@microsoft/typespec-msgraph-reference 1.0.5 → 1.0.6

package/lib/Prod/V1.0/main.tsp

@@ -9542,9 +9542,6 @@ namespace reference.`microsoft.graph` {
     @references sponsors: directoryObject[];
   }
 
-  /**
-   * Represents a Microsoft Entra user account.
-   */
   @open
   @entity model agentUser extends user {
   }
@@ -12059,6 +12056,7 @@ files, events, and updates for people sharing a common interest or goal.
     appId: string | null;
     assetId: string | null;
     availableTo: packageStatus;
+    @computed createdDateTime: offsetDateTime | null;
     deployedTo: packageStatus;
     displayName: string | null;
     elementTypes: string[];
@@ -12083,6 +12081,7 @@ files, events, and updates for people sharing a common interest or goal.
     elementDetails: packageElementDetail[];
     longDescription: string | null;
     sensitivity: string | null;
+    sharedWithUsersAndGroups: packageAccessEntity[];
   }
 
   @entity model copilotReportRoot extends entity {
@@ -13770,6 +13769,7 @@ files, events, and updates for people sharing a common interest or goal.
     @contains federationConfigurations: identityProviderBase[];
     @contains onPremisesSynchronization: onPremisesDirectorySynchronization[];
     @contains publicKeyInfrastructure: publicKeyInfrastructureRoot | null;
+    @contains recovery: reference.`microsoft.graph.entraRecoveryServices`.recovery | null;
     @contains subscriptions: companySubscription[];
   }
 
@@ -14303,9 +14303,6 @@ files, events, and updates for people sharing a common interest or goal.
     policyName: string | null;
   }
 
-  /**
-   * Represents a container that exposes navigation properties for employee experience resources.
-   */
   @entity model employeeExperience extends MsGraph.SharedModels.entity {
     /**
      * A collection of communities in Viva Engage.
@@ -14807,7 +14804,7 @@ within the time frame of their original request.
     description: string | null;
     issuer: string;
     name: string;
-    subject: string;
+    subject: string | null;
   }
 
   @entity model federatedTokenValidationPolicy extends directoryObject {
@@ -14963,9 +14960,6 @@ within the time frame of their original request.
     siteId: string | null;
   }
 
-  /**
-   * Represents a Microsoft Entra group.
-   */
   @open
   @entity model group extends directoryObject {
     accessType: groupAccessType | null;
@@ -18421,9 +18415,6 @@ within the time frame of their original request.
     handler: onInteractiveAuthFlowStartHandler | null;
   }
 
-  /**
-   * Represents a Microsoft online meeting.
-   */
   @open
   @entity model onlineMeeting extends onlineMeetingBase {
     attendeeReport: stream | null;
@@ -19911,10 +19902,14 @@ within the time frame of their original request.
     vendorInformation: securityVendorInformation | null;
   }
 
+  /**
+   * Security singleton providing access to audit log resources.
+   */
   @entity model security extends MsGraph.SharedModels.entity {
     @contains alerts: alert[];
     @contains alerts_v2: reference.`microsoft.graph.security`.alert[];
     @contains attackSimulation: attackSimulationRoot | null;
+    @contains auditLog: reference.`microsoft.graph.security`.auditCoreRoot | null;
     @contains cases: reference.`microsoft.graph.security`.casesRoot | null;
     @contains collaboration: reference.`microsoft.graph.security`.collaborationRoot | null;
     @contains dataSecurityAndGovernance: tenantDataSecurityAndGovernance | null;
@@ -21436,9 +21431,6 @@ within the time frame of their original request.
     @references resource: entity | null;
   }
 
-  /**
-   * Represents a Microsoft Entra user account.
-   */
   @open
   @entity model user extends directoryObject {
     aboutMe: string | null;
@@ -36760,6 +36752,165 @@ namespace reference.`microsoft.graph.callRecords` {
     unknownFutureValue: 7,
   }
 
+}
+@publicNamespace("microsoft.graph.entrarecoveryservices")
+namespace reference.`microsoft.graph.entraRecoveryServices` {
+  @complex model entityTypeAndIds {
+    entityIds: string[];
+    entityType: resourceTypeName;
+  }
+
+  @complex model recoveryJobEntityNameAndIdsFilter extends recoveryJobFilteringCriteriaBase {
+    filterValues: entityTypeAndIds[];
+  }
+
+  @complex model recoveryJobEntityNamesFilter extends recoveryJobFilteringCriteriaBase {
+    entityTypes: resourceTypeName[];
+  }
+
+  @complex model recoveryJobFilteringCriteriaBase {
+  }
+
+  @entity model recovery extends reference.`microsoft.graph`.entity {
+    @contains jobs: recoveryJobBase[];
+    @contains snapshots: snapshot[];
+  }
+
+  @open
+  @entity model recoveryChangeObjectBase extends reference.`microsoft.graph`.entity {
+    displayName: string | null;
+    entityTypeName: resourceTypeName;
+    failureMessage: string | null;
+    recoveryAction: recoveryAction;
+  }
+
+  @entity model recoveryJob extends recoveryJobBase {
+    totalFailedChanges: int32 | null;
+    totalLinksModified: int32 | null;
+    totalObjectsModified: int32 | null;
+  }
+
+  @abstract
+  @entity model recoveryJobBase extends reference.`microsoft.graph`.entity {
+    filteringCriteria: recoveryJobFilteringCriteriaBase | null;
+    jobCompletionDateTime: offsetDateTime | null;
+    jobStartDateTime: offsetDateTime;
+    status: recoveryStatus;
+    targetStateDateTime: offsetDateTime;
+    totalChangedLinksCalculated: int32 | null;
+    totalChangedObjectsCalculated: int32 | null;
+  }
+
+  @entity model recoveryPreviewJob extends recoveryJobBase {
+  }
+
+  @entity model snapshot extends reference.`microsoft.graph`.entity {
+    @computed createdDateTime: offsetDateTime;
+    totalChangedObjects: int32 | null;
+    @references recoveryJobs: recoveryJob[];
+    @references recoveryPreviewJobs: recoveryPreviewJob[];
+  }
+
+  enum recoveryAction {
+    /**
+     * Represents a soft delete action during recovery
+     */
+    softDelete: 0,
+    /**
+     * Represents an update action during recovery
+     */
+    update: 1,
+    /**
+     * Represents a restore action during recovery
+     */
+    restore: 2,
+    unknownFutureValue: 3,
+  }
+
+  enum recoveryStatus {
+    /**
+     * Represents a job that has been initialized but has not been started yet
+     */
+    initialized: 0,
+    /**
+     * Represents a job that is in progress
+     */
+    running: 1,
+    /**
+     * Represents a job that ran successfully and is now complete
+     */
+    successful: 2,
+    /**
+     * Represents a job that we were not able to run successfully
+     */
+    failed: 3,
+    /**
+     * Represents a job that was abandoned by the user
+     */
+    abandoned: 4,
+    unknownFutureValue: 5,
+    /**
+     * Represents a job for which we have started calculating the diff/preview.
+     */
+    calculating: 6,
+    /**
+     * Represents a job for which we have started loading data of the snapshot.
+     */
+    loadingData: 7,
+  }
+
+  enum resourceTypeName {
+    /**
+     * Represents the user entity
+     */
+    user: 0,
+    /**
+     * Represents the group entity
+     */
+    group: 1,
+    /**
+     * Represents the conditional access policy entity
+     */
+    conditionalAccessPolicy: 2,
+    /**
+     * Represents the named location policy entity
+     */
+    namedLocationPolicy: 3,
+    /**
+     * Represents the authentication method policy entity
+     */
+    authenticationMethodPolicy: 4,
+    /**
+     * Represents the authorization policy entity
+     */
+    authorizationPolicy: 5,
+    /**
+     * Represents the authentication strength policy entity
+     */
+    authenticationStrengthPolicy: 6,
+    /**
+     * Represents the application entity
+     */
+    application: 7,
+    /**
+     * Represents the service principal entity
+     */
+    servicePrincipal: 8,
+    unknownFutureValue: 9,
+    /**
+     * Represents the oAuth2PermissionGrant entity.
+     */
+    oAuth2PermissionGrant: 10,
+    /**
+     * Represents the appRoleAssignment entity.
+     */
+    appRoleAssignment: 11,
+    /**
+     * Represents the organization entity.
+     */
+    organization: 12,
+  }
+
 }
 @publicNamespace("microsoft.graph.externalconnectors")
 namespace reference.`microsoft.graph.externalConnectors` {
@@ -37083,6 +37234,18 @@ namespace reference.`microsoft.graph.identityGovernance` {
     triggerAttributes: triggerAttribute[];
   }
 
+  @complex model cancelRunsScope extends cancelScope {
+    @references runs: run[];
+  }
+
+  @abstract
+  @complex model cancelScope {
+  }
+
+  @complex model countBasedQuarantineCondition extends quarantineCondition {
+    threshold: int64;
+  }
+
   @complex model customTaskExtensionCallbackConfiguration extends reference.`microsoft.graph`.customExtensionCallbackConfiguration {
     @references authorizedApps: reference.`microsoft.graph`.application[];
   }
@@ -37115,6 +37278,32 @@ namespace reference.`microsoft.graph.identityGovernance` {
     valueType: valueType;
   }
 
+  @complex model percentageBasedQuarantineCondition extends quarantineCondition {
+    percentage: int32;
+  }
+
+  @complex model previewFailedTask {
+    definitionId: string;
+    failureReason: string;
+    name: string;
+    taskId: string;
+  }
+
+  @abstract
+  @complex model quarantineCondition {
+  }
+
+  @complex model quarantineConfiguration {
+    conditions: quarantineCondition[];
+    matchMode: matchMode;
+  }
+
+  @complex model quarantineDetails {
+    quarantinedDateTime: offsetDateTime | null;
+    quarantineReason: string | null;
+    quarantineType: quarantineType;
+  }
+
   @complex model ruleBasedSubjectSet extends reference.`microsoft.graph`.subjectSet {
     rule: string;
   }
@@ -37201,6 +37390,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
   @complex model workflowExecutionTrigger {
   }
 
+  @complex model workflowSetting {
+    quarantineConfiguration: quarantineConfiguration | null;
+  }
+
   @complex model workflowsInsightsByCategory {
     failedJoinerRuns: int32;
     failedLeaverRuns: int32;
@@ -37238,6 +37431,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
 
   @entity model lifecycleManagementSettings extends reference.`microsoft.graph`.entity {
     emailSettings: reference.`microsoft.graph`.emailSettings;
+    quarantineConfiguration: quarantineConfiguration | null;
     workflowScheduleIntervalInHours: int32;
   }
 
@@ -37336,8 +37530,11 @@ namespace reference.`microsoft.graph.identityGovernance` {
     deletedDateTime: offsetDateTime | null;
     @computed @key id: string;
     nextScheduleRunDateTime: offsetDateTime | null;
+    quarantineDetails: quarantineDetails;
+    settings: workflowSetting;
     version: int32 | null;
     @references executionScope: userProcessingResult[];
+    @references previewScope: reference.`microsoft.graph`.directoryObject[];
     @contains runs: run[];
     @contains taskReports: taskReport[];
     @contains userProcessingResults: userProcessingResult[];
@@ -37369,6 +37566,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
   }
 
   @entity model workflowVersion extends workflowBase {
+    settings: workflowSetting;
     @computed @key versionNumber: int32;
   }
 
