\n\n/** Known values of {@link AutomationRulePropertyConditionSupportedProperty} that the service accepts. */\nexport enum KnownAutomationRulePropertyConditionSupportedProperty {\n  /** The title of the incident */\n  IncidentTitle = \"IncidentTitle\",\n  /** The description of the incident */\n  IncidentDescription = \"IncidentDescription\",\n  /** The severity of the incident */\n  IncidentSeverity = \"IncidentSeverity\",\n  /** The status of the incident */\n  IncidentStatus = \"IncidentStatus\",\n  /** The related Analytic rule ids of the incident */\n  IncidentRelatedAnalyticRuleIds = \"IncidentRelatedAnalyticRuleIds\",\n  /** The tactics of the incident */\n  IncidentTactics = \"IncidentTactics\",\n  /** The labels of the incident */\n  IncidentLabel = \"IncidentLabel\",\n  /** The provider name of the incident */\n  IncidentProviderName = \"IncidentProviderName\",\n  /** The update source of the incident */\n  IncidentUpdatedBySource = \"IncidentUpdatedBySource\",\n  /** The incident custom detail key */\n  IncidentCustomDetailsKey = \"IncidentCustomDetailsKey\",\n  /** The incident custom detail value */\n  IncidentCustomDetailsValue = \"IncidentCustomDetailsValue\",\n  /** The account Azure Active Directory tenant id */\n  AccountAadTenantId = \"AccountAadTenantId\",\n  /** The account Azure Active Directory user id */\n  AccountAadUserId = \"AccountAadUserId\",\n  /** The account name */\n  AccountName = \"AccountName\",\n  /** The account NetBIOS domain name */\n  AccountNTDomain = \"AccountNTDomain\",\n  /** The account Azure Active Directory Passport User ID */\n  AccountPuid = \"AccountPUID\",\n  /** The account security identifier */\n  AccountSid = \"AccountSid\",\n  /** The account unique identifier */\n  AccountObjectGuid = \"AccountObjectGuid\",\n  /** The account user principal name suffix */\n  AccountUPNSuffix = \"AccountUPNSuffix\",\n  /** The name of the product of the alert */\n  AlertProductNames = \"AlertProductNames\",\n  /** The analytic rule ids of the alert */\n  AlertAnalyticRuleIds = \"AlertAnalyticRuleIds\",\n  /** The Azure resource id */\n  AzureResourceResourceId = \"AzureResourceResourceId\",\n  /** The Azure resource subscription id */\n  AzureResourceSubscriptionId = \"AzureResourceSubscriptionId\",\n  /** The cloud application identifier */\n  CloudApplicationAppId = \"CloudApplicationAppId\",\n  /** The cloud application name */\n  CloudApplicationAppName = \"CloudApplicationAppName\",\n  /** The dns record domain name */\n  DNSDomainName = \"DNSDomainName\",\n  /** The file directory full path */\n  FileDirectory = \"FileDirectory\",\n  /** The file name without path */\n  FileName = \"FileName\",\n  /** The file hash value */\n  FileHashValue = \"FileHashValue\",\n  /** The host Azure resource id */\n  HostAzureID = \"HostAzureID\",\n  /** The host name without domain */\n  HostName = \"HostName\",\n  /** The host NetBIOS name */\n  HostNetBiosName = \"HostNetBiosName\",\n  /** The host NT domain */\n  HostNTDomain = \"HostNTDomain\",\n  /** The host operating system */\n  HostOSVersion = \"HostOSVersion\",\n  /** \"The IoT device id */\n  IoTDeviceId = \"IoTDeviceId\",\n  /** The IoT device name */\n  IoTDeviceName = \"IoTDeviceName\",\n  /** The IoT device type */\n  IoTDeviceType = \"IoTDeviceType\",\n  /** The IoT device vendor */\n  IoTDeviceVendor = \"IoTDeviceVendor\",\n  /** The IoT device model */\n  IoTDeviceModel = \"IoTDeviceModel\",\n  /** The IoT device operating system */\n  IoTDeviceOperatingSystem = \"IoTDeviceOperatingSystem\",\n  /** The IP address */\n  IPAddress = \"IPAddress\",\n  /** The mailbox display name */\n  MailboxDisplayName = \"MailboxDisplayName\",\n  /** The mailbox primary address */\n  MailboxPrimaryAddress = \"MailboxPrimaryAddress\",\n  /** The mailbox user principal name */\n  MailboxUPN = \"MailboxUPN\",\n  /** The mail message delivery action */\n  MailMessageDeliveryAction = \"MailMessageDeliveryAction\",\n  /** The mail message delivery location */\n  MailMessageDeliveryLocation = \"MailMessageDeliveryLocation\",\n  /** The mail message recipient */\n  MailMessageRecipient = \"MailMessageRecipient\",\n  /** The mail message sender IP address */\n  MailMessageSenderIP = \"MailMessageSenderIP\",\n  /** The mail message subject */\n  MailMessageSubject = \"MailMessageSubject\",\n  /** The mail message P1 sender */\n  MailMessageP1Sender = \"MailMessageP1Sender\",\n  /** The mail message P2 sender */\n  MailMessageP2Sender = \"MailMessageP2Sender\",\n  /** The malware category */\n  MalwareCategory = \"MalwareCategory\",\n  /** The malware name */\n  MalwareName = \"MalwareName\",\n  /** The process execution command line */\n  ProcessCommandLine = \"ProcessCommandLine\",\n  /** The process id */\n  ProcessId = \"ProcessId\",\n  /** The registry key path */\n  RegistryKey = \"RegistryKey\",\n  /** The registry key value in string formatted representation */\n  RegistryValueData = \"RegistryValueData\",\n  /** The url */\n  Url = \"Url\"\n}\n\n/**\n * Defines values for AutomationRulePropertyConditionSupportedProperty. \\\n * {@link KnownAutomationRulePropertyConditionSupportedProperty} can be used interchangeably with AutomationRulePropertyConditionSupportedProperty,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **IncidentTitle**: The title of the incident \\\n * **IncidentDescription**: The description of the incident \\\n * **IncidentSeverity**: The severity of the incident \\\n * **IncidentStatus**: The status of the incident \\\n * **IncidentRelatedAnalyticRuleIds**: The related Analytic rule ids of the incident \\\n * **IncidentTactics**: The tactics of the incident \\\n * **IncidentLabel**: The labels of the incident \\\n * **IncidentProviderName**: The provider name of the incident \\\n * **IncidentUpdatedBySource**: The update source of the incident \\\n * **IncidentCustomDetailsKey**: The incident custom detail key \\\n * **IncidentCustomDetailsValue**: The incident custom detail value \\\n * **AccountAadTenantId**: The account Azure Active Directory tenant id \\\n * **AccountAadUserId**: The