@microsoft/msgraph-sdk 1.0.0-preview.73 → 1.0.0-preview.75

package/models/security/index.d.ts

@@ -1,8 +1,50 @@
 import { type BaseCollectionPaginationCountResponse, type Entity, type Group, type IdentitySet, type PhysicalAddress, type PublicError, type ResultInfo, type Site } from '../index.js';
 import { type AdditionalDataHolder, type BackedModel, type Duration, type Guid, type Parsable, type ParseNode, type SerializationWriter } from '@microsoft/kiota-abstractions';
+export interface Account extends AdditionalDataHolder, BackedModel, Parsable {
+    /**
+     * List of the type of action. The possible values are: disable, enable, forcePasswordReset, revokeAllSessions, requireUserToSignInAgain, markUserAsCompromised, unknownFutureValue.
+     */
+    actions?: Action[] | null;
+    /**
+     * Stores model information.
+     */
+    backingStoreEnabled?: boolean | null;
+    /**
+     * The account ID.
+     */
+    identifier?: string | null;
+    /**
+     * The identityProvider property
+     */
+    identityProvider?: IdentityProvider | null;
+    /**
+     * The OdataType property
+     */
+    odataType?: string | null;
+}
+export type Action = (typeof ActionObject)[keyof typeof ActionObject];
 export type ActionAfterRetentionPeriod = (typeof ActionAfterRetentionPeriodObject)[keyof typeof ActionAfterRetentionPeriodObject];
 export type AdditionalDataOptions = (typeof AdditionalDataOptionsObject)[keyof typeof AdditionalDataOptionsObject];
 export type AdditionalOptions = (typeof AdditionalOptionsObject)[keyof typeof AdditionalOptionsObject];
+export interface AiAgentEvidence extends AlertEvidence, Parsable {
+    /**
+     * The unique identifier for the AI agent.
+     */
+    agentId?: string | null;
+    /**
+     * The display name for the AI agent.
+     */
+    agentName?: string | null;
+    /**
+     * Type of the platform the agent runs on. Possible values are: unknown, azureAIFoundry, copilotStudio, copilot, unknownFutureValue.
+     */
+    hostingPlatformType?: AiAgentPlatform | null;
+    /**
+     * The instructions of the agent.
+     */
+    instructions?: string | null;
+}
+export type AiAgentPlatform = (typeof AiAgentPlatformObject)[keyof typeof AiAgentPlatformObject];
 export interface Alert extends Entity, Parsable {
     /**
      * The adversary or activity group that is associated with this alert.
@@ -76,6 +118,10 @@ export interface Alert extends Entity, Parsable {
      * URL for the incident page in the Microsoft 365 Defender portal.
      */
     incidentWebUrl?: string | null;
+    /**
+     * Information on the current status of the investigation. Possible values are: unknown, terminated, successfullyRemediated, benign, failed, partiallyRemediated, running, pendingApproval, pendingResource, queued, innerFailure, preexistingAlert, unsupportedOs, unsupportedAlertType, suppressedAlert, partiallyInvestigated, terminatedByUser, terminatedBySystem, unknownFutureValue.
+     */
+    investigationState?: InvestigationState | null;
     /**
      * The oldest activity associated with the alert.