@@ -37413,6 +37611,14 @@ namespace reference.`microsoft.graph.identityGovernance` {
     canceled: 4,
     failed: 5,
     unknownFutureValue: 6,
+    canceling: 7,
+    quarantined: 8,
+  }
+
+  enum matchMode {
+    any: 0,
+    all: 1,
+    unknownFutureValue: 2,
   }
 
   enum membershipChangeType {
@@ -37421,6 +37627,14 @@ namespace reference.`microsoft.graph.identityGovernance` {
     unknownFutureValue: 3,
   }
 
+  enum quarantineType {
+    notQuarantined: 0,
+    countBasedThresholdExceeded: 1,
+    percentageBasedThresholdExceeded: 2,
+    multipleConditionsExceeded: 3,
+    unknownFutureValue: 4,
+  }
+
   enum valueType {
     `enum`: 0,
     `string`: 1,
@@ -37434,6 +37648,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
     onDemand: 1,
     unknownFutureValue: 2,
     activatedWithScope: 3,
+    preview: 4,
   }
 
   enum workflowTriggerTimeBasedAttribute {
@@ -37603,6 +37818,48 @@ namespace reference.`microsoft.graph.search` {
 // Metadata item DeprecatedDefinition_Tasks_And_Plans was already defined with a different value.
 @publicNamespace("microsoft.graph.security")
 namespace reference.`microsoft.graph.security` {
+  /**
+   * Audit data for A365 AI Execute Tool events.
+   */
+  @open
+  @complex model a365AiExecuteTool extends auditData {
+  }
+
+  /**
+   * Audit data for A365 AI Inference Call events.
+   */
+  @open
+  @complex model a365AiInferenceCall extends auditData {
+  }
+
+  /**
+   * Audit data for A365 AI Invoke Agent events.
+   */
+  @open
+  @complex model a365AiInvokeAgent extends auditData {
+  }
+
+  /**
+   * Audit data for A365 AI Run Summary events.
+   */
+  @open
+  @complex model a365AiRunSummary extends auditData {
+  }
+
+  /**
+   * Audit data for A365 Span Outputs events.
+   */
+  @open
+  @complex model a365SpanOutputs extends auditData {
+  }
+
+  /**
+   * Audit data for AAD Risk Detection events.
+   */
+  @open
+  @complex model aadRiskDetectionAuditRecord extends auditData {
+  }
+
   @complex model account {
     actions: action[];
     identifier: string;
@@ -37614,6 +37871,27 @@ namespace reference.`microsoft.graph.security` {
     trustedDomains: activeDirectoryDomainEvidence[];
   }
 
+  /**
+   * Audit data for Advanced eDiscovery events.
+   */
+  @open
+  @complex model aedAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Agent Admin Activity events.
+   */
+  @open
+  @complex model agentAdminActivityRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Agent Setting Admin Activity events.
+   */
+  @open
+  @complex model agentSettingAdminActivity extends auditData {
+  }
+
   @complex model aiAgentEvidence extends alertEvidence {
     agentId: string | null;
     agentName: string | null;
@@ -37621,80 +37899,206 @@ namespace reference.`microsoft.graph.security` {
     instructions: string | null;
   }
 
-  @complex model alertComment {
-    comment: string | null;
-    createdByDisplayName: string | null;
-    @computed createdDateTime: offsetDateTime;
-  }
-
-  @complex model alertEvidence {
-    @computed createdDateTime: offsetDateTime;
-    detailedRoles: string[] | null;
-    remediationStatus: evidenceRemediationStatus;
-    remediationStatusDetails: string | null;
-    roles: evidenceRole[];
-    tags: string[] | null;
-    verdict: evidenceVerdict;
+  /**
+   * Audit data for AI App Interaction events.
+   */
+  @open
+  @complex model aiAppInteractionAuditRecord extends auditData {
   }
 
-  @complex model amazonResourceEvidence extends alertEvidence {
-    amazonAccountId: string | null;
-    amazonResourceId: string | null;
-    resourceName: string | null;
-    resourceType: string | null;
+  /**
+   * Audit data for AI Execute Tool events.
+   */
+  @open
+  @complex model aiExecuteToolAuditRecord extends auditData {
   }
 
-  @complex model analyzedEmailAttachment {
-    detonationDetails: detonationDetails | null;
-    fileExtension: string | null;
-    fileName: string | null;
-    fileSize: int32 | null;
-    fileType: string | null;
-    malwareFamily: string | null;
-    sha256: string | null;
-    tenantAllowBlockListDetailInfo: string | null;
-    threatType: threatType | null;
+  /**
+   * Audit data for AI Interactions Change Notification events.
+   */
+  @open
+  @complex model aiInteractionsChangeNotificationAuditRecord extends auditData {
   }
 
-  @complex model analyzedEmailAuthenticationDetail {
-    compositeAuthentication: string | null;
-    dkim: string | null;
-    dmarc: string | null;
-    senderPolicyFramework: string | null;
+  /**
+   * Audit data for AI Interactions Export events.
+   */
+  @open
+  @complex model aiInteractionsExportAuditRecord extends auditData {
   }
 
-  @complex model analyzedEmailDeliveryDetail {
-    action: deliveryAction | null;
-    latestThreats: string | null;
-    location: deliveryLocation | null;
-    originalThreats: string | null;
+  /**
+   * Audit data for AI Interactions Subscription events.
+   */
+  @open
+  @complex model aiInteractionsSubscriptionAuditRecord extends auditData {
   }
 
-  @complex model analyzedEmailDlpRuleInfo {
-    name: string | null;
-    ruleId: string | null;
+  /**
+   * Audit data for AI Invoke Agent events.
+   */
+  @open
+  @complex model aiInvokeAgentAuditRecord extends auditData {
   }
 
-  @complex model analyzedEmailExchangeTransportRuleInfo {
-    name: string | null;
-    ruleId: string | null;
+  /**
+   * Audit data for AIP Discover events.
+   */
+  @open
+  @complex model aipDiscover extends auditData {
   }
 
-  @complex model analyzedEmailRecipientDetail {
-    ccRecipients: string[] | null;
-    domainName: string | null;
+  /**
+   * Audit data for AIP File Deleted events.
+   */
+  @open
+  @complex model aipFileDeleted extends auditData {
   }
 
-  @complex model analyzedEmailSenderDetail {
-    displayName: string | null;
-    domainCreationDateTime: offsetDateTime | null;
-    domainName: string | null;
-    domainOwner: string | null;
-    fromAddress: string | null;
-    ipv4: string | null;
-    location: string | null;
-    mailFromAddress: string | null;
-    mailFromDomainName: string | null;
+  /**
+   * Audit data for AIP Heart Beat events.
+   */
+  @open
+  @complex model aipHeartBeat extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Protection Action log request events.
+   */
+  @open
+  @complex model aipProtectionActionLogRequest extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Scanner Discover Event events.
+   */
+  @open
+  @complex model aipScannerDiscoverEvent extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Sensitivity Label Action log request events.
+   */
+  @open
+  @complex model aipSensitivityLabelActionLogRequest extends auditData {
+  }
+
+  /**
+   * Audit data for AIR Admin Action Investigation events.
+   */
+  @open
+  @complex model airAdminActionInvestigationData extends auditData {
+  }
+
+  /**
+   * Audit data for AIR Investigation events.
+   */
+  @open
+  @complex model airInvestigationData extends auditData {
+  }
+
+  /**
+   * Audit data for AIR Manual Investigation events.
+   */
+  @open
+  @complex model airManualInvestigationData extends auditData {
+  }
+
+  /**
+   * Audit data for AI Span Outputs events.
+   */
+  @open
+  @complex model aISpanOutputsAuditRecord extends auditData {
+  }
+
+  @complex model alertComment {
+    comment: string | null;
+    createdByDisplayName: string | null;
+    @computed createdDateTime: offsetDateTime;
+  }
+
+  @complex model alertEvidence {
+    @computed createdDateTime: offsetDateTime;
+    detailedRoles: string[] | null;
+    remediationStatus: evidenceRemediationStatus;
+    remediationStatusDetails: string | null;
+    roles: evidenceRole[];
+    tags: string[] | null;
+    verdict: evidenceVerdict;
+  }
+
+  /**
+   * Audit data for Alert Submission events.
+   */
+  @open
+  @complex model alertSubmissionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Alert Submission Result Detail events.
+   */
+  @open
+  @complex model alertSubmissionResultDetailAuditRecord extends auditData {
+  }
+
+  @complex model amazonResourceEvidence extends alertEvidence {
+    amazonAccountId: string | null;
+    amazonResourceId: string | null;
+    resourceName: string | null;
+    resourceType: string | null;
+  }
+
+  @complex model analyzedEmailAttachment {
+    detonationDetails: detonationDetails | null;
+    fileExtension: string | null;
+    fileName: string | null;
+    fileSize: int32 | null;
+    fileType: string | null;
+    malwareFamily: string | null;
+    sha256: string | null;
+    tenantAllowBlockListDetailInfo: string | null;
+    threatType: threatType | null;
+  }
+
+  @complex model analyzedEmailAuthenticationDetail {
+    compositeAuthentication: string | null;
+    dkim: string | null;
+    dmarc: string | null;
+    senderPolicyFramework: string | null;
+  }
+
+  @complex model analyzedEmailDeliveryDetail {
+    action: deliveryAction | null;
+    latestThreats: string | null;
+    location: deliveryLocation | null;
+    originalThreats: string | null;
+  }
+
+  @complex model analyzedEmailDlpRuleInfo {
+    name: string | null;
+    ruleId: string | null;
+  }
+
+  @complex model analyzedEmailExchangeTransportRuleInfo {
+    name: string | null;
+    ruleId: string | null;
+  }
+
+  @complex model analyzedEmailRecipientDetail {
+    ccRecipients: string[] | null;
+    domainName: string | null;
+  }
+
+  @complex model analyzedEmailSenderDetail {
+    displayName: string | null;
+    domainCreationDateTime: offsetDateTime | null;
+    domainName: string | null;
+    domainOwner: string | null;
+    fromAddress: string | null;
+    ipv4: string | null;
+    location: string | null;
+    mailFromAddress: string | null;
+    mailFromDomainName: string | null;
   }
 
   @complex model analyzedEmailUrl {
@@ -37726,6 +38130,49 @@ namespace reference.`microsoft.graph.security` {
     urn: string | null;
   }
 
+  /**
+   * Audit data for Attack Sim Admin events.
+   */
+  @open
+  @complex model attackSimAdminAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Attack Sim events.
+   */
+  @open
+  @complex model attackSimAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Audit Config events.
+   */
+  @open
+  @complex model auditConfigAuditRecord extends auditData {
+  }
+
+  /**
+   * Abstract base type for audit event data.
+   */
+  @abstract
+  @complex model auditData {
+    dynamicProperties: auditRecordTypeDictionary | null;
+  }
+
+  /**
+   * A dictionary of name-value pairs for dynamic audit event properties.
+   */
+  @open
+  @complex model auditRecordTypeDictionary {
+  }
+
+  /**
+   * Audit data for Audit Search events.
+   */
+  @open
+  @complex model auditSearchAuditRecord extends auditData {
+  }
+
   @complex model autonomousSystem {
     name: string;
     number: int32;
@@ -37733,6 +38180,55 @@ namespace reference.`microsoft.graph.security` {
     value: string;
   }
 
+  /**
+   * Audit data for Azfw Application Rule Aggregation Event events.
+   */
+  @open
+  @complex model azfwApplicationRuleAggregationEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azfw Dns Query Event events.
+   */
+  @open
+  @complex model azfwDnsQueryEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azfw Network Rule Event events.
+   */
+  @open
+  @complex model azfwNetworkRuleEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure Active Directory Account Logon events.
+   */
+  @open
+  @complex model azureActiveDirectoryAccountLogonAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure Active Directory events.
+   */
+  @open
+  @complex model azureActiveDirectoryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure Active Directory STS Logon events.
+   */
+  @open
+  @complex model azureActiveDirectoryStsLogonAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure AI Search Audit events.
+   */
+  @open
+  @complex model azureAISearchAuditRecord extends auditData {
+  }
+
   @complex model azureResourceEvidence extends alertEvidence {
     resourceId: string | null;
     resourceName: string | null;
@@ -37753,6 +38249,83 @@ namespace reference.`microsoft.graph.security` {
     url: string | null;
   }
 
+  /**
+   * Audit data for threat campaign events.
+   */
+  @open
+  @complex model campaignAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CCRAI Policy Violation events.
+   */
+  @open
+  @complex model ccraiPolicyViolationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Classifier Health events.
+   */
+  @open
+  @complex model cdpClassifierHealthRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Cold Crawl Status events.
+   */
+  @open
+  @complex model cdpColdCrawlStatusRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Consumption Resource events.
+   */
+  @open
+  @complex model cdpConsumptionResourceRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Content Explorer Aggregate events.
+   */
+  @open
+  @complex model cdpContentExplorerAggregateRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Cdpdlmai Interaction Insights events.
+   */
+  @open
+  @complex model cdpdlmaiInteractionInsightsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP DLP Sensitive Endpoint events.
+   */
+  @open
+  @complex model cdpDlpSensitiveEndpointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Log events.
+   */
+  @open
+  @complex model cdpLogRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP OCR Billing events.
+   */
+  @open
+  @complex model cdpOcrBillingRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Resource Scope Change Event events.
+   */
+  @open
+  @complex model cdpResourceScopeChangeEventRecord extends auditData {
+  }
+
   @complex model cloudApplicationEvidence extends alertEvidence {
     appId: int64 | null;
     displayName: string | null;
@@ -37778,688 +38351,3047 @@ namespace reference.`microsoft.graph.security` {
     userAgent: string | null;
   }
 
-  @complex model compromiseIndicator {
-    value: string | null;
-    verdict: verdictCategory | null;
+  /**
+   * Audit data for Cloud Update Device Config events.
+   */
+  @open
+  @complex model cloudUpdateDeviceConfigAuditRecord extends auditData {
   }
 
-  @complex model containerEvidence extends alertEvidence {
-    args: string[] | null;
-    command: string[] | null;
-    containerId: string | null;
-    image: containerImageEvidence | null;
-    isPrivileged: boolean;
-    name: string | null;
-    pod: kubernetesPodEvidence | null;
-  }
+  /**
+   * Audit data for Cloud Update Profile Config events.
+   */
+  @open
+  @complex model cloudUpdateProfileConfigAuditRecord extends auditData {
+  }
 
-  @complex model containerImageEvidence extends alertEvidence {
-    digestImage: containerImageEvidence | null;
-    imageId: string | null;
-    registry: containerRegistryEvidence | null;
+  /**
+   * Audit data for Cloud Update Tenant Config events.
+   */
+  @open
+  @complex model cloudUpdateTenantConfigAuditRecord extends auditData {
   }
 
-  @complex model containerRegistryEvidence extends alertEvidence {
-    registry: string | null;
+  /**
+   * Audit data for Compliance Connector events.
+   */
+  @open
+  @complex model complianceConnectorAuditRecord extends auditData {
   }
 
-  @complex model cvssSummary {
-    score: float64;
-    severity: vulnerabilitySeverity | null;
-    vectorString: string | null;
+  /**
+   * Audit data for Compliance DLM Exchange events.
+   */
+  @open
+  @complex model complianceDLMExchangeAuditRecord extends auditData {
   }
 
-  @complex model deploymentAccessKeyType {
-    deploymentAccessKey: string;
+  /**
+   * Audit data for Compliance DLM SharePoint events.
+   */
+  @open
+  @complex model complianceDLMSharePointAuditRecord extends auditData {
   }
 
-  @graphDeprecated("Tasks_And_Plans")
-  @complex model detonationBehaviourDetails {
-    actionStatus: string | null;
-    behaviourCapability: string | null;
-    behaviourGroup: string | null;
-    details: string | null;
-    eventDateTime: offsetDateTime | null;
-    operation: string | null;
-    processId: string | null;
-    processName: string | null;
-    target: string | null;
+  /**
+   * Audit data for Compliance DLP Applications events.
+   */
+  @open
+  @complex model complianceDLPApplicationsAuditRecord extends auditData {
   }
 
-  @complex model detonationChain {
-    childNodes: detonationChain[] | null;
-    value: string | null;
+  /**
+   * Audit data for Compliance DLP Applications Classification events.
+   */
+  @open
+  @complex model complianceDLPApplicationsClassificationAuditRecord extends auditData {
   }
 
-  @complex model detonationDetails {
-    analysisDateTime: offsetDateTime | null;
-    compromiseIndicators: compromiseIndicator[] | null;
-    detonationBehaviourDetails: detonationBehaviourDetails | null;
-    detonationBehaviourDetailsV2: string | null;
-    detonationChain: detonationChain | null;
-    detonationObservables: detonationObservables | null;
-    detonationScreenshotUri: string | null;
-    detonationVerdict: string | null;
-    detonationVerdictReason: string | null;
-    entityMetadata: string | null;
-    mitreTechniques: string | null;
-    staticAnalysis: string | null;
-    submissionSource: string | null;
+  /**
+   * Audit data for Compliance DLP Endpoint events.
+   */
+  @open
+  @complex model complianceDLPEndpointAuditRecord extends auditData {
   }
 
-  @complex model detonationObservables {
-    contactedIps: string[] | null;
-    contactedUrls: string[] | null;
-    droppedfiles: string[] | null;
+  /**
+   * Audit data for Compliance DLP Endpoint Discovery events.
+   */
+  @open
+  @complex model complianceDLPEndpointDiscoveryAuditRecord extends auditData {
   }
 
-  @complex model deviceEvidence extends alertEvidence {
-    azureAdDeviceId: string | null;
-    defenderAvStatus: defenderAvStatus | null;
-    deviceDnsName: string | null;
-    dnsDomain: string | null;
-    firstSeenDateTime: offsetDateTime | null;
-    healthStatus: deviceHealthStatus | null;
-    hostName: string | null;
-    ipInterfaces: string[] | null;
-    lastExternalIpAddress: string | null;
-    lastIpAddress: string | null;
-    loggedOnUsers: loggedOnUser[] | null;
-    mdeDeviceId: string | null;
-    ntDomain: string | null;
-    onboardingStatus: onboardingStatus | null;
-    osBuild: int64 | null;
-    osPlatform: string | null;
-    rbacGroupId: int32 | null;
-    rbacGroupName: string | null;
-    resourceAccessEvents: resourceAccessEvent[] | null;
-    riskScore: deviceRiskScore | null;
-    version: string | null;
-    vmMetadata: vmMetadata | null;
+  /**
+   * Audit data for Compliance DLP Enforcement events.
+   */
+  @open
+  @complex model complianceDLPEnforcementAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Compliance DLP Exchange events.
+   */
   @open
-  @complex model dictionary {
+  @complex model complianceDLPExchangeAuditRecord extends auditData {
   }
 
-  @complex model dnsEvidence extends alertEvidence {
-    dnsServerIp: ipEvidence | null;
-    domainName: string | null;
-    hostIpAddress: ipEvidence | null;
-    ipAddresses: ipEvidence[] | null;
+  /**
+   * Audit data for Compliance DLP Exchange Classification events.
+   */
+  @open
+  @complex model complianceDLPExchangeClassificationAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Compliance DLP Exchange Classification CDP events.
+   */
   @open
-  @complex model dynamicColumnValue {
+  @complex model complianceDLPExchangeClassificationCdpRecord extends auditData {
   }
 
-  @complex model emailSender {
-    displayName: string | null;
-    domainName: string | null;
-    emailAddress: string | null;
+  /**
+   * Audit data for Compliance DLP Exchange Discovery events.
+   */
+  @open
+  @complex model complianceDLPExchangeDiscoveryAuditRecord extends auditData {
   }
 
-  @complex model eventPropagationResult {
-    location: string | null;
-    serviceName: string | null;
-    status: eventPropagationStatus | null;
-    statusInformation: string | null;
+  /**
+   * Audit data for Compliance DLP SharePoint events.
+   */
+  @open
+  @complex model complianceDLPSharePointAuditRecord extends auditData {
   }
 
-  @complex model eventQuery {
-    query: string;
-    queryType: queryType | null;
+  /**
+   * Audit data for Compliance DLP SharePoint Classification events.
+   */
+  @open
+  @complex model complianceDLPSharePointClassificationAuditRecord extends auditData {
   }
 
-  @complex model exportFileMetadata {
-    downloadUrl: string | null;
-    fileName: string | null;
-    size: int64 | null;
+  /**
+   * Audit data for Compliance DLP SharePoint Classification CDP events.
+   */
+  @open
+  @complex model complianceDLPSharePointClassificationCdpRecord extends auditData {
   }
 
-  @complex model fileDetails {
-    fileName: string | null;
-    filePath: string | null;
-    filePublisher: string | null;
-    fileSize: int64 | null;
-    issuer: string | null;
-    md5: string | null;
-    sha1: string | null;
-    sha256: string | null;
-    sha256Ac: string | null;
-    signer: string | null;
+  /**
+   * Audit data for Compliance DLP SharePoint Classification Extended events.
+   */
+  @open
+  @complex model complianceDLPSharePointClassificationExtendedAuditRecord extends auditData {
   }
 
-  @complex model fileEvidence extends alertEvidence {
-    detectionStatus: detectionStatus | null;
-    fileDetails: fileDetails | null;
-    mdeDeviceId: string | null;
+  /**
+   * Audit data for Compliance Exchange OCR events.
+   */
+  @open
+  @complex model complianceExchangeOcrAuditRecord extends auditData {
   }
 
-  @complex model fileHash {
-    algorithm: fileHashAlgorithm;
-    value: string | null;
+  /**
+   * Audit data for Compliance Manager Action events.
+   */
+  @open
+  @complex model complianceManagerActionRecord extends auditData {
   }
 
-  @complex model fileHashEvidence extends alertEvidence {
-    algorithm: fileHashAlgorithm;
-    value: string | null;
+  /**
+   * Audit data for Compliance Policy Grading SharePoint events.
+   */
+  @open
+  @complex model compliancePolicyGradingSharePointAuditRecord extends auditData {
   }
 
-  @complex model filePlanAppliedCategory extends filePlanDescriptorBase {
-    subcategory: filePlanSubcategory | null;
+  /**
+   * Audit data for Compliance Settings Change events.
+   */
+  @open
+  @complex model complianceSettingsChangeAuditRecord extends auditData {
   }
 
-  @complex model filePlanAuthority extends filePlanDescriptorBase {
+  /**
+   * Audit data for Compliance SIT Grading SharePoint events.
+   */
+  @open
+  @complex model complianceSitGradingSharePointAuditRecord extends auditData {
   }
 
-  @complex model filePlanCitation extends filePlanDescriptorBase {
-    citationJurisdiction: string | null;
-    citationUrl: string | null;
+  /**
+   * Audit data for Compliance Supervision Exchange events.
+   */
+  @open
+  @complex model complianceSupervisionExchangeAuditRecord extends auditData {
   }
 
-  @complex model filePlanDepartment extends filePlanDescriptorBase {
+  @complex model compromiseIndicator {
+    value: string | null;
+    verdict: verdictCategory | null;
   }
 
-  @complex model filePlanDescriptorBase {
-    displayName: string | null;
+  /**
+   * Audit data for Connected AI App Interaction events.
+   */
+  @open
+  @complex model connectedAIAppInteractionAuditRecord extends auditData {
   }
 
-  @complex model filePlanReference extends filePlanDescriptorBase {
+  /**
+   * Audit data for Consumption Resource events.
+   */
+  @open
+  @complex model consumptionResourceAuditRecord extends auditData {
   }
 
-  @complex model filePlanSubcategory extends filePlanDescriptorBase {
+  @complex model containerEvidence extends alertEvidence {
+    args: string[] | null;
+    command: string[] | null;
+    containerId: string | null;
+    image: containerImageEvidence | null;
+    isPrivileged: boolean;
+    name: string | null;
+    pod: kubernetesPodEvidence | null;
   }
 
-  @complex model formattedContent {
-    content: string | null;
-    format: contentFormat | null;
+  @complex model containerImageEvidence extends alertEvidence {
+    digestImage: containerImageEvidence | null;
+    imageId: string | null;
+    registry: containerRegistryEvidence | null;
   }
 
-  @complex model geoLocation {
-    city: string | null;
-    countryName: string | null;
-    latitude: float64 | null;
-    longitude: float64 | null;
-    state: string | null;
+  @complex model containerRegistryEvidence extends alertEvidence {
+    registry: string | null;
   }
 
-  @complex model gitHubOrganizationEvidence extends alertEvidence {
-    company: string | null;
-    displayName: string | null;
-    email: string | null;
-    login: string | null;
-    orgId: string | null;
-    webUrl: string | null;
+  /**
+   * Audit data for Content Store Meta events.
+   */
+  @open
+  @complex model contentStoreMetadataRecord extends auditData {
   }
 
-  @complex model gitHubRepoEvidence extends alertEvidence {
-    baseUrl: string | null;
-    login: string | null;
-    owner: string | null;
-    ownerType: string | null;
-    repoId: string | null;
+  /**
+   * Audit data for Copilot Agent Management events.
+   */
+  @open
+  @complex model copilotAgentManagementAuditRecord extends auditData {
   }
 
-  @complex model gitHubUserEvidence extends alertEvidence {
-    email: string | null;
-    login: string | null;
-    name: string | null;
-    userId: string | null;
-    webUrl: string | null;
+  /**
+   * Audit data for Copilot for Security Logging events.
+   */
+  @open
+  @complex model copilotForSecurityLoggingAuditRecord extends auditData {
   }
 
-  @complex model googleCloudResourceEvidence extends alertEvidence {
-    fullResourceName: string | null;
-    location: string | null;
-    locationType: googleCloudLocationType | null;
-    projectId: string | null;
-    projectNumber: int64 | null;
-    resourceName: string | null;
-    resourceType: string | null;
+  /**
+   * Audit data for Copilot for Security Trigger events.
+   */
+  @open
+  @complex model copilotForSecurityTriggerAuditRecord extends auditData {
   }
 
-  @complex model hostLogonSessionEvidence extends alertEvidence {
-    account: userEvidence | null;
-    endUtcDateTime: offsetDateTime | null;
-    host: deviceEvidence | null;
-    sessionId: string | null;
-    startUtcDateTime: offsetDateTime | null;
+  /**
+   * Audit data for Copilot Interaction events.
+   */
+  @open
+  @complex model copilotInteractionAuditRecord extends auditData {
   }
 
-  @complex model hostPortBanner {
-    banner: string;
-    firstSeenDateTime: offsetDateTime | null;
-    @computed lastSeenDateTime: offsetDateTime | null;
-    scanProtocol: string | null;
-    timesObserved: int32 | null;
+  /**
+   * Audit data for Copilot Plugin Setting events.
+   */
+  @open
+  @complex model copilotPluginSettingAuditRecord extends auditData {
   }
 
-  @complex model hostPortComponent {
-    firstSeenDateTime: offsetDateTime | null;
-    isRecent: boolean | null;
-    @computed lastSeenDateTime: offsetDateTime | null;
-    @references component: hostComponent | null;
+  /**
+   * Audit data for Copilot Prompt Book Setting events.
+   */
+  @open
+  @complex model copilotPromptBookSettingAuditRecord extends auditData {
   }
 
-  @complex model hostReputationRule {
-    description: string;
-    name: string;
-    relatedDetailsUrl: string | null;
-    severity: hostReputationRuleSeverity;
+  /**
+   * Audit data for Copilot Session Sharing events.
+   */
+  @open
+  @complex model copilotSessionSharingAuditRecord extends auditData {
   }
 
-  @complex model hostSslCertificatePort {
-    firstSeenDateTime: offsetDateTime | null;
-    @computed lastSeenDateTime: offsetDateTime | null;
-    port: int32 | null;
+  /**
+   * Audit data for Copilot Setting events.
+   */
+  @open
+  @complex model copilotSettingAuditRecord extends auditData {
   }
 
-  @complex model huntingQueryResults {
-    results: huntingRowResult[] | null;
-    schema: singlePropertySchema[] | null;
+  /**
+   * Audit data for Copilot Workspace Setting events.
+   */
+  @open
+  @complex model copilotWorkspaceSettingAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Core Reporting Settings events.
+   */
   @open
-  @complex model huntingRowResult {
+  @complex model coreReportingSettingsAuditRecord extends auditData {
   }
 
-  @complex model hyperlink {
-    name: string;
-    url: string;
+  /**
+   * Audit data for Cortana Briefing events.
+   */
+  @open
+  @complex model cortanaBriefingAuditRecord extends auditData {
   }
 
-  @complex model intelligenceProfileCountryOrRegionOfOrigin {
-    code: string;
-    label: string;
+  /**
+   * Audit data for Critical Asset Management Classification events.
+   */
+  @open
+  @complex model criticalAssetManagementClassificationRecord extends auditData {
   }
 
-  @complex model invokeActionResult {
-    accountId: string;
-    action: action;
-    correlationId: string | null;
-    identityProvider: identityProvider;
+  /**
+   * Audit data for CRM Entity Operation events.
+   */
+  @open
+  @complex model crmEntityOperationAuditRecord extends auditData {
   }
 
-  @complex model ioTDeviceEvidence extends alertEvidence {
-    deviceId: string | null;
-    deviceName: string | null;
-    devicePageLink: string | null;
-    deviceSubType: string | null;
-    deviceType: string | null;
-    importance: ioTDeviceImportanceType | null;
-    ioTHub: azureResourceEvidence | null;
-    ioTSecurityAgentId: string | null;
-    ipAddress: ipEvidence | null;
-    isAuthorized: boolean | null;
-    isProgramming: boolean | null;
-    isScanner: boolean | null;
-    macAddress: string | null;
-    manufacturer: string | null;
-    `model`: string | null;
-    nics: nicEvidence[] | null;
-    operatingSystem: string | null;
-    owners: string[] | null;
-    protocols: string[] | null;
-    purdueLayer: string | null;
-    sensor: string | null;
-    serialNumber: string | null;
-    site: string | null;
-    source: string | null;
-    sourceRef: urlEvidence | null;
-    zone: string | null;
+  /**
+   * Audit data for Cross Tenant Access Policy events.
+   */
+  @open
+  @complex model crossTenantAccessPolicyAuditRecord extends auditData {
   }
 
-  @complex model ipEvidence extends alertEvidence {
-    countryLetterCode: string | null;
-    ipAddress: string | null;
-    location: geoLocation | null;
-    stream: stream | null;
+  /**
+   * Audit data for Customer Key Service Encryption events.
+   */
+  @open
+  @complex model customerKeyServiceEncryptionAuditRecord extends auditData {
   }
 
-  @complex model kubernetesClusterEvidence extends alertEvidence {
-    cloudResource: alertEvidence | null;
-    distribution: string | null;
-    name: string | null;
-    platform: kubernetesPlatform | null;
-    version: string | null;
+  @complex model cvssSummary {
+    score: float64;
+    severity: vulnerabilitySeverity | null;
+    vectorString: string | null;
   }
 
-  @complex model kubernetesControllerEvidence extends alertEvidence {
-    labels: dictionary | null;
-    name: string | null;
-    `namespace`: kubernetesNamespaceEvidence | null;
-    type: string | null;
+  /**
+   * Audit data for Data Center Security cmdlet events.
+   */
+  @open
+  @complex model dataCenterSecurityCmdletAuditRecord extends auditData {
   }
 
-  @complex model kubernetesNamespaceEvidence extends alertEvidence {
-    cluster: kubernetesClusterEvidence | null;
-    labels: dictionary | null;
-    name: string | null;
+  /**
+   * Audit data for Data Governance events.
+   */
+  @open
+  @complex model dataGovernanceAuditRecord extends auditData {
   }
 
-  @complex model kubernetesPodEvidence extends alertEvidence {
-    containers: containerEvidence[] | null;
-    controller: kubernetesControllerEvidence | null;
-    ephemeralContainers: containerEvidence[] | null;
-    initContainers: containerEvidence[] | null;
-    labels: dictionary | null;
-    name: string | null;
-    `namespace`: kubernetesNamespaceEvidence | null;
-    podIp: ipEvidence | null;
-    serviceAccount: kubernetesServiceAccountEvidence | null;
+  /**
+   * Audit data for Data Insights Rest Api events.
+   */
+  @open
+  @complex model dataInsightsRestApiAuditRecord extends auditData {
   }
 
-  @complex model kubernetesSecretEvidence extends alertEvidence {
-    name: string | null;
-    `namespace`: kubernetesNamespaceEvidence | null;
-    secretType: string | null;
+  /**
+   * Audit data for Data Lake Export Operation events.
+   */
+  @open
+  @complex model dataLakeExportOperationAuditRecord extends auditData {
   }
 
-  @complex model kubernetesServiceAccountEvidence extends alertEvidence {
-    name: string | null;
-    `namespace`: kubernetesNamespaceEvidence | null;
+  /**
+   * Audit data for Data Security Investigation events.
+   */
+  @open
+  @complex model dataSecurityInvestigationAuditRecord extends auditData {
   }
 
-  @complex model kubernetesServiceEvidence extends alertEvidence {
-    clusterIP: ipEvidence | null;
-    externalIPs: ipEvidence[] | null;
-    labels: dictionary | null;
-    name: string | null;
-    `namespace`: kubernetesNamespaceEvidence | null;
-    selector: dictionary | null;
-    servicePorts: kubernetesServicePort[] | null;
-    serviceType: kubernetesServiceType;
+  /**
+   * Audit data for Data Share Operation events.
+   */
+  @open
+  @complex model dataShareOperationAuditRecord extends auditData {
   }
 
-  @complex model kubernetesServicePort {
-    appProtocol: string | null;
-    name: string | null;
-    nodePort: int32;
-    port: int32;
-    protocol: containerPortProtocol | null;
-    targetPort: string | null;
+  /**
+   * Default open-type audit data when no specific subtype applies.
+   */
+  @open
+  @complex model defaultAuditData extends auditData {
   }
 
-  @complex model loggedOnUser {
-    accountName: string | null;
-    domainName: string | null;
+  /**
+   * Audit data for Defender Case Management events.
+   */
+  @open
+  @complex model defenderCaseManagementAuditRecord extends auditData {
   }
 
-  @complex model mailboxConfigurationEvidence extends alertEvidence {
-    configurationId: string | null;
-    configurationType: mailboxConfigurationType | null;
-    displayName: string | null;
-    externalDirectoryObjectId: guid | null;
-    mailboxPrimaryAddress: string | null;
-    upn: string | null;
+  /**
+   * Audit data for Defender Preview Features events.
+   */
+  @open
+  @complex model defenderPreviewFeaturesRecord extends auditData {
   }
 
-  @complex model mailboxEvidence extends alertEvidence {
-    displayName: string | null;
-    primaryAddress: string | null;
-    upn: string | null;
-    userAccount: userAccount | null;
+  /**
+   * Audit data for Defender Security for AI Configuration events.
+   */
+  @open
+  @complex model defenderSecurityForAIConfigurationAuditRecord extends auditData {
   }
 
-  @complex model mailClusterEvidence extends alertEvidence {
-    clusterBy: string | null;
-    clusterByValue: string | null;
-    emailCount: int64 | null;
-    networkMessageIds: string[] | null;
-    query: string | null;
-    urn: string | null;
+  /**
+   * Audit data for Deploy Feature Activity events.
+   */
+  @open
+  @complex model deployFeatureActivityRecord extends auditData {
   }
 
-  @complex model malwareEvidence extends alertEvidence {
-    category: string | null;
-    files: fileEvidence[] | null;
-    name: string | null;
-    processes: processEvidence[] | null;
+  @complex model deploymentAccessKeyType {
+    deploymentAccessKey: string;
   }
 
-  @complex model mergeResponse {
-    targetIncidentId: string;
+  @graphDeprecated("Tasks_And_Plans")
+  @complex model detonationBehaviourDetails {
+    actionStatus: string | null;
+    behaviourCapability: string | null;
+    behaviourGroup: string | null;
+    details: string | null;
+    eventDateTime: offsetDateTime | null;
+    operation: string | null;
+    processId: string | null;
+    processName: string | null;
+    target: string | null;
   }
 
-  @complex model networkConnectionEvidence extends alertEvidence {
-    destinationAddress: ipEvidence | null;
-    destinationPort: int32 | null;
-    protocol: protocolType | null;
-    sourceAddress: ipEvidence | null;
-    sourcePort: int32 | null;
+  @complex model detonationChain {
+    childNodes: detonationChain[] | null;
+    value: string | null;
   }
 
-  @complex model nicEvidence extends alertEvidence {
-    ipAddress: ipEvidence | null;
-    macAddress: string | null;
-    vlans: string[] | null;
+  @complex model detonationDetails {
+    analysisDateTime: offsetDateTime | null;
+    compromiseIndicators: compromiseIndicator[] | null;
+    detonationBehaviourDetails: detonationBehaviourDetails | null;
+    detonationBehaviourDetailsV2: string | null;
+    detonationChain: detonationChain | null;
+    detonationObservables: detonationObservables | null;
+    detonationScreenshotUri: string | null;
+    detonationVerdict: string | null;
+    detonationVerdictReason: string | null;
+    entityMetadata: string | null;
+    mitreTechniques: string | null;
+    staticAnalysis: string | null;
+    submissionSource: string | null;
   }
 
-  @complex model oauthApplicationEvidence extends alertEvidence {
-    appId: string | null;
-    displayName: string | null;
-    objectId: string | null;
-    publisher: string | null;
+  @complex model detonationObservables {
+    contactedIps: string[] | null;
+    contactedUrls: string[] | null;
+    droppedfiles: string[] | null;
   }
 
-  @complex model ocrSettings {
-    isEnabled: boolean | null;
-    maxImageSize: int32 | null;
-    timeout: duration | null;
+  /**
+   * Audit data for Device Discovery Settings Authenticated Scans events.
+   */
+  @open
+  @complex model deviceDiscoverySettingsAuthenticatedScansRecord extends auditData {
   }
 
-  @complex model processEvidence extends alertEvidence {
-    detectionStatus: detectionStatus | null;
-    imageFile: fileDetails | null;
+  /**
+   * Audit data for Device Discovery Settings Exclusion events.
+   */
+  @open
+  @complex model deviceDiscoverySettingsExclusionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Device Discovery Settings events.
+   */
+  @open
+  @complex model deviceDiscoverySettingsRecord extends auditData {
+  }
+
+  @complex model deviceEvidence extends alertEvidence {
+    azureAdDeviceId: string | null;
+    defenderAvStatus: defenderAvStatus | null;
+    deviceDnsName: string | null;
+    dnsDomain: string | null;
+    firstSeenDateTime: offsetDateTime | null;
+    healthStatus: deviceHealthStatus | null;
+    hostName: string | null;
+    ipInterfaces: string[] | null;
+    lastExternalIpAddress: string | null;
+    lastIpAddress: string | null;
+    loggedOnUsers: loggedOnUser[] | null;
     mdeDeviceId: string | null;
-    parentProcessCreationDateTime: offsetDateTime | null;
-    parentProcessId: int64 | null;
-    parentProcessImageFile: fileDetails | null;
-    processCommandLine: string | null;
-    processCreationDateTime: offsetDateTime | null;
-    processId: int64 | null;
-    userAccount: userAccount | null;
+    ntDomain: string | null;
+    onboardingStatus: onboardingStatus | null;
+    osBuild: int64 | null;
+    osPlatform: string | null;
+    rbacGroupId: int32 | null;
+    rbacGroupName: string | null;
+    resourceAccessEvents: resourceAccessEvent[] | null;
+    riskScore: deviceRiskScore | null;
+    version: string | null;
+    vmMetadata: vmMetadata | null;
   }
 
-  @complex model redundancyDetectionSettings {
-    isEnabled: boolean | null;
-    maxWords: int32 | null;
-    minWords: int32 | null;
-    similarityThreshold: int32 | null;
+  @open
+  @complex model dictionary {
   }
 
-  @complex model registryKeyEvidence extends alertEvidence {
-    registryHive: string | null;
-    registryKey: string | null;
+  /**
+   * Audit data for eDiscovery events.
+   */
+  @open
+  @complex model discoveryAuditRecord extends auditData {
   }
 
-  @complex model registryValueEvidence extends alertEvidence {
-    mdeDeviceId: string | null;
-    registryHive: string | null;
-    registryKey: string | null;
-    registryValue: string | null;
-    registryValueName: string | null;
-    registryValueType: string | null;
+  /**
+   * Audit data for DLP Endpoint events.
+   */
+  @open
+  @complex model dlpEndpointAuditRecord extends auditData {
   }
 
-  @complex model reportFileMetadata {
+  /**
+   * Audit data for DLP Import Result events.
+   */
+  @open
+  @complex model dlpImportResultAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for DLP Sensitive Information Type Rule Package cmdlet events.
+   */
+  @open
+  @complex model dlpSensitiveInformationTypeRulePackageCmdletRecord extends auditData {
+  }
+
+  @complex model dnsEvidence extends alertEvidence {
+    dnsServerIp: ipEvidence | null;
+    domainName: string | null;
+    hostIpAddress: ipEvidence | null;
+    ipAddresses: ipEvidence[] | null;
+  }
+
+  /**
+   * Audit data for Dragon Copilot Access events.
+   */
+  @open
+  @complex model dragonCopilotAccessRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Admin events.
+   */
+  @open
+  @complex model dragonCopilotAdminRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Clinical Data events.
+   */
+  @open
+  @complex model dragonCopilotClinicalDataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Session events.
+   */
+  @open
+  @complex model dragonCopilotSessionRecord extends auditData {
+  }
+
+  @open
+  @complex model dynamicColumnValue {
+  }
+
+  /**
+   * Audit data for Dynamics365 Business Central events.
+   */
+  @open
+  @complex model dynamics365BusinessCentralAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for EHR Connector events.
+   */
+  @open
+  @complex model ehrConnectorAuditBaseRecord extends auditData {
+  }
+
+  @complex model emailSender {
+    displayName: string | null;
+    domainName: string | null;
+    emailAddress: string | null;
+  }
+
+  /**
+   * Audit data for EOP Submission Feed Entity events.
+   */
+  @open
+  @complex model eopSubmissionFeedEntityAuditRecord extends auditData {
+  }
+
+  @complex model eventPropagationResult {
+    location: string | null;
+    serviceName: string | null;
+    status: eventPropagationStatus | null;
+    statusInformation: string | null;
+  }
+
+  @complex model eventQuery {
+    query: string;
+    queryType: queryType | null;
+  }
+
+  /**
+   * Audit data for Exchange Admin events.
+   */
+  @open
+  @complex model exchangeAdminAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Aggregated Mailbox events.
+   */
+  @open
+  @complex model exchangeAggregatedMailboxAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Aggregated Operation events.
+   */
+  @open
+  @complex model exchangeAggregatedOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Mailbox Audit Group events.
+   */
+  @open
+  @complex model exchangeMailboxAuditGroupRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Mailbox events.
+   */
+  @open
+  @complex model exchangeMailboxAuditRecord extends auditData {
+  }
+
+  @complex model exportFileMetadata {
     downloadUrl: string | null;
     fileName: string | null;
     size: int64 | null;
   }
 
-  @complex model resourceAccessEvent {
-    accessDateTime: offsetDateTime | null;
-    accountId: string | null;
-    ipAddress: string | null;
-    resourceIdentifier: string | null;
+  /**
+   * Audit data for Microsoft Fabric events.
+   */
+  @open
+  @complex model fabricAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Fabric Policy events.
+   */
+  @open
+  @complex model fabricPolicyRecord extends auditData {
+  }
+
+  @complex model fileDetails {
+    fileName: string | null;
+    filePath: string | null;
+    filePublisher: string | null;
+    fileSize: int64 | null;
+    issuer: string | null;
+    md5: string | null;
+    sha1: string | null;
+    sha256: string | null;
+    sha256Ac: string | null;
+    signer: string | null;
+  }
+
+  @complex model fileEvidence extends alertEvidence {
+    detectionStatus: detectionStatus | null;
+    fileDetails: fileDetails | null;
+    mdeDeviceId: string | null;
+  }
+
+  @complex model fileHash {
+    algorithm: fileHashAlgorithm;
+    value: string | null;
+  }
+
+  @complex model fileHashEvidence extends alertEvidence {
+    algorithm: fileHashAlgorithm;
+    value: string | null;
+  }
+
+  @complex model filePlanAppliedCategory extends filePlanDescriptorBase {
+    subcategory: filePlanSubcategory | null;
+  }
+
+  @complex model filePlanAuthority extends filePlanDescriptorBase {
+  }
+
+  @complex model filePlanCitation extends filePlanDescriptorBase {
+    citationJurisdiction: string | null;
+    citationUrl: string | null;
+  }
+
+  @complex model filePlanDepartment extends filePlanDescriptorBase {
+  }
+
+  @complex model filePlanDescriptorBase {
+    displayName: string | null;
+  }
+
+  @complex model filePlanReference extends filePlanDescriptorBase {
+  }
+
+  @complex model filePlanSubcategory extends filePlanDescriptorBase {
+  }
+
+  @complex model formattedContent {
+    content: string | null;
+    format: contentFormat | null;
+  }
+
+  @complex model geoLocation {
+    city: string | null;
+    countryName: string | null;
+    latitude: float64 | null;
+    longitude: float64 | null;
+    state: string | null;
+  }
+
+  @complex model gitHubOrganizationEvidence extends alertEvidence {
+    company: string | null;
+    displayName: string | null;
+    email: string | null;
+    login: string | null;
+    orgId: string | null;
+    webUrl: string | null;
+  }
+
+  @complex model gitHubRepoEvidence extends alertEvidence {
+    baseUrl: string | null;
+    login: string | null;
+    owner: string | null;
+    ownerType: string | null;
+    repoId: string | null;
+  }
+
+  @complex model gitHubUserEvidence extends alertEvidence {
+    email: string | null;
+    login: string | null;
+    name: string | null;
+    userId: string | null;
+    webUrl: string | null;
+  }
+
+  @complex model googleCloudResourceEvidence extends alertEvidence {
+    fullResourceName: string | null;
+    location: string | null;
+    locationType: googleCloudLocationType | null;
+    projectId: string | null;
+    projectNumber: int64 | null;
+    resourceName: string | null;
+    resourceType: string | null;
+  }
+
+  /**
+   * Audit data for Healthcare Signal events.
+   */
+  @open
+  @complex model healthcareSignalRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Hosted RPA events.
+   */
+  @open
+  @complex model hostedRpaAuditRecord extends auditData {
+  }
+
+  @complex model hostLogonSessionEvidence extends alertEvidence {
+    account: userEvidence | null;
+    endUtcDateTime: offsetDateTime | null;
+    host: deviceEvidence | null;
+    sessionId: string | null;
+    startUtcDateTime: offsetDateTime | null;
+  }
+
+  @complex model hostPortBanner {
+    banner: string;
+    firstSeenDateTime: offsetDateTime | null;
+    @computed lastSeenDateTime: offsetDateTime | null;
+    scanProtocol: string | null;
+    timesObserved: int32 | null;
+  }
+
+  @complex model hostPortComponent {
+    firstSeenDateTime: offsetDateTime | null;
+    isRecent: boolean | null;
+    @computed lastSeenDateTime: offsetDateTime | null;
+    @references component: hostComponent | null;
+  }
+
+  @complex model hostReputationRule {
+    description: string;
+    name: string;
+    relatedDetailsUrl: string | null;
+    severity: hostReputationRuleSeverity;
+  }
+
+  @complex model hostSslCertificatePort {
+    firstSeenDateTime: offsetDateTime | null;
+    @computed lastSeenDateTime: offsetDateTime | null;
+    port: int32 | null;
+  }
+
+  /**
+   * Audit data for HR Signal events.
+   */
+  @open
+  @complex model hrSignalAuditRecord extends auditData {
+  }
+
+  @complex model huntingQueryResults {
+    results: huntingRowResult[] | null;
+    schema: singlePropertySchema[] | null;
+  }
+
+  @open
+  @complex model huntingRowResult {
+  }
+
+  /**
+   * Audit data for Hygiene Event events.
+   */
+  @open
+  @complex model hygieneEventRecord extends auditData {
+  }
+
+  @complex model hyperlink {
+    name: string;
+    url: string;
+  }
+
+  /**
+   * Audit data for Information Barrier Policy Application events.
+   */
+  @open
+  @complex model informationBarrierPolicyApplicationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Information Worker Protection events.
+   */
+  @open
+  @complex model informationWorkerProtectionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Insider Risk Scoped User Insights events.
+   */
+  @open
+  @complex model insiderRiskScopedUserInsightsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Insider Risk Scoped Users events.
+   */
+  @open
+  @complex model insiderRiskScopedUsersRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Integrated Apps App Admin Activity events.
+   */
+  @open
+  @complex model integratedAppsAppAdminActivityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Integrated Apps App Settings Admin Activity events.
+   */
+  @open
+  @complex model integratedAppsAppSettingsAdminActivityAuditRecord extends auditData {
+  }
+
+  @complex model intelligenceProfileCountryOrRegionOfOrigin {
+    code: string;
+    label: string;
+  }
+
+  @complex model invokeActionResult {
+    accountId: string;
+    action: action;
+    correlationId: string | null;
+    identityProvider: identityProvider;
+  }
+
+  @complex model ioTDeviceEvidence extends alertEvidence {
+    deviceId: string | null;
+    deviceName: string | null;
+    devicePageLink: string | null;
+    deviceSubType: string | null;
+    deviceType: string | null;
+    importance: ioTDeviceImportanceType | null;
+    ioTHub: azureResourceEvidence | null;
+    ioTSecurityAgentId: string | null;
+    ipAddress: ipEvidence | null;
+    isAuthorized: boolean | null;
+    isProgramming: boolean | null;
+    isScanner: boolean | null;
+    macAddress: string | null;
+    manufacturer: string | null;
+    `model`: string | null;
+    nics: nicEvidence[] | null;
+    operatingSystem: string | null;
+    owners: string[] | null;
+    protocols: string[] | null;
+    purdueLayer: string | null;
+    sensor: string | null;
+    serialNumber: string | null;
+    site: string | null;
+    source: string | null;
+    sourceRef: urlEvidence | null;
+    zone: string | null;
+  }
+
+  @complex model ipEvidence extends alertEvidence {
+    countryLetterCode: string | null;
+    ipAddress: string | null;
+    location: geoLocation | null;
+    stream: stream | null;
+  }
+
+  /**
+   * Audit data for IRM Activity Audit Trail events.
+   */
+  @open
+  @complex model irmActivityAuditTrailRecord extends auditData {
+  }
+
+  /**
+   * Audit data for IRM User Defined Detection events.
+   */
+  @open
+  @complex model irmUserDefinedDetectionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Kaizala events.
+   */
+  @open
+  @complex model kaizalaAuditRecord extends auditData {
+  }
+
+  @complex model kubernetesClusterEvidence extends alertEvidence {
+    cloudResource: alertEvidence | null;
+    distribution: string | null;
+    name: string | null;
+    platform: kubernetesPlatform | null;
+    version: string | null;
+  }
+
+  @complex model kubernetesControllerEvidence extends alertEvidence {
+    labels: dictionary | null;
+    name: string | null;
+    `namespace`: kubernetesNamespaceEvidence | null;
+    type: string | null;
+  }
+
+  @complex model kubernetesNamespaceEvidence extends alertEvidence {
+    cluster: kubernetesClusterEvidence | null;
+    labels: dictionary | null;
+    name: string | null;
+  }
+
+  @complex model kubernetesPodEvidence extends alertEvidence {
+    containers: containerEvidence[] | null;
+    controller: kubernetesControllerEvidence | null;
+    ephemeralContainers: containerEvidence[] | null;
+    initContainers: containerEvidence[] | null;
+    labels: dictionary | null;
+    name: string | null;
+    `namespace`: kubernetesNamespaceEvidence | null;
+    podIp: ipEvidence | null;
+    serviceAccount: kubernetesServiceAccountEvidence | null;
+  }
+
+  @complex model kubernetesSecretEvidence extends alertEvidence {
+    name: string | null;
+    `namespace`: kubernetesNamespaceEvidence | null;
+    secretType: string | null;
+  }
+
+  @complex model kubernetesServiceAccountEvidence extends alertEvidence {
+    name: string | null;
+    `namespace`: kubernetesNamespaceEvidence | null;
+  }
+
+  @complex model kubernetesServiceEvidence extends alertEvidence {
+    clusterIP: ipEvidence | null;
+    externalIPs: ipEvidence[] | null;
+    labels: dictionary | null;
+    name: string | null;
+    `namespace`: kubernetesNamespaceEvidence | null;
+    selector: dictionary | null;
+    servicePorts: kubernetesServicePort[] | null;
+    serviceType: kubernetesServiceType;
+  }
+
+  @complex model kubernetesServicePort {
+    appProtocol: string | null;
+    name: string | null;
+    nodePort: int32;
+    port: int32;
+    protocol: containerPortProtocol | null;
+    targetPort: string | null;
+  }
+
+  /**
+   * Audit data for Label Analytics Aggregate events.
+   */
+  @open
+  @complex model labelAnalyticsAggregateAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Label Content Explorer events.
+   */
+  @open
+  @complex model labelContentExplorerAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Large Content Meta events.
+   */
+  @open
+  @complex model largeContentMetadataAuditRecord extends auditData {
+  }
+
+  @complex model loggedOnUser {
+    accountName: string | null;
+    domainName: string | null;
+  }
+
+  /**
+   * Audit data for M365 Compliance Connector events.
+   */
+  @open
+  @complex model m365ComplianceConnectorAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for M365daad events.
+   */
+  @open
+  @complex model m365daadAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for M365odsp Asset Meta events.
+   */
+  @open
+  @complex model m365odspAssetMetadataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for M365 Search Sections events.
+   */
+  @open
+  @complex model m365SearchSectionsRecord extends auditData {
+  }
+
+  @complex model mailboxConfigurationEvidence extends alertEvidence {
+    configurationId: string | null;
+    configurationType: mailboxConfigurationType | null;
+    displayName: string | null;
+    externalDirectoryObjectId: guid | null;
+    mailboxPrimaryAddress: string | null;
+    upn: string | null;
+  }
+
+  @complex model mailboxEvidence extends alertEvidence {
+    displayName: string | null;
+    primaryAddress: string | null;
+    upn: string | null;
+    userAccount: userAccount | null;
+  }
+
+  @complex model mailClusterEvidence extends alertEvidence {
+    clusterBy: string | null;
+    clusterByValue: string | null;
+    emailCount: int64 | null;
+    networkMessageIds: string[] | null;
+    query: string | null;
+    urn: string | null;
+  }
+
+  /**
+   * Audit data for Mail Submission events.
+   */
+  @open
+  @complex model mailSubmissionData extends auditData {
+  }
+
+  @complex model malwareEvidence extends alertEvidence {
+    category: string | null;
+    files: fileEvidence[] | null;
+    name: string | null;
+    processes: processEvidence[] | null;
+  }
+
+  /**
+   * Audit data for Managed Services events.
+   */
+  @open
+  @complex model managedServicesAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Managed Tenants events.
+   */
+  @open
+  @complex model managedTenantsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Alerts events.
+   */
+  @open
+  @complex model mapgAlertsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Onboard events.
+   */
+  @open
+  @complex model mapgOnboardAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Policy events.
+   */
+  @open
+  @complex model mapgPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Remediation events.
+   */
+  @open
+  @complex model mapgRemediationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MCAS Alerts events.
+   */
+  @open
+  @complex model mcasAlertsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDA events.
+   */
+  @open
+  @complex model mdaAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDA Data Security Signal events.
+   */
+  @open
+  @complex model mdaDataSecuritySignalRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDASH events.
+   */
+  @open
+  @complex model mDASHAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDATP events.
+   */
+  @open
+  @complex model mdatpAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDC Events events.
+   */
+  @open
+  @complex model mdcEventsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDI events.
+   */
+  @open
+  @complex model mdiAuditRecord extends auditData {
+  }
+
+  @complex model mergeResponse {
+    targetIncidentId: string;
+  }
+
+  /**
+   * Audit data for Mesh Worlds events.
+   */
+  @open
+  @complex model meshWorldsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft365 Backup Backup Item events.
+   */
+  @open
+  @complex model microsoft365BackupBackupItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft365 Backup Backup Policy events.
+   */
+  @open
+  @complex model microsoft365BackupBackupPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft365 Backup Granular Browse Task events.
+   */
+  @open
+  @complex model microsoft365BackupGranularBrowseTaskAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft365 Backup Restore Item events.
+   */
+  @open
+  @complex model microsoft365BackupRestoreItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft365 Backup Restore Task events.
+   */
+  @open
+  @complex model microsoft365BackupRestoreTaskAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft365 Copilot Scheduled Prompt events.
+   */
+  @open
+  @complex model microsoft365CopilotScheduledPromptAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Defender Experts XDR events.
+   */
+  @open
+  @complex model microsoftDefenderExpertsXDRAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Flow events.
+   */
+  @open
+  @complex model microsoftFlowAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Forms events.
+   */
+  @open
+  @complex model microsoftFormsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Graph Data Connect Consent events.
+   */
+  @open
+  @complex model microsoftGraphDataConnectConsent extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Graph Data Connect Operation events.
+   */
+  @open
+  @complex model microsoftGraphDataConnectOperation extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Purview Data Catalog Operation events.
+   */
+  @open
+  @complex model microsoftPurviewDataCatalogOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Purview Data Map Operation events.
+   */
+  @open
+  @complex model microsoftPurviewDataMapOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Purview Metadata Policy Operation events.
+   */
+  @open
+  @complex model microsoftPurviewMetadataPolicyOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Purview Policy Operation events.
+   */
+  @open
+  @complex model microsoftPurviewPolicyOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Purview Privacy Audit Event events.
+   */
+  @open
+  @complex model microsoftPurviewPrivacyAuditEvent extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Purview Unified Catalog Operation events.
+   */
+  @open
+  @complex model microsoftPurviewUnifiedCatalogOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Stream events.
+   */
+  @open
+  @complex model microsoftStreamAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams Admin events.
+   */
+  @open
+  @complex model microsoftTeamsAdminAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams Analytics events.
+   */
+  @open
+  @complex model microsoftTeamsAnalyticsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams events.
+   */
+  @open
+  @complex model microsoftTeamsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams Device events.
+   */
+  @open
+  @complex model microsoftTeamsDeviceAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams Retention Label Action events.
+   */
+  @open
+  @complex model microsoftTeamsRetentionLabelActionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams Sensitivity Label Action events.
+   */
+  @open
+  @complex model microsoftTeamsSensitivityLabelActionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams Shifts events.
+   */
+  @open
+  @complex model microsoftTeamsShiftsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams User Concern events.
+   */
+  @open
+  @complex model microsoftTeamsUserConcernAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Exchange Item events.
+   */
+  @open
+  @complex model mipAutoLabelExchangeItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Progress Feedback events.
+   */
+  @open
+  @complex model mipAutoLabelProgressFeedbackAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label SharePoint Item events.
+   */
+  @open
+  @complex model mipAutoLabelSharePointItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label SharePoint Policy Location events.
+   */
+  @open
+  @complex model mipAutoLabelSharePointPolicyLocationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Simulation SharePoint Completion events.
+   */
+  @open
+  @complex model mipAutoLabelSimulationSharePointCompletionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Simulation SharePoint Progress events.
+   */
+  @open
+  @complex model mipAutoLabelSimulationSharePointProgressRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Simulation Statistics events.
+   */
+  @open
+  @complex model mipAutoLabelSimulationStatisticsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Exact Data Match events.
+   */
+  @open
+  @complex model mipExactDataMatchAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Label Analytics events.
+   */
+  @open
+  @complex model mipLabelAnalyticsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Label events.
+   */
+  @open
+  @complex model mipLabelAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MOS Agent Info events.
+   */
+  @open
+  @complex model mosAgentInfoRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MOS Agent Info V2 events.
+   */
+  @open
+  @complex model mosAgentInfoRecordV2 extends auditData {
+  }
+
+  /**
+   * Audit data for MS365D Custom Detection events.
+   */
+  @open
+  @complex model ms365dCustomDetectionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MS365D Incident events.
+   */
+  @open
+  @complex model ms365dIncidentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MS365D Suppression Rule events.
+   */
+  @open
+  @complex model ms365dSuppressionRuleAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Custom Collection events.
+   */
+  @open
+  @complex model msdeCustomCollectionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE General Settings events.
+   */
+  @open
+  @complex model msdeGeneralSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Indicators Settings events.
+   */
+  @open
+  @complex model msdeIndicatorsSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Response Actions events.
+   */
+  @open
+  @complex model msdeResponseActionsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Roles Settings events.
+   */
+  @open
+  @complex model msdeRolesSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSP Vector Search Content Metadata events.
+   */
+  @open
+  @complex model mspVectorSearchContentMetadataAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSTIC Nation State Notification events.
+   */
+  @open
+  @complex model msticNationStateNotificationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Multi Stage Disposition events.
+   */
+  @open
+  @complex model multiStageDispositionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for My Analytics Settings events.
+   */
+  @open
+  @complex model myAnalyticsSettingsAuditRecord extends auditData {
+  }
+
+  @complex model networkConnectionEvidence extends alertEvidence {
+    destinationAddress: ipEvidence | null;
+    destinationPort: int32 | null;
+    protocol: protocolType | null;
+    sourceAddress: ipEvidence | null;
+    sourcePort: int32 | null;
+  }
+
+  @complex model nicEvidence extends alertEvidence {
+    ipAddress: ipEvidence | null;
+    macAddress: string | null;
+    vlans: string[] | null;
+  }
+
+  /**
+   * Audit data for Noisy Alert Policy events.
+   */
+  @open
+  @complex model noisyAlertPolicyAuditRecord extends auditData {
+  }
+
+  @complex model oauthApplicationEvidence extends alertEvidence {
+    appId: string | null;
+    displayName: string | null;
+    objectId: string | null;
+    publisher: string | null;
+  }
+
+  @complex model ocrSettings {
+    isEnabled: boolean | null;
+    maxImageSize: int32 | null;
+    timeout: duration | null;
+  }
+
+  /**
+   * Audit data for Office Native events.
+   */
+  @open
+  @complex model officeNativeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for OME Portal events.
+   */
+  @open
+  @complex model omePortalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for On Demand SharePoint Classification events.
+   */
+  @open
+  @complex model onDemandSharePointClassificationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for OneDrive events.
+   */
+  @open
+  @complex model oneDriveAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for On Premises File Share Scanner DLP events.
+   */
+  @open
+  @complex model onPremisesFileShareScannerDLPAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for On Premises SharePoint Scanner DLP events.
+   */
+  @open
+  @complex model onPremisesSharePointScannerDLPAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Organizational Data In M365 events.
+   */
+  @open
+  @complex model organizationalDataInM365AuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Outlook Copilot Automation events.
+   */
+  @open
+  @complex model outlookCopilotAutomationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for OWA Get Access Token For Resource events.
+   */
+  @open
+  @complex model owaGetAccessTokenForResourceAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment Category events.
+   */
+  @open
+  @complex model p4aiAssessmentCategoryRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment Fabric Scanner events.
+   */
+  @open
+  @complex model p4aiAssessmentFabricScannerRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment Location Result events.
+   */
+  @open
+  @complex model p4aiAssessmentLocationResultRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment events.
+   */
+  @open
+  @complex model p4aiAssessmentRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4 AI Risk Score events.
+   */
+  @open
+  @complex model p4AIRiskScoreRecord extends auditData {
+  }
+
+  /**
+   * Audit data for People Admin Settings events.
+   */
+  @open
+  @complex model peopleAdminSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Physical Badging Signal events.
+   */
+  @open
+  @complex model physicalBadgingSignalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Places Directory events.
+   */
+  @open
+  @complex model placesDirectoryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Chat Message events.
+   */
+  @open
+  @complex model plannerChatMessageAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Chat Message List events.
+   */
+  @open
+  @complex model plannerChatMessageListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Copy Plan events.
+   */
+  @open
+  @complex model plannerCopyPlanAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Goal events.
+   */
+  @open
+  @complex model plannerGoalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Goal List events.
+   */
+  @open
+  @complex model plannerGoalListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Plan events.
+   */
+  @open
+  @complex model plannerPlanAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Plan List events.
+   */
+  @open
+  @complex model plannerPlanListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Plan Sensitivity Label events.
+   */
+  @open
+  @complex model plannerPlanSensitivityLabelAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Roster events.
+   */
+  @open
+  @complex model plannerRosterAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Roster Sensitivity Label events.
+   */
+  @open
+  @complex model plannerRosterSensitivityLabelAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Task events.
+   */
+  @open
+  @complex model plannerTaskAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Task List events.
+   */
+  @open
+  @complex model plannerTaskListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Tenant Settings events.
+   */
+  @open
+  @complex model plannerTenantSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Policy Config Change events.
+   */
+  @open
+  @complex model policyConfigChangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for PowerApps Audit App events.
+   */
+  @open
+  @complex model powerAppsAuditAppRecord extends auditData {
+  }
+
+  /**
+   * Audit data for PowerApps Audit Plan events.
+   */
+  @open
+  @complex model powerAppsAuditPlanRecord extends auditData {
+  }
+
+  /**
+   * Audit data for PowerApps Audit Resource events.
+   */
+  @open
+  @complex model powerAppsAuditResourceRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power BI events.
+   */
+  @open
+  @complex model powerBIAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power BI DLP events.
+   */
+  @open
+  @complex model powerBIDlpAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Pages Site events.
+   */
+  @open
+  @complex model powerPagesSiteAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Admin DLP events.
+   */
+  @open
+  @complex model powerPlatformAdminDlpAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Admin Environment events.
+   */
+  @open
+  @complex model powerPlatformAdminEnvironmentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Administrator Activity events.
+   */
+  @open
+  @complex model powerPlatformAdministratorActivityRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Lockbox Resource Access Request events.
+   */
+  @open
+  @complex model powerPlatformLockboxResourceAccessRequestAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Lockbox Resource Command events.
+   */
+  @open
+  @complex model powerPlatformLockboxResourceCommandAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Service Activity events.
+   */
+  @open
+  @complex model powerPlatformServiceActivityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Tenant Isolation events.
+   */
+  @open
+  @complex model powerPlatformTenantIsolationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Data Match events.
+   */
+  @open
+  @complex model privacyDataMatchAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Data Minimization events.
+   */
+  @open
+  @complex model privacyDataMinimizationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Digest Email events.
+   */
+  @open
+  @complex model privacyDigestEmailRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Open Access events.
+   */
+  @open
+  @complex model privacyOpenAccessAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Portal events.
+   */
+  @open
+  @complex model privacyPortalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Remediation Action events.
+   */
+  @open
+  @complex model privacyRemediationActionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Remediation events.
+   */
+  @open
+  @complex model privacyRemediationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Priva Privacy Assessment Operation events.
+   */
+  @open
+  @complex model privaPrivacyAssessmentOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Priva Privacy Consent Operation events.
+   */
+  @open
+  @complex model privaPrivacyConsentOperationRecord extends auditData {
+  }
+
+  @complex model processEvidence extends alertEvidence {
+    detectionStatus: detectionStatus | null;
+    imageFile: fileDetails | null;
+    mdeDeviceId: string | null;
+    parentProcessCreationDateTime: offsetDateTime | null;
+    parentProcessId: int64 | null;
+    parentProcessImageFile: fileDetails | null;
+    processCommandLine: string | null;
+    processCreationDateTime: offsetDateTime | null;
+    processId: int64 | null;
+    userAccount: userAccount | null;
+  }
+
+  /**
+   * Audit data for Microsoft Project events.
+   */
+  @open
+  @complex model projectAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Assigned To Me Settings events.
+   */
+  @open
+  @complex model projectForTheWebAssignedToMeSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Project events.
+   */
+  @open
+  @complex model projectForTheWebProjectAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Project Settings events.
+   */
+  @open
+  @complex model projectForTheWebProjectSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Roadmap events.
+   */
+  @open
+  @complex model projectForTheWebRoadmapAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Roadmap Item events.
+   */
+  @open
+  @complex model projectForTheWebRoadmapItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Roadmap Settings events.
+   */
+  @open
+  @complex model projectForTheWebRoadmapSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Task events.
+   */
+  @open
+  @complex model projectForTheWebTaskAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange public folder events.
+   */
+  @open
+  @complex model publicFolderAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview Insider Risk Alerts events.
+   */
+  @open
+  @complex model purviewInsiderRiskAlertsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview Insider Risk Cases events.
+   */
+  @open
+  @complex model purviewInsiderRiskCasesRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview MC Recommendation events.
+   */
+  @open
+  @complex model purviewMCRecommendationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview Posture Agent events.
+   */
+  @open
+  @complex model purviewPostureAgentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for quarantine events.
+   */
+  @open
+  @complex model quarantineAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Records Management events.
+   */
+  @open
+  @complex model recordsManagementAuditRecord extends auditData {
+  }
+
+  @complex model redundancyDetectionSettings {
+    isEnabled: boolean | null;
+    maxWords: int32 | null;
+    minWords: int32 | null;
+    similarityThreshold: int32 | null;
+  }
+
+  @complex model registryKeyEvidence extends alertEvidence {
+    registryHive: string | null;
+    registryKey: string | null;
+  }
+
+  @complex model registryValueEvidence extends alertEvidence {
+    mdeDeviceId: string | null;
+    registryHive: string | null;
+    registryKey: string | null;
+    registryValue: string | null;
+    registryValueName: string | null;
+    registryValueType: string | null;
+  }
+
+  @complex model reportFileMetadata {
+    downloadUrl: string | null;
+    fileName: string | null;
+    size: int64 | null;
+  }
+
+  /**
+   * Audit data for Report Submission events.
+   */
+  @open
+  @complex model reportSubmission extends auditData {
+  }
+
+  /**
+   * Audit data for Report Submission Result Detail events.
+   */
+  @open
+  @complex model reportSubmissionResultDetail extends auditData {
+  }
+
+  @complex model resourceAccessEvent {
+    accessDateTime: offsetDateTime | null;
+    accountId: string | null;
+    ipAddress: string | null;
+    resourceIdentifier: string | null;
+  }
+
+  /**
+   * Audit data for Restricted Mode events.
+   */
+  @open
+  @complex model restrictedModeAuditRecord extends auditData {
+  }
+
+  @abstract
+  @complex model retentionDuration {
+  }
+
+  @complex model retentionDurationForever extends retentionDuration {
+  }
+
+  @complex model retentionDurationInDays extends retentionDuration {
+    days: int32 | null;
+  }
+
+  @complex model retentionEventStatus {
+    error: reference.`microsoft.graph`.publicError | null;
+    status: eventStatusType | null;
+  }
+
+  /**
+   * Audit data for Retention Policy events.
+   */
+  @open
+  @complex model retentionPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for RTI Operations Agent events.
+   */
+  @open
+  @complex model rtiOperationsAgentAuditRecord extends auditData {
+  }
+
+  @complex model sasTokenEvidence extends alertEvidence {
+    allowedIpAddresses: string | null;
+    allowedResourceTypes: string[] | null;
+    allowedServices: string[] | null;
+    expiryDateTime: offsetDateTime | null;
+    permissions: string[] | null;
+    protocol: string | null;
+    signatureHash: string | null;
+    signedWith: string | null;
+    startDateTime: offsetDateTime | null;
+    storageResource: azureResourceEvidence | null;
+  }
+
+  /**
+   * Audit data for SBP Configuration Event events.
+   */
+  @open
+  @complex model sbpConfigurationEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SBP Usage Event events.
+   */
+  @open
+  @complex model sbpUsageEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Secure Score evidence events.
+   */
+  @open
+  @complex model scoreEvidence extends auditData {
+  }
+
+  /**
+   * Audit data for Score Platform Generic events.
+   */
+  @open
+  @complex model scorePlatformGenericAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Script Run events.
+   */
+  @open
+  @complex model scriptRunAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for search events.
+   */
+  @open
+  @complex model searchAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance Alert events.
+   */
+  @open
+  @complex model securityComplianceAlertRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance Center EOP cmdlet events.
+   */
+  @open
+  @complex model securityComplianceCenterEOPCmdletAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance Insights events.
+   */
+  @open
+  @complex model securityComplianceInsightsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance RBAC events.
+   */
+  @open
+  @complex model securityComplianceRBACAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance User Change events.
+   */
+  @open
+  @complex model securityComplianceUserChangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Copilot Identity Management events.
+   */
+  @open
+  @complex model securityCopilotIdentityManagementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Development Lifecycle AI Log events.
+   */
+  @open
+  @complex model securityDevelopmentLifecycleAILogAuditRecord extends auditData {
+  }
+
+  @complex model securityGroupEvidence extends alertEvidence {
+    activeDirectoryObjectGuid: guid | null;
+    displayName: string | null;
+    distinguishedName: string | null;
+    friendlyName: string | null;
+    securityGroupId: string | null;
+    sid: string | null;
+  }
+
+  /**
+   * Audit data for Sensitive Info Remediation Agent events.
+   */
+  @open
+  @complex model sensitiveInfoRemediationAgentDataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sensitivity Label Action events.
+   */
+  @open
+  @complex model sensitivityLabelActionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sensitivity Labeled File Action events.
+   */
+  @open
+  @complex model sensitivityLabeledFileActionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sensitivity Label Policy Match events.
+   */
+  @open
+  @complex model sensitivityLabelPolicyMatchAuditRecord extends auditData {
+  }
+
+  @complex model sensorDeploymentPackage {
+    downloadUrl: string;
+    version: string;
+  }
+
+  @complex model sensorSettings {
+    description: string;
+    domainControllerDnsNames: string[] | null;
+    isDelayedDeploymentEnabled: boolean | null;
+    @contains networkAdapters: networkAdapter[];
+  }
+
+  /**
+   * Audit data for Sentinel AI Tool events.
+   */
+  @open
+  @complex model sentinelAIToolAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Graph events.
+   */
+  @open
+  @complex model sentinelGraphAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Job events.
+   */
+  @open
+  @complex model sentinelJobAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel KQL On Lake events.
+   */
+  @open
+  @complex model sentinelKQLOnLakeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Lake Data Onboarding events.
+   */
+  @open
+  @complex model sentinelLakeDataOnboardingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Lake Encryption events.
+   */
+  @open
+  @complex model sentinelLakeEncryptionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Lake Onboarding events.
+   */
+  @open
+  @complex model sentinelLakeOnboardingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Notebook On Lake events.
+   */
+  @open
+  @complex model sentinelNotebookOnLakeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Package events.
+   */
+  @open
+  @complex model sentinelPackageAuditRecord extends auditData {
+  }
+
+  @complex model servicePrincipalEvidence extends alertEvidence {
+    appId: string | null;
+    appOwnerTenantId: string | null;
+    servicePrincipalName: string | null;
+    servicePrincipalObjectId: string | null;
+    servicePrincipalType: servicePrincipalType | null;
+    tenantId: string | null;
+  }
+
+  /**
+   * Audit data for SharePoint App Permission Operation events.
+   */
+  @open
+  @complex model sharePointAppPermissionOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint events.
+   */
+  @open
+  @complex model sharePointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Comment Operation events.
+   */
+  @open
+  @complex model sharePointCommentOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Content Security Policy events.
+   */
+  @open
+  @complex model sharePointContentSecurityPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Content Type Operation events.
+   */
+  @open
+  @complex model sharePointContentTypeOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint E Signature events.
+   */
+  @open
+  @complex model sharePointESignatureAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Field Operation events.
+   */
+  @open
+  @complex model sharePointFieldOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint File Operation events.
+   */
+  @open
+  @complex model sharePointFileOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint List Item Operation events.
+   */
+  @open
+  @complex model sharePointListItemOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint List Operation events.
+   */
+  @open
+  @complex model sharePointListOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Sharing Operation events.
+   */
+  @open
+  @complex model sharePointSharingOperationAuditRecord extends auditData {
+  }
+
+  @complex model singlePropertySchema {
+    name: string | null;
+    type: string | null;
+  }
+
+  /**
+   * Audit data for Skype for Business cmdlets events.
+   */
+  @open
+  @complex model skypeForBusinessCmdletsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Skype for Business PSTN Usage events.
+   */
+  @open
+  @complex model skypeForBusinessPSTNUsageAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Skype for Business Users Blocked events.
+   */
+  @open
+  @complex model skypeForBusinessUsersBlockedAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar Detonation Content Meta events.
+   */
+  @open
+  @complex model sonarDetonationContentMetadata extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar Detonation Entity events.
+   */
+  @open
+  @complex model sonarDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar File Detonation Entity events.
+   */
+  @open
+  @complex model sonarFileDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar Submission Entity events.
+   */
+  @open
+  @complex model sonarSubmissionEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar URL Detonation Entity events.
+   */
+  @open
+  @complex model sonarUrlDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Spark Core Custom Live Pool events.
+   */
+  @open
+  @complex model sparkCoreCustomLivePoolRecord extends auditData {
+  }
+
+  @complex model sslCertificateEntity {
+    address: reference.`microsoft.graph`.physicalAddress | null;
+    alternateNames: string[] | null;
+    commonName: string | null;
+    email: string | null;
+    givenName: string | null;
+    organizationName: string | null;
+    organizationUnitName: string | null;
+    serialNumber: string | null;
+    surname: string | null;
+  }
+
+  @complex model stream {
+    name: string | null;
+  }
+
+  @open
+  @complex model stringValueDictionary {
+  }
+
+  /**
+   * Audit data for Submission Entity events.
+   */
+  @open
+  @complex model submissionEntityAuditRecord extends auditData {
+  }
+
+  @complex model submissionMailEvidence extends alertEvidence {
+    networkMessageId: string | null;
+    recipient: string | null;
+    reportType: string | null;
+    sender: string | null;
+    senderIp: string | null;
+    subject: string | null;
+    submissionDateTime: offsetDateTime | null;
+    submissionId: string | null;
+    submitter: string | null;
+  }
+
+  /**
+   * Audit data for Supervisory Review Day X Insights events.
+   */
+  @open
+  @complex model supervisoryReviewDayXInsightsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Synthetic Probe events.
+   */
+  @open
+  @complex model syntheticProbeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Team Copilot Interaction events.
+   */
+  @open
+  @complex model teamCopilotInteractionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Easy Approvals events.
+   */
+  @open
+  @complex model teamsEasyApprovalsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Eval Data Hub Admin Operation events.
+   */
+  @open
+  @complex model teamsEvalDataHubAdminOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Eval Data Hub Data Access events.
+   */
+  @open
+  @complex model teamsEvalDataHubDataAccessAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Eval Data Hub Permission Change events.
+   */
+  @open
+  @complex model teamsEvalDataHubPermissionChangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Healthcare events.
+   */
+  @open
+  @complex model teamsHealthcareAuditRecord extends auditData {
+  }
+
+  @complex model teamsMessageEvidence extends alertEvidence {
+    campaignId: string | null;
+    channelId: string | null;
+    deliveryAction: teamsMessageDeliveryAction | null;
+    deliveryLocation: teamsDeliveryLocation | null;
+    files: fileEvidence[] | null;
+    groupId: string | null;
+    isExternal: boolean | null;
+    isOwned: boolean | null;
+    @computed lastModifiedDateTime: offsetDateTime | null;
+    messageDirection: antispamTeamsDirection | null;
+    messageId: string | null;
+    owningTenantId: guid | null;
+    parentMessageId: string | null;
+    receivedDateTime: offsetDateTime | null;
+    recipients: string[] | null;
+    senderFromAddress: string | null;
+    senderIP: string | null;
+    sourceAppName: string | null;
+    sourceId: string | null;
+    subject: string | null;
+    suspiciousRecipients: string[] | null;
+    threadId: string | null;
+    threadType: string | null;
+    urls: urlEvidence[] | null;
+  }
+
+  /**
+   * Audit