account Azure Active Directory user id \\\n * **AccountName**: The account name \\\n * **AccountNTDomain**: The account NetBIOS domain name \\\n * **AccountPUID**: The account Azure Active Directory Passport User ID \\\n * **AccountSid**: The account security identifier \\\n * **AccountObjectGuid**: The account unique identifier \\\n * **AccountUPNSuffix**: The account user principal name suffix \\\n * **AlertProductNames**: The name of the product of the alert \\\n * **AlertAnalyticRuleIds**: The analytic rule ids of the alert \\\n * **AzureResourceResourceId**: The Azure resource id \\\n * **AzureResourceSubscriptionId**: The Azure resource subscription id \\\n * **CloudApplicationAppId**: The cloud application identifier \\\n * **CloudApplicationAppName**: The cloud application name \\\n * **DNSDomainName**: The dns record domain name \\\n * **FileDirectory**: The file directory full path \\\n * **FileName**: The file name without path \\\n * **FileHashValue**: The file hash value \\\n * **HostAzureID**: The host Azure resource id \\\n * **HostName**: The host name without domain \\\n * **HostNetBiosName**: The host NetBIOS name \\\n * **HostNTDomain**: The host NT domain \\\n * **HostOSVersion**: The host operating system \\\n * **IoTDeviceId**: \"The IoT device id \\\n * **IoTDeviceName**: The IoT device name \\\n * **IoTDeviceType**: The IoT device type \\\n * **IoTDeviceVendor**: The IoT device vendor \\\n * **IoTDeviceModel**: The IoT device model \\\n * **IoTDeviceOperatingSystem**: The IoT device operating system \\\n * **IPAddress**: The IP address \\\n * **MailboxDisplayName**: The mailbox display name \\\n * **MailboxPrimaryAddress**: The mailbox primary address \\\n * **MailboxUPN**: The mailbox user principal name \\\n * **MailMessageDeliveryAction**: The mail message delivery action \\\n * **MailMessageDeliveryLocation**: The mail message delivery location \\\n * **MailMessageRecipient**: The mail message recipient \\\n * **MailMessageSenderIP**: The mail message sender IP address \\\n * **MailMessageSubject**: The mail message subject \\\n * **MailMessageP1Sender**: The mail message P1 sender \\\n * **MailMessageP2Sender**: The mail message P2 sender \\\n * **MalwareCategory**: The malware category \\\n * **MalwareName**: The malware name \\\n * **ProcessCommandLine**: The process execution command line \\\n * **ProcessId**: The process id \\\n * **RegistryKey**: The registry key path \\\n * **RegistryValueData**: The registry key value in string formatted representation \\\n * **Url**: The url\n */\nexport type AutomationRulePropertyConditionSupportedProperty = string;\n\n/** Known values of {@link EntityType} that the service accepts. */\nexport enum KnownEntityType {\n  /** Entity represents account in the system. */\n  Account = \"Account\",\n  /** Entity represents host in the system. */\n  Host = \"Host\",\n  /** Entity represents file in the system. */\n  File = \"File\",\n  /** Entity represents azure resource in the system. */\n  AzureResource = \"AzureResource\",\n  /** Entity represents cloud application in the system. */\n  CloudApplication = \"CloudApplication\",\n  /** Entity represents dns in the system. */\n  DNS = \"DNS\",\n  /** Entity represents file hash in the system. */\n  FileHash = \"FileHash\",\n  /** Entity represents ip in the system. */\n  IP = \"IP\",\n  /** Entity represents malware in the system. */\n  Malware = \"Malware\",\n  /** Entity represents process in the system. */\n  Process = \"Process\",\n  /** Entity represents registry key in the system. */\n  RegistryKey = \"RegistryKey\",\n  /** Entity represents registry value in the system. */\n  RegistryValue = \"RegistryValue\",\n  /** Entity represents security group in the system. */\n  SecurityGroup = \"SecurityGroup\",\n  /** Entity represents url in the system. */\n  URL = \"URL\",\n  /** Entity represents IoT device in the system. */\n  IoTDevice = \"IoTDevice\",\n  /** Entity represents security alert in the system. */\n  SecurityAlert = \"SecurityAlert\",\n  /** Entity represents HuntingBookmark in the system. */\n  HuntingBookmark = \"HuntingBookmark\",\n  /** Entity represents mail cluster in the system. */\n  MailCluster = \"MailCluster\",\n  /** Entity represents mail message in the system. */\n  MailMessage = \"MailMessage\",\n  /** Entity represents mailbox in the system. */\n  Mailbox = \"Mailbox\",\n  /** Entity represents submission mail in the system. */\n  SubmissionMail = \"SubmissionMail\",\n  /** Entity represents network interface in the system. */\n  Nic = \"Nic\"\n}\n\n/**\n * Defines values for EntityType. \\\n * {@link KnownEntityType} can be used interchangeably with EntityType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Account**: Entity represents account in the system. \\\n * **Host**: Entity represents host in the system. \\\n * **File**: Entity represents file in the system. \\\n * **AzureResource**: Entity represents azure resource in the system. \\\n * **CloudApplication**: Entity represents cloud application in the system. \\\n * **DNS**: Entity represents dns in the system. \\\n * **FileHash**: Entity represents file hash in the system. \\\n * **IP**: Entity represents ip in the system. \\\n * **Malware**: Entity represents malware in the system. \\\n * **Process**: Entity represents process in the system. \\\n * **RegistryKey**: Entity represents registry key in the system. \\\n * **RegistryValue**: Entity represents registry value in the system. \\\n * **SecurityGroup**: Entity represents security group in the system. \\\n * **URL**: Entity represents url in the system. \\\n * **IoTDevice**: Entity represents IoT device in the system. \\\n * **SecurityAlert**: Entity represents security alert in the system. \\\n * **HuntingBookmark**: Entity represents HuntingBookmark in the system. \\\n * **MailCluster**: Entity represents mail cluster in the system. \\\n * **MailMessage**: Entity represents mail message in the system. \\\n * **Mailbox**: Entity represents mailbox in the system. \\\n * **SubmissionMail**: Entity represents submission mail in the system. \\\n * **Nic**: Entity represents network interface in the system.