      */
@@ -663,6 +709,18 @@ export interface ContainerRegistryEvidence extends AlertEvidence, Parsable {
     registry?: string | null;
 }
 export type ContentFormat = (typeof ContentFormatObject)[keyof typeof ContentFormatObject];
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {Account}
+ */
+export declare function createAccountFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {AiAgentEvidence}
+ */
+export declare function createAiAgentEvidenceFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
 /**
  * Creates a new instance of the appropriate class based on discriminator value
  * @param parseNode The parse node to use to read the discriminator value and create the object
@@ -1377,6 +1435,18 @@ export declare function createHuntingRowResultFromDiscriminatorValue(parseNode:
  * @returns {Hyperlink}
  */
 export declare function createHyperlinkFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {IdentityAccountsCollectionResponse}
+ */
+export declare function createIdentityAccountsCollectionResponseFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {IdentityAccounts}
+ */
+export declare function createIdentityAccountsFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
 /**
  * Creates a new instance of the appropriate class based on discriminator value
  * @param parseNode The parse node to use to read the discriminator value and create the object
@@ -1431,6 +1501,12 @@ export declare function createIntelligenceProfileIndicatorCollectionResponseFrom
  * @returns {IntelligenceProfileIndicator}
  */
 export declare function createIntelligenceProfileIndicatorFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {InvokeActionResult}
+ */
+export declare function createInvokeActionResultFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
 /**
  * Creates a new instance of the appropriate class based on discriminator value
  * @param parseNode The parse node to use to read the discriminator value and create the object
@@ -1689,6 +1765,24 @@ export declare function createSearchFromDiscriminatorValue(parseNode: ParseNode
  * @returns {SecurityGroupEvidence}
  */
 export declare function createSecurityGroupEvidenceFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {SensorCandidateActivationConfiguration}
+ */
+export declare function createSensorCandidateActivationConfigurationFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {SensorCandidateCollectionResponse}
+ */
+export declare function createSensorCandidateCollectionResponseFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {SensorCandidate}
+ */
+export declare function createSensorCandidateFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
 /**
  * Creates a new instance of the appropriate class based on discriminator value
  * @param parseNode The parse node to use to read the discriminator value and create the object
@@ -1863,6 +1957,12 @@ export declare function createUserAccountFromDiscriminatorValue(parseNode: Parse
  * @returns {UserEvidence}
  */
 export declare function createUserEvidenceFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
+/**
+ * Creates a new instance of the appropriate class based on discriminator value
+ * @param parseNode The parse node to use to read the discriminator value and create the object
+ * @returns {User}
+ */
+export declare function createUserFromDiscriminatorValue(parseNode: ParseNode | undefined): ((instance?: Parsable) => Record<string, (node: ParseNode) => void>);
 /**
  * Creates a new instance of the appropriate class based on discriminator value
  * @param parseNode The parse node to use to read the discriminator value and create the object
@@ -2065,6 +2165,18 @@ export interface DeploymentAccessKeyType extends AdditionalDataHolder, BackedMod
     odataType?: string | null;
 }
 export type DeploymentStatus = (typeof DeploymentStatusObject)[keyof typeof DeploymentStatusObject];
+/**
+ * The deserialization information for the current model
+ * @param Account The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoAccount(account?: Partial<Account> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param AiAgentEvidence The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoAiAgentEvidence(aiAgentEvidence?: Partial<AiAgentEvidence> | undefined): Record<string, (node: ParseNode) => void>;
 /**
  * The deserialization information for the current model
  * @param Alert The instance to deserialize into.
@@ -2779,6 +2891,18 @@ export declare function deserializeIntoHuntingRowResult(huntingRowResult?: Parti
  * @returns {Record<string, (node: ParseNode) => void>}
  */
 export declare function deserializeIntoHyperlink(hyperlink?: Partial<Hyperlink> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param IdentityAccounts The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoIdentityAccounts(identityAccounts?: Partial<IdentityAccounts> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param IdentityAccountsCollectionResponse The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoIdentityAccountsCollectionResponse(identityAccountsCollectionResponse?: Partial<IdentityAccountsCollectionResponse> | undefined): Record<string, (node: ParseNode) => void>;
 /**
  * The deserialization information for the current model
  * @param IdentityContainer The instance to deserialize into.
@@ -2833,6 +2957,12 @@ export declare function deserializeIntoIntelligenceProfileIndicator(intelligence
  * @returns {Record<string, (node: ParseNode) => void>}
  */
 export declare function deserializeIntoIntelligenceProfileIndicatorCollectionResponse(intelligenceProfileIndicatorCollectionResponse?: Partial<IntelligenceProfileIndicatorCollectionResponse> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param InvokeActionResult The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoInvokeActionResult(invokeActionResult?: Partial<InvokeActionResult> | undefined): Record<string, (node: ParseNode) => void>;
 /**
  * The deserialization information for the current model
  * @param IoTDeviceEvidence The instance to deserialize into.
@@ -3097,6 +3227,24 @@ export declare function deserializeIntoSecurityGroupEvidence(securityGroupEviden
  * @returns {Record<string, (node: ParseNode) => void>}
  */
 export declare function deserializeIntoSensor(sensor?: Partial<Sensor> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param SensorCandidate The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoSensorCandidate(sensorCandidate?: Partial<SensorCandidate> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param SensorCandidateActivationConfiguration The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoSensorCandidateActivationConfiguration(sensorCandidateActivationConfiguration?: Partial<SensorCandidateActivationConfiguration> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param SensorCandidateCollectionResponse The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoSensorCandidateCollectionResponse(sensorCandidateCollectionResponse?: Partial<SensorCandidateCollectionResponse> | undefined): Record<string, (node: ParseNode) => void>;
 /**
  * The deserialization information for the current model
  * @param SensorCollectionResponse The instance to deserialize into.
@@ -3253,6 +3401,12 @@ export declare function deserializeIntoUnifiedGroupSourceCollectionResponse(unif
  * @returns {Record<string, (node: ParseNode) => void>}
  */
 export declare function deserializeIntoUrlEvidence(urlEvidence?: Partial<UrlEvidence> | undefined): Record<string, (node: ParseNode) => void>;
+/**
+ * The deserialization information for the current model
+ * @param User The instance to deserialize into.
+ * @returns {Record<string, (node: ParseNode) => void>}
+ */
+export declare function deserializeIntoUser(user?: Partial<User> | undefined): Record<string, (node: ParseNode) => void>;
 /**
  * The deserialization information for the current model
  * @param UserAccount The instance to deserialize into.
@@ -3672,7 +3826,7 @@ export interface EdiscoveryExportOperation extends CaseOperation, Parsable {
      */
     exportOptions?: ExportOptions[] | null;
     /**
-     * The options that specify the structure of the export. For more information, see reviewSet: export. Possible values are: none, directory (deprecated), pst, unknownFutureValue, msg. Use the Prefer: include-unknown-enum-members request header to get the following value from this evolvable enum: msg. The directory member is deprecated. It remains in v1.0 for backward compatibility. Going forward, use either pst or msg.
+     * The options that specify the structure of the export. For more information, see reviewSet: export. Possible values are: none, directory (deprecated), pst, unknownFutureValue, msg. Use the Prefer: include-unknown-enum-members request header to get the following members from this evolvable enum: msg. The directory member is deprecated. It remains in v1.0 for backward compatibility. Going forward, use either pst or msg.
      */
     exportStructure?: ExportFileStructure | null;
     /**
@@ -4805,16 +4959,61 @@ export interface Hyperlink extends AdditionalDataHolder, BackedModel, Parsable {
      */
     url?: string | null;
 }
+export interface IdentityAccounts extends Entity, Parsable {
+    /**
+     * Collection of accounts of the identity in different identity providers.
+     */
+    accounts?: Account[] | null;
+    /**
+     * The cloud security identifier of the identityAccount.
+     */
+    cloudSecurityIdentifier?: string | null;
+    /**
+     * The  Active Directory display name of the identityAccount.
+     */
+    displayName?: string | null;
+    /**
+     * The Active Directory domain name of the identityAccount.
+     */
+    domain?: string | null;
+    /**
+     * Boolean indicating if the identityAccounts is enabled.
+     */
+    isEnabled?: boolean | null;
+    /**
+     * The on-premises security identifier of the identityAccount.
+     */
+    onPremisesSecurityIdentifier?: string | null;
+}
+export interface IdentityAccountsCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
+    /**
+     * The value property
+     */
+    value?: IdentityAccounts[] | null;
+}
 export interface IdentityContainer extends Entity, Parsable {
     /**
      * Represents potential issues identified by Microsoft Defender for Identity within a customer's Microsoft Defender for Identity configuration.
      */
     healthIssues?: HealthIssue[] | null;
+    /**
+     * Represents an identity's details in the context of Microsoft Defender for Identity.
+     */
+    identityAccounts?: IdentityAccounts[] | null;
+    /**
+     * The sensorCandidateActivationConfiguration property
+     */
+    sensorCandidateActivationConfiguration?: SensorCandidateActivationConfiguration | null;
+    /**
+     * Represents Microsoft Defender for Identity sensors that are ready to be activated.
+     */
+    sensorCandidates?: SensorCandidate[] | null;
     /**
      * Represents a customer's Microsoft Defender for Identity sensors.
      */
     sensors?: Sensor[] | null;
 }
+export type IdentityProvider = (typeof IdentityProviderObject)[keyof typeof IdentityProviderObject];
 export interface Incident extends Entity, Parsable {
     /**
      * The list of related alerts. Supports $expand.
@@ -4994,6 +5193,33 @@ export interface IntelligenceProfileIndicatorCollectionResponse extends BaseColl
     value?: IntelligenceProfileIndicator[] | null;
 }
 export type IntelligenceProfileKind = (typeof IntelligenceProfileKindObject)[keyof typeof IntelligenceProfileKindObject];
+export type InvestigationState = (typeof InvestigationStateObject)[keyof typeof InvestigationStateObject];
+export interface InvokeActionResult extends AdditionalDataHolder, BackedModel, Parsable {
+    /**
+     * The account ID.
+     */
+    accountId?: string | null;
+    /**
+     * The action property
+     */
+    action?: Action | null;
+    /**
+     * Stores model information.
+     */
+    backingStoreEnabled?: boolean | null;
+    /**
+     * The unique identifier for tracking the request.
+     */
+    correlationId?: string | null;
+    /**
+     * The identityProvider property
+     */
+    identityProvider?: IdentityProvider | null;
+    /**
+     * The OdataType property
+     */
+    odataType?: string | null;
+}
 export interface IoTDeviceEvidence extends AlertEvidence, Parsable {
     /**
      * The device ID.
@@ -6074,6 +6300,33 @@ export interface Sensor extends Entity, Parsable {
      */
     version?: string | null;
 }
+export interface SensorCandidate extends Entity, Parsable {
+    /**
+     * The DNS name of the computer associated with the sensor.
+     */
+    computerDnsName?: string | null;
+    /**
+     * The date and time when the sensor was last seen.
+     */
+    lastSeenDateTime?: Date | null;
+    /**
+     * The version of the Defender for Identity sensor client. Supports $filter (eq).
+     */
+    senseClientVersion?: string | null;
+}
+export interface SensorCandidateActivationConfiguration extends Entity, Parsable {
+    /**
+     * The activationMode property
+     */
+    activationMode?: SensorCandidateActivationMode | null;
+}
+export type SensorCandidateActivationMode = (typeof SensorCandidateActivationModeObject)[keyof typeof SensorCandidateActivationModeObject];
+export interface SensorCandidateCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
+    /**
+     * The value property
+     */
+    value?: SensorCandidate[] | null;
+}
 export interface SensorCollectionResponse extends BaseCollectionPaginationCountResponse, Parsable {
     /**
      * The value property
@@ -6126,6 +6379,20 @@ export interface SensorSettings extends AdditionalDataHolder, BackedModel, Parsa
     odataType?: string | null;
 }
 export type SensorType = (typeof SensorTypeObject)[keyof typeof SensorTypeObject];
+/**
+ * Serializes information the current object
+ * @param Account The instance to serialize from.
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeAccount(writer: SerializationWriter, account?: Partial<Account> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param AiAgentEvidence The instance to serialize from.
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeAiAgentEvidence(writer: SerializationWriter, aiAgentEvidence?: Partial<AiAgentEvidence> | undefined | null, isSerializingDerivedType?: boolean): void;
 /**
  * Serializes information the current object
  * @param Alert The instance to serialize from.
@@ -6959,6 +7226,20 @@ export declare function serializeHuntingRowResult(writer: SerializationWriter, h
  * @param writer Serialization writer to use to serialize this model
  */
 export declare function serializeHyperlink(writer: SerializationWriter, hyperlink?: Partial<Hyperlink> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param IdentityAccounts The instance to serialize from.
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeIdentityAccounts(writer: SerializationWriter, identityAccounts?: Partial<IdentityAccounts> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param IdentityAccountsCollectionResponse The instance to serialize from.
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeIdentityAccountsCollectionResponse(writer: SerializationWriter, identityAccountsCollectionResponse?: Partial<IdentityAccountsCollectionResponse> | undefined | null, isSerializingDerivedType?: boolean): void;
 /**
  * Serializes information the current object
  * @param IdentityContainer The instance to serialize from.
@@ -7022,6 +7303,13 @@ export declare function serializeIntelligenceProfileIndicator(writer: Serializat
  * @param writer Serialization writer to use to serialize this model
  */
 export declare function serializeIntelligenceProfileIndicatorCollectionResponse(writer: SerializationWriter, intelligenceProfileIndicatorCollectionResponse?: Partial<IntelligenceProfileIndicatorCollectionResponse> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param InvokeActionResult The instance to serialize from.
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeInvokeActionResult(writer: SerializationWriter, invokeActionResult?: Partial<InvokeActionResult> | undefined | null, isSerializingDerivedType?: boolean): void;
 /**
  * Serializes information the current object
  * @param IoTDeviceEvidence The instance to serialize from.
@@ -7330,6 +7618,27 @@ export declare function serializeSecurityGroupEvidence(writer: SerializationWrit
  * @param writer Serialization writer to use to serialize this model
  */
 export declare function serializeSensor(writer: SerializationWriter, sensor?: Partial<Sensor> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param SensorCandidate The instance to serialize from.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeSensorCandidate(writer: SerializationWriter, sensorCandidate?: Partial<SensorCandidate> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param SensorCandidateActivationConfiguration The instance to serialize from.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeSensorCandidateActivationConfiguration(writer: SerializationWriter, sensorCandidateActivationConfiguration?: Partial<SensorCandidateActivationConfiguration> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param SensorCandidateCollectionResponse The instance to serialize from.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeSensorCandidateCollectionResponse(writer: SerializationWriter, sensorCandidateCollectionResponse?: Partial<SensorCandidateCollectionResponse> | undefined | null, isSerializingDerivedType?: boolean): void;
 /**
  * Serializes information the current object
  * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
@@ -7512,6 +7821,13 @@ export declare function serializeUnifiedGroupSourceCollectionResponse(writer: Se
  * @param writer Serialization writer to use to serialize this model
  */
 export declare function serializeUrlEvidence(writer: SerializationWriter, urlEvidence?: Partial<UrlEvidence> | undefined | null, isSerializingDerivedType?: boolean): void;
+/**
+ * Serializes information the current object
+ * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
+ * @param User The instance to serialize from.
+ * @param writer Serialization writer to use to serialize this model
+ */
+export declare function serializeUser(writer: SerializationWriter, user?: Partial<User> | undefined | null, isSerializingDerivedType?: boolean): void;
 /**
  * Serializes information the current object
  * @param isSerializingDerivedType A boolean indicating whether the serialization is for a derived type.
@@ -8112,6 +8428,16 @@ export interface UrlEvidence extends AlertEvidence, Parsable {
      */
     url?: string | null;
 }
+export interface User extends IdentityAccounts, Parsable {
+    /**
+     * Email address of the user.
+     */
+    emailAddress?: string | null;
+    /**
+     * The user principal name.
+     */
+    userPrincipalName?: string | null;
+}
 export interface UserAccount extends AdditionalDataHolder, BackedModel, Parsable {
     /**
      * The displayed name of the user account.
@@ -8457,6 +8783,15 @@ export declare const ActionAfterRetentionPeriodObject: {
     readonly Relabel: "relabel";
     readonly UnknownFutureValue: "unknownFutureValue";
 };
+export declare const ActionObject: {
+    readonly Disable: "disable";
+    readonly Enable: "enable";
+    readonly ForcePasswordReset: "forcePasswordReset";
+    readonly RevokeAllSessions: "revokeAllSessions";
+    readonly RequireUserToSignInAgain: "requireUserToSignInAgain";
+    readonly MarkUserAsCompromised: "markUserAsCompromised";
+    readonly UnknownFutureValue: "unknownFutureValue";
+};
 export declare const AdditionalDataOptionsObject: {
     readonly AllVersions: "allVersions";
     readonly LinkedFiles: "linkedFiles";
@@ -8485,6 +8820,13 @@ export declare const AdditionalOptionsObject: {
     readonly SplitSource: "splitSource";
     readonly IncludeReport: "includeReport";
 };
+export declare const AiAgentPlatformObject: {
+    readonly Unknown: "unknown";
+    readonly AzureAIFoundry: "azureAIFoundry";
+    readonly CopilotStudio: "copilotStudio";
+    readonly Copilot: "copilot";
+    readonly UnknownFutureValue: "unknownFutureValue";
+};
 export declare const AlertClassificationObject: {
     readonly Unknown: "unknown";
     readonly FalsePositive: "falsePositive";
@@ -8862,6 +9204,12 @@ export declare const HostReputationRuleSeverityObject: {
     readonly High: "high";
     readonly UnknownFutureValue: "unknownFutureValue";
 };
+export declare const IdentityProviderObject: {
+    readonly EntraID: "entraID";
+    readonly ActiveDirectory: "activeDirectory";
+    readonly Okta: "okta";
+    readonly UnknownFutureValue: "unknownFutureValue";
+};
 export declare const IncidentStatusObject: {
     readonly Active: "active";
     readonly Resolved: "resolved";
@@ -8881,6 +9229,27 @@ export declare const IntelligenceProfileKindObject: {
     readonly Tool: "tool";
     readonly UnknownFutureValue: "unknownFutureValue";
 };
+export declare const InvestigationStateObject: {
+    readonly Unknown: "unknown";
+    readonly Terminated: "terminated";
+    readonly SuccessfullyRemediated: "successfullyRemediated";
+    readonly Benign: "benign";
+    readonly Failed: "failed";
+    readonly PartiallyRemediated: "partiallyRemediated";
+    readonly Running: "running";
+    readonly PendingApproval: "pendingApproval";
+    readonly PendingResource: "pendingResource";
+    readonly Queued: "queued";
+    readonly InnerFailure: "innerFailure";
+    readonly PreexistingAlert: "preexistingAlert";
+    readonly UnsupportedOs: "unsupportedOs";
+    readonly UnsupportedAlertType: "unsupportedAlertType";
+    readonly SuppressedAlert: "suppressedAlert";
+    readonly PartiallyInvestigated: "partiallyInvestigated";
+    readonly TerminatedByUser: "terminatedByUser";
+    readonly TerminatedBySystem: "terminatedBySystem";
+    readonly UnknownFutureValue: "unknownFutureValue";
+};
 export declare const IoTDeviceImportanceTypeObject: {
     readonly Unknown: "unknown";
     readonly Low: "low";
@@ -8956,6 +9325,11 @@ export declare const ReviewSetSettingsObject: {
     readonly DisableGrouping: "disableGrouping";
     readonly UnknownFutureValue: "unknownFutureValue";
 };
+export declare const SensorCandidateActivationModeObject: {
+    readonly Manual: "manual";
+    readonly Automated: "automated";
+    readonly UnknownFutureValue: "unknownFutureValue";
+};
 export declare const SensorHealthStatusObject: {
     readonly Healthy: "healthy";
     readonly NotHealthyLow: "notHealthyLow";