\n */\nexport type EntityType = string;\n\n/** Known values of {@link OutputType} that the service accepts. */\nexport enum KnownOutputType {\n  /** Number */\n  Number = \"Number\",\n  /** String */\n  String = \"String\",\n  /** Date */\n  Date = \"Date\",\n  /** Entity */\n  Entity = \"Entity\"\n}\n\n/**\n * Defines values for OutputType. \\\n * {@link KnownOutputType} can be used interchangeably with OutputType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Number** \\\n * **String** \\\n * **Date** \\\n * **Entity**\n */\nexport type OutputType = string;\n\n/** Known values of {@link SettingsStatus} that the service accepts. */\nexport enum KnownSettingsStatus {\n  /** Anomaly settings status in Production mode */\n  Production = \"Production\",\n  /** Anomaly settings status in Flighting mode */\n  Flighting = \"Flighting\"\n}\n\n/**\n * Defines values for SettingsStatus. \\\n * {@link KnownSettingsStatus} can be used interchangeably with SettingsStatus,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Production**: Anomaly settings status in Production mode \\\n * **Flighting**: Anomaly settings status in Flighting mode\n */\nexport type SettingsStatus = string;\n\n/** Known values of {@link EntityProviders} that the service accepts. */\nexport enum KnownEntityProviders {\n  /** ActiveDirectory */\n  ActiveDirectory = \"ActiveDirectory\",\n  /** AzureActiveDirectory */\n  AzureActiveDirectory = \"AzureActiveDirectory\"\n}\n\n/**\n * Defines values for EntityProviders. \\\n * {@link KnownEntityProviders} can be used interchangeably with EntityProviders,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **ActiveDirectory** \\\n * **AzureActiveDirectory**\n */\nexport type EntityProviders = string;\n\n/** Known values of {@link UebaDataSources} that the service accepts. */\nexport enum KnownUebaDataSources {\n  /** AuditLogs */\n  AuditLogs = \"AuditLogs\",\n  /** AzureActivity */\n  AzureActivity = \"AzureActivity\",\n  /** SecurityEvent */\n  SecurityEvent = \"SecurityEvent\",\n  /** SigninLogs */\n  SigninLogs = \"SigninLogs\"\n}\n\n/**\n * Defines values for UebaDataSources. \\\n * {@link KnownUebaDataSources} can be used interchangeably with UebaDataSources,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **AuditLogs** \\\n * **AzureActivity** \\\n * **SecurityEvent** \\\n * **SigninLogs**\n */\nexport type UebaDataSources = string;\n\n/** Known values of {@link DataTypeState} that the service accepts. */\nexport enum KnownDataTypeState {\n  /** Enabled */\n  Enabled = \"Enabled\",\n  /** Disabled */\n  Disabled = \"Disabled\"\n}\n\n/**\n * Defines values for DataTypeState. \\\n * {@link KnownDataTypeState} can be used interchangeably with DataTypeState,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Enabled** \\\n * **Disabled**\n */\nexport type DataTypeState = string;\n\n/** Known values of {@link PollingFrequency} that the service accepts. */\nexport enum KnownPollingFrequency {\n  /** Once a minute */\n  OnceAMinute = \"OnceAMinute\",\n  /** Once an hour */\n  OnceAnHour = \"OnceAnHour\",\n  /** Once a day */\n  OnceADay = \"OnceADay\"\n}\n\n/**\n * Defines values for PollingFrequency. \\\n * {@link KnownPollingFrequency} can be used interchangeably with PollingFrequency,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **OnceAMinute**: Once a minute \\\n * **OnceAnHour**: Once an hour \\\n * **OnceADay**: Once a day\n */\nexport type PollingFrequency = string;\n\n/** Known values of {@link ConnectivityType} that the service accepts. */\nexport enum KnownConnectivityType {\n  /** IsConnectedQuery */\n  IsConnectedQuery = \"IsConnectedQuery\"\n}\n\n/**\n * Defines values for ConnectivityType. \\\n * {@link KnownConnectivityType} can be used interchangeably with ConnectivityType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **IsConnectedQuery**\n */\nexport type ConnectivityType = string;\n\n/** Known values of {@link ProviderName} that the service accepts. */\nexport enum KnownProviderName {\n  /** MicrosoftOperationalInsightsSolutions */\n  MicrosoftOperationalInsightsSolutions = \"Microsoft.OperationalInsights/solutions\",\n  /** MicrosoftOperationalInsightsWorkspaces */\n  MicrosoftOperationalInsightsWorkspaces = \"Microsoft.OperationalInsights/workspaces\",\n  /** MicrosoftOperationalInsightsWorkspacesDatasources */\n  MicrosoftOperationalInsightsWorkspacesDatasources = \"Microsoft.OperationalInsights/workspaces/datasources\",\n  /** MicrosoftAadiamDiagnosticSettings */\n  MicrosoftAadiamDiagnosticSettings = \"microsoft.aadiam/diagnosticSettings\",\n  /** MicrosoftOperationalInsightsWorkspacesSharedKeys */\n  MicrosoftOperationalInsightsWorkspacesSharedKeys = \"Microsoft.OperationalInsights/workspaces/sharedKeys\",\n  /** MicrosoftAuthorizationPolicyAssignments */\n  MicrosoftAuthorizationPolicyAssignments = \"Microsoft.Authorization/policyAssignments\"\n}\n\n/**\n * Defines values for ProviderName. \\\n * {@link KnownProviderName} can be used interchangeably with ProviderName,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Microsoft.OperationalInsights\\/solutions** \\\n * **Microsoft.OperationalInsights\\/workspaces** \\\n * **Microsoft.OperationalInsights\\/workspaces\\/datasources** \\\n * **microsoft.aadiam\\/diagnosticSettings** \\\n * **Microsoft.OperationalInsights\\/workspaces\\/sharedKeys** \\\n * **Microsoft.Authorization\\/policyAssignments**\n */\nexport type ProviderName = string;\n\n/** Known values of {@link PermissionProviderScope} that the service accepts. */\nexport enum KnownPermissionProviderScope {\n  /** ResourceGroup */\n  ResourceGroup = \"ResourceGroup\",\n  /** Subscription */\n  Subscription = \"Subscription\",\n  /** Workspace */\n  Workspace = \"Workspace\"\n}\n\n/**\n * Defines values for PermissionProviderScope. \\\n * {@link KnownPermissionProviderScope} can be used interchangeably with PermissionProviderScope,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **ResourceGroup** \\\n * **Subscription** \\\n * **Workspace**\n */\nexport type PermissionProviderScope = string;\n\n/** Known values of {@link SettingType} that the service accepts. */\nexport enum KnownSettingType {\n  /** CopyableLabel */\n  CopyableLabel = \"CopyableLabel\",\n  /** InstructionStepsGroup */\n  InstructionStepsGroup = \"InstructionStepsGroup\",\n  /** InfoMessage */\n  InfoMessage = \"InfoMessage\"\n}\n\n/**\n * Defines values for SettingType. \\\n * {@link KnownSettingType} can be used interchangeably with SettingType,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **CopyableLabel** \\\n * **InstructionStepsGroup** \\\n * **InfoMessage**\n */\nexport type SettingType = string;\n\n/** Known values of {@link FileHashAlgorithm} that the service accepts. */\nexport enum KnownFileHashAlgorithm {\n  /** Unknown hash algorithm */\n  Unknown = \"Unknown\",\n  /** MD5 hash type */\n  MD5 = \"MD5\",\n  /** SHA1 hash type */\n  SHA1 = \"SHA1\",\n  /** SHA256 hash type */\n  SHA256 = \"SHA256\",\n  /** SHA256 Authenticode hash type */\n  SHA256AC = \"SHA256AC\"\n}\n\n/**\n * Defines values for FileHashAlgorithm. \\\n * {@link KnownFileHashAlgorithm} can be used interchangeably with FileHashAlgorithm,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Unknown**: Unknown hash algorithm \\\n * **MD5**: MD5 hash type \\\n * **SHA1**: SHA1 hash type \\\n * **SHA256**: SHA256 hash type \\\n * **SHA256AC**: SHA256 Authenticode hash type\n */\nexport type FileHashAlgorithm = string;\n\n/** Known values of {@link DeviceImportance} that the service accepts. */\nexport enum KnownDeviceImportance {\n  /** Unknown - Default value */\n  Unknown = \"Unknown\",\n  /** Low */\n  Low = \"Low\",\n  /** Normal */\n  Normal = \"Normal\",\n  /** High */\n  High = \"High\"\n}\n\n/**\n * Defines values for DeviceImportance. \\\n * {@link KnownDeviceImportance} can be used interchangeably with DeviceImportance,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Unknown**: Unknown - Default value \\\n * **Low**: Low \\\n * **Normal**: Normal \\\n * **High**: High\n */\nexport type DeviceImportance = string;\n\n/** Known values of {@link AntispamMailDirection} that the service accepts. */\nexport enum KnownAntispamMailDirection {\n  /** Unknown */\n  Unknown = \"Unknown\",\n  /** Inbound */\n  Inbound = \"Inbound\",\n  /** Outbound */\n  Outbound = \"Outbound\",\n  /** Intraorg */\n  Intraorg = \"Intraorg\"\n}\n\n/**\n * Defines values for AntispamMailDirection. \\\n * {@link KnownAntispamMailDirection} can be used interchangeably with AntispamMailDirection,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **Unknown**: Unknown \\\n * **Inbound**: Inbound \\\n * **Outbound**: Outbound \\\n * **Intraorg**: Intraorg\n */\nexport type AntispamMailDirection = string;\n\n/** Known values of {@link RegistryHive} that the service accepts. */\nexport enum KnownRegistryHive {\n  /** HKEY_LOCAL_MACHINE */\n  HkeyLocalMachine = \"HKEY_LOCAL_MACHINE\",\n  /** HKEY_CLASSES_ROOT */\n  HkeyClassesRoot = \"HKEY_CLASSES_ROOT\",\n  /** HKEY_CURRENT_CONFIG */\n  HkeyCurrentConfig = \"HKEY_CURRENT_CONFIG\",\n  /** HKEY_USERS */\n  HkeyUsers = \"HKEY_USERS\",\n  /** HKEY_CURRENT_USER_LOCAL_SETTINGS */\n  HkeyCurrentUserLocalSettings = \"HKEY_CURRENT_USER_LOCAL_SETTINGS\",\n  /** HKEY_PERFORMANCE_DATA */\n  HkeyPerformanceData = \"HKEY_PERFORMANCE_DATA\",\n  /** HKEY_PERFORMANCE_NLSTEXT */\n  HkeyPerformanceNlstext = \"HKEY_PERFORMANCE_NLSTEXT\",\n  /** HKEY_PERFORMANCE_TEXT */\n  HkeyPerformanceText = \"HKEY_PERFORMANCE_TEXT\",\n  /** HKEY_A */\n  HkeyA = \"HKEY_A\",\n  /** HKEY_CURRENT_USER */\n  HkeyCurrentUser = \"HKEY_CURRENT_USER\"\n}\n\n/**\n * Defines values for RegistryHive. \\\n * {@link KnownRegistryHive} can be used interchangeably with RegistryHive,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **HKEY_LOCAL_MACHINE**: HKEY_LOCAL_MACHINE \\\n * **HKEY_CLASSES_ROOT**: HKEY_CLASSES_ROOT \\\n * **HKEY_CURRENT_CONFIG**: HKEY_CURRENT_CONFIG \\\n * **HKEY_USERS**: HKEY_USERS \\\n * **HKEY_CURRENT_USER_LOCAL_SETTINGS**: HKEY_CURRENT_USER_LOCAL_SETTINGS \\\n * **HKEY_PERFORMANCE_DATA**: HKEY_PERFORMANCE_DATA \\\n * **HKEY_PERFORMANCE_NLSTEXT**: HKEY_PERFORMANCE_NLSTEXT \\\n * **HKEY_PERFORMANCE_TEXT**: HKEY_PERFORMANCE_TEXT \\\n * **HKEY_A**: HKEY_A \\\n * **HKEY_CURRENT_USER**: HKEY_CURRENT_USER\n */\nexport type RegistryHive = string;\n\n/** Known values of {@link RegistryValueKind} that the service accepts. */\nexport enum KnownRegistryValueKind {\n  /** None */\n  None = \"None\",\n  /** Unknown value type */\n  Unknown = \"Unknown\",\n  /** String value type */\n  String = \"String\",\n  /** ExpandString value type */\n  ExpandString = \"ExpandString\",\n  /** Binary value type */\n  Binary = \"Binary\",\n  /** DWord value type */\n  DWord = \"DWord\",\n  /** MultiString value type */\n  MultiString = \"MultiString\",\n  /** QWord value type */\n  QWord = \"QWord\"\n}\n\n/**\n * Defines values for RegistryValueKind. \\\n * {@link KnownRegistryValueKind} can be used interchangeably with RegistryValueKind,\n *  this enum contains the known values that the service supports.\n * ### Known values supported by the service\n * **None**: None \\\n * **Unknown**: Unknown value type \\\n * **String**: String value type \\\n * **ExpandString**: ExpandString value type \\\n * **Binary**: Binary value type \\\n * **DWord**: DWord value type \\\n * **MultiString**: MultiString value type \\\n * **QWord**: QWord value type\n */\nexport type RegistryValueKind = string;\n/** Defines values for TriggerOperator. */\nexport type TriggerOperator = \"GreaterThan\" | \"LessThan\" | \"Equal\" | \"NotEqual\";\n/** Defines values for OSFamily. */\nexport type OSFamily = \"Linux\" | \"Windows\" | \"Android\" | \"IOS\" | \"Unknown\";\n/** Defines values for DeliveryAction. */\nexport type DeliveryAction =\n  | \"Unknown\"\n  | \"DeliveredAsSpam\"\n  | \"Delivered\"\n  | \"Blocked\"\n  | \"Replaced\";\n/** Defines values for DeliveryLocation. */\nexport type DeliveryLocation =\n  | \"Unknown\"\n  | \"Inbox\"\n  | \"JunkFolder\"\n  | \"DeletedFolder\"\n  | \"Quarantine\"\n  | \"External\"\n  | \"Failed\"\n  | \"Dropped\"\n  | \"Forwarded\";\n/** Defines values for ElevationToken. */\nexport type ElevationToken = \"Default\" | \"Full\" | \"Limited\";\n\n/** Optional parameters. */\nexport interface AlertRulesListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type AlertRulesListResponse = AlertRulesList;\n\n/** Optional parameters. */\nexport interface AlertRulesGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type AlertRulesGetResponse = AlertRuleUnion;\n\n/** Optional parameters. */\nexport interface AlertRulesCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type AlertRulesCreateOrUpdateResponse = AlertRuleUnion;\n\n/** Optional parameters. */\nexport interface AlertRulesDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface AlertRulesListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type AlertRulesListNextResponse = AlertRulesList;\n\n/** Optional parameters. */\nexport interface ActionsListByAlertRuleOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listByAlertRule operation. */\nexport type ActionsListByAlertRuleResponse = ActionsList;\n\n/** Optional parameters. */\nexport interface ActionsGetOptionalParams extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type ActionsGetResponse = ActionResponse;\n\n/** Optional parameters. */\nexport interface ActionsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type ActionsCreateOrUpdateResponse = ActionResponse;\n\n/** Optional parameters. */\nexport interface ActionsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface ActionsListByAlertRuleNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listByAlertRuleNext operation. */\nexport type ActionsListByAlertRuleNextResponse = ActionsList;\n\n/** Optional parameters. */\nexport interface AlertRuleTemplatesListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type AlertRuleTemplatesListResponse = AlertRuleTemplatesList;\n\n/** Optional parameters. */\nexport interface AlertRuleTemplatesGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type AlertRuleTemplatesGetResponse = AlertRuleTemplateUnion;\n\n/** Optional parameters. */\nexport interface AlertRuleTemplatesListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type AlertRuleTemplatesListNextResponse = AlertRuleTemplatesList;\n\n/** Optional parameters. */\nexport interface AutomationRulesGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type AutomationRulesGetResponse = AutomationRule;\n\n/** Optional parameters. */\nexport interface AutomationRulesCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {\n  /** The automation rule */\n  automationRuleToUpsert?: AutomationRule;\n}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type AutomationRulesCreateOrUpdateResponse = AutomationRule;\n\n/** Optional parameters. */\nexport interface AutomationRulesDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the delete operation. */\nexport type AutomationRulesDeleteResponse = Record<string, unknown>;\n\n/** Optional parameters. */\nexport interface AutomationRulesListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type AutomationRulesListResponse = AutomationRulesList;\n\n/** Optional parameters. */\nexport interface AutomationRulesListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type AutomationRulesListNextResponse = AutomationRulesList;\n\n/** Optional parameters. */\nexport interface IncidentsRunPlaybookOptionalParams\n  extends coreClient.OperationOptions {\n  requestBody?: ManualTriggerRequestBody;\n}\n\n/** Contains response data for the runPlaybook operation. */\nexport type IncidentsRunPlaybookResponse = Record<string, unknown>;\n\n/** Optional parameters. */\nexport interface IncidentsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type IncidentsListResponse = IncidentList;\n\n/** Optional parameters. */\nexport interface IncidentsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type IncidentsGetResponse = Incident;\n\n/** Optional parameters. */\nexport interface IncidentsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type IncidentsCreateOrUpdateResponse = Incident;\n\n/** Optional parameters. */\nexport interface IncidentsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface IncidentsCreateTeamOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createTeam operation. */\nexport type IncidentsCreateTeamResponse = TeamInformation;\n\n/** Optional parameters. */\nexport interface IncidentsListAlertsOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listAlerts operation. */\nexport type IncidentsListAlertsResponse = IncidentAlertList;\n\n/** Optional parameters. */\nexport interface IncidentsListBookmarksOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listBookmarks operation. */\nexport type IncidentsListBookmarksResponse = IncidentBookmarkList;\n\n/** Optional parameters. */\nexport interface IncidentsListEntitiesOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listEntities operation. */\nexport type IncidentsListEntitiesResponse = IncidentEntitiesResponse;\n\n/** Optional parameters. */\nexport interface IncidentsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type IncidentsListNextResponse = IncidentList;\n\n/** Optional parameters. */\nexport interface BookmarksListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type BookmarksListResponse = BookmarkList;\n\n/** Optional parameters. */\nexport interface BookmarksGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type BookmarksGetResponse = Bookmark;\n\n/** Optional parameters. */\nexport interface BookmarksCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type BookmarksCreateOrUpdateResponse = Bookmark;\n\n/** Optional parameters. */\nexport interface BookmarksDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface BookmarksListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type BookmarksListNextResponse = BookmarkList;\n\n/** Optional parameters. */\nexport interface BookmarkRelationsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type BookmarkRelationsListResponse = RelationList;\n\n/** Optional parameters. */\nexport interface BookmarkRelationsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type BookmarkRelationsGetResponse = Relation;\n\n/** Optional parameters. */\nexport interface BookmarkRelationsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type BookmarkRelationsCreateOrUpdateResponse = Relation;\n\n/** Optional parameters. */\nexport interface BookmarkRelationsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface BookmarkRelationsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type BookmarkRelationsListNextResponse = RelationList;\n\n/** Optional parameters. */\nexport interface BookmarkExpandOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the expand operation. */\nexport type BookmarkExpandOperationResponse = BookmarkExpandResponse;\n\n/** Optional parameters. */\nexport interface IPGeodataGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type IPGeodataGetResponse = EnrichmentIpGeodata;\n\n/** Optional parameters. */\nexport interface DomainWhoisGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type DomainWhoisGetResponse = EnrichmentDomainWhois;\n\n/** Optional parameters. */\nexport interface EntitiesListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type EntitiesListResponse = EntityList;\n\n/** Optional parameters. */\nexport interface EntitiesGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type EntitiesGetResponse = EntityUnion;\n\n/** Optional parameters. */\nexport interface EntitiesExpandOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the expand operation. */\nexport type EntitiesExpandResponse = EntityExpandResponse;\n\n/** Optional parameters. */\nexport interface EntitiesQueriesOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the queries operation. */\nexport type EntitiesQueriesResponse = GetQueriesResponse;\n\n/** Optional parameters. */\nexport interface EntitiesGetInsightsOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the getInsights operation. */\nexport type EntitiesGetInsightsResponse = EntityGetInsightsResponse;\n\n/** Optional parameters. */\nexport interface EntitiesListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type EntitiesListNextResponse = EntityList;\n\n/** Optional parameters. */\nexport interface EntitiesGetTimelineListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type EntitiesGetTimelineListResponse = EntityTimelineResponse;\n\n/** Optional parameters. */\nexport interface EntitiesRelationsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type EntitiesRelationsListResponse = RelationList;\n\n/** Optional parameters. */\nexport interface EntitiesRelationsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type EntitiesRelationsListNextResponse = RelationList;\n\n/** Optional parameters. */\nexport interface EntityRelationsGetRelationOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the getRelation operation. */\nexport type EntityRelationsGetRelationResponse = Relation;\n\n/** Optional parameters. */\nexport interface EntityQueriesListOptionalParams\n  extends coreClient.OperationOptions {\n  /** The entity query kind we want to fetch */\n  kind?: Enum13;\n}\n\n/** Contains response data for the list operation. */\nexport type EntityQueriesListResponse = EntityQueryList;\n\n/** Optional parameters. */\nexport interface EntityQueriesGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type EntityQueriesGetResponse = EntityQueryUnion;\n\n/** Optional parameters. */\nexport interface EntityQueriesCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type EntityQueriesCreateOrUpdateResponse = EntityQueryUnion;\n\n/** Optional parameters. */\nexport interface EntityQueriesDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface EntityQueriesListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type EntityQueriesListNextResponse = EntityQueryList;\n\n/** Optional parameters. */\nexport interface EntityQueryTemplatesListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type EntityQueryTemplatesListResponse = EntityQueryTemplateList;\n\n/** Optional parameters. */\nexport interface EntityQueryTemplatesGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type EntityQueryTemplatesGetResponse = EntityQueryTemplateUnion;\n\n/** Optional parameters. */\nexport interface EntityQueryTemplatesListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type EntityQueryTemplatesListNextResponse = EntityQueryTemplateList;\n\n/** Optional parameters. */\nexport interface FileImportsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type FileImportsListResponse = FileImportList;\n\n/** Optional parameters. */\nexport interface FileImportsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type FileImportsGetResponse = FileImport;\n\n/** Optional parameters. */\nexport interface FileImportsCreateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the create operation. */\nexport type FileImportsCreateResponse = FileImport;\n\n/** Optional parameters. */\nexport interface FileImportsDeleteOptionalParams\n  extends coreClient.OperationOptions {\n  /** Delay to wait until next poll, in milliseconds. */\n  updateIntervalInMs?: number;\n  /** A serialized poller which can be used to resume an existing paused Long-Running-Operation. */\n  resumeFrom?: string;\n}\n\n/** Contains response data for the delete operation. */\nexport type FileImportsDeleteResponse = FileImport;\n\n/** Optional parameters. */\nexport interface FileImportsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type FileImportsListNextResponse = FileImportList;\n\n/** Optional parameters. */\nexport interface IncidentCommentsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type IncidentCommentsListResponse = IncidentCommentList;\n\n/** Optional parameters. */\nexport interface IncidentCommentsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type IncidentCommentsGetResponse = IncidentComment;\n\n/** Optional parameters. */\nexport interface IncidentCommentsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type IncidentCommentsCreateOrUpdateResponse = IncidentComment;\n\n/** Optional parameters. */\nexport interface IncidentCommentsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface IncidentCommentsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type IncidentCommentsListNextResponse = IncidentCommentList;\n\n/** Optional parameters. */\nexport interface IncidentRelationsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type IncidentRelationsListResponse = RelationList;\n\n/** Optional parameters. */\nexport interface IncidentRelationsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type IncidentRelationsGetResponse = Relation;\n\n/** Optional parameters. */\nexport interface IncidentRelationsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type IncidentRelationsCreateOrUpdateResponse = Relation;\n\n/** Optional parameters. */\nexport interface IncidentRelationsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface IncidentRelationsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type IncidentRelationsListNextResponse = RelationList;\n\n/** Optional parameters. */\nexport interface MetadataListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left. */\n  skip?: number;\n}\n\n/** Contains response data for the list operation. */\nexport type MetadataListResponse = MetadataList;\n\n/** Optional parameters. */\nexport interface MetadataGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type MetadataGetResponse = MetadataModel;\n\n/** Optional parameters. */\nexport interface MetadataDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface MetadataCreateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the create operation. */\nexport type MetadataCreateResponse = MetadataModel;\n\n/** Optional parameters. */\nexport interface MetadataUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the update operation. */\nexport type MetadataUpdateResponse = MetadataModel;\n\n/** Optional parameters. */\nexport interface MetadataListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type MetadataListNextResponse = MetadataList;\n\n/** Optional parameters. */\nexport interface OfficeConsentsListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type OfficeConsentsListResponse = OfficeConsentList;\n\n/** Optional parameters. */\nexport interface OfficeConsentsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type OfficeConsentsGetResponse = OfficeConsent;\n\n/** Optional parameters. */\nexport interface OfficeConsentsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface OfficeConsentsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type OfficeConsentsListNextResponse = OfficeConsentList;\n\n/** Optional parameters. */\nexport interface SentinelOnboardingStatesGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type SentinelOnboardingStatesGetResponse = SentinelOnboardingState;\n\n/** Optional parameters. */\nexport interface SentinelOnboardingStatesCreateOptionalParams\n  extends coreClient.OperationOptions {\n  /** The Sentinel onboarding state parameter */\n  sentinelOnboardingStateParameter?: SentinelOnboardingState;\n}\n\n/** Contains response data for the create operation. */\nexport type SentinelOnboardingStatesCreateResponse = SentinelOnboardingState;\n\n/** Optional parameters. */\nexport interface SentinelOnboardingStatesDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface SentinelOnboardingStatesListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type SentinelOnboardingStatesListResponse = SentinelOnboardingStatesList;\n\n/** Optional parameters. */\nexport interface SecurityMLAnalyticsSettingsListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type SecurityMLAnalyticsSettingsListResponse = SecurityMLAnalyticsSettingsList;\n\n/** Optional parameters. */\nexport interface SecurityMLAnalyticsSettingsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type SecurityMLAnalyticsSettingsGetResponse = SecurityMLAnalyticsSettingUnion;\n\n/** Optional parameters. */\nexport interface SecurityMLAnalyticsSettingsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type SecurityMLAnalyticsSettingsCreateOrUpdateResponse = SecurityMLAnalyticsSettingUnion;\n\n/** Optional parameters. */\nexport interface SecurityMLAnalyticsSettingsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface SecurityMLAnalyticsSettingsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type SecurityMLAnalyticsSettingsListNextResponse = SecurityMLAnalyticsSettingsList;\n\n/** Optional parameters. */\nexport interface ProductSettingsListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type ProductSettingsListResponse = SettingList;\n\n/** Optional parameters. */\nexport interface ProductSettingsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type ProductSettingsGetResponse = SettingsUnion;\n\n/** Optional parameters. */\nexport interface ProductSettingsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface ProductSettingsUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the update operation. */\nexport type ProductSettingsUpdateResponse = SettingsUnion;\n\n/** Optional parameters. */\nexport interface SourceControlListRepositoriesOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listRepositories operation. */\nexport type SourceControlListRepositoriesResponse = RepoList;\n\n/** Optional parameters. */\nexport interface SourceControlListRepositoriesNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listRepositoriesNext operation. */\nexport type SourceControlListRepositoriesNextResponse = RepoList;\n\n/** Optional parameters. */\nexport interface SourceControlsListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type SourceControlsListResponse = SourceControlList;\n\n/** Optional parameters. */\nexport interface SourceControlsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type SourceControlsGetResponse = SourceControl;\n\n/** Optional parameters. */\nexport interface SourceControlsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface SourceControlsCreateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the create operation. */\nexport type SourceControlsCreateResponse = SourceControl;\n\n/** Optional parameters. */\nexport interface SourceControlsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type SourceControlsListNextResponse = SourceControlList;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorCreateIndicatorOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createIndicator operation. */\nexport type ThreatIntelligenceIndicatorCreateIndicatorResponse = ThreatIntelligenceInformationUnion;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type ThreatIntelligenceIndicatorGetResponse = ThreatIntelligenceInformationUnion;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorCreateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the create operation. */\nexport type ThreatIntelligenceIndicatorCreateResponse = ThreatIntelligenceInformationUnion;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorQueryIndicatorsOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the queryIndicators operation. */\nexport type ThreatIntelligenceIndicatorQueryIndicatorsResponse = ThreatIntelligenceInformationList;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorAppendTagsOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorReplaceTagsOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the replaceTags operation. */\nexport type ThreatIntelligenceIndicatorReplaceTagsResponse = ThreatIntelligenceInformationUnion;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorQueryIndicatorsNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the queryIndicatorsNext operation. */\nexport type ThreatIntelligenceIndicatorQueryIndicatorsNextResponse = ThreatIntelligenceInformationList;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Filters the results, based on a Boolean condition. Optional. */\n  filter?: string;\n  /** Sorts the results. Optional. */\n  orderby?: string;\n  /** Returns only the first n results. Optional. */\n  top?: number;\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type ThreatIntelligenceIndicatorsListResponse = ThreatIntelligenceInformationList;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type ThreatIntelligenceIndicatorsListNextResponse = ThreatIntelligenceInformationList;\n\n/** Optional parameters. */\nexport interface ThreatIntelligenceIndicatorMetricsListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type ThreatIntelligenceIndicatorMetricsListResponse = ThreatIntelligenceMetricsList;\n\n/** Optional parameters. */\nexport interface WatchlistsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type WatchlistsListResponse = WatchlistList;\n\n/** Optional parameters. */\nexport interface WatchlistsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type WatchlistsGetResponse = Watchlist;\n\n/** Optional parameters. */\nexport interface WatchlistsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the delete operation. */\nexport type WatchlistsDeleteResponse = WatchlistsDeleteHeaders;\n\n/** Optional parameters. */\nexport interface WatchlistsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type WatchlistsCreateOrUpdateResponse = Watchlist;\n\n/** Optional parameters. */\nexport interface WatchlistsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type WatchlistsListNextResponse = WatchlistList;\n\n/** Optional parameters. */\nexport interface WatchlistItemsListOptionalParams\n  extends coreClient.OperationOptions {\n  /** Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. */\n  skipToken?: string;\n}\n\n/** Contains response data for the list operation. */\nexport type WatchlistItemsListResponse = WatchlistItemList;\n\n/** Optional parameters. */\nexport interface WatchlistItemsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type WatchlistItemsGetResponse = WatchlistItem;\n\n/** Optional parameters. */\nexport interface WatchlistItemsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface WatchlistItemsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type WatchlistItemsCreateOrUpdateResponse = WatchlistItem;\n\n/** Optional parameters. */\nexport interface WatchlistItemsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type WatchlistItemsListNextResponse = WatchlistItemList;\n\n/** Optional parameters. */\nexport interface DataConnectorsListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type DataConnectorsListResponse = DataConnectorList;\n\n/** Optional parameters. */\nexport interface DataConnectorsGetOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the get operation. */\nexport type DataConnectorsGetResponse = DataConnectorUnion;\n\n/** Optional parameters. */\nexport interface DataConnectorsCreateOrUpdateOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the createOrUpdate operation. */\nexport type DataConnectorsCreateOrUpdateResponse = DataConnectorUnion;\n\n/** Optional parameters. */\nexport interface DataConnectorsDeleteOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface DataConnectorsConnectOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface DataConnectorsDisconnectOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Optional parameters. */\nexport interface DataConnectorsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type DataConnectorsListNextResponse = DataConnectorList;\n\n/** Optional parameters. */\nexport interface DataConnectorsCheckRequirementsPostOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the post operation. */\nexport type DataConnectorsCheckRequirementsPostResponse = DataConnectorRequirementsState;\n\n/** Optional parameters. */\nexport interface OperationsListOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the list operation. */\nexport type OperationsListResponse = OperationsList;\n\n/** Optional parameters. */\nexport interface OperationsListNextOptionalParams\n  extends coreClient.OperationOptions {}\n\n/** Contains response data for the listNext operation. */\nexport type OperationsListNextResponse = OperationsList;\n\n/** Optional parameters. */\nexport interface SecurityInsightsOptionalParams\n  extends coreClient.ServiceClientOptions {\n  /** server parameter */\n  $host?: string;\n  /** Api Version */\n  apiVersion?: string;\n  /** Overrides client endpoint. */\n  endpoint?: string;\n}\n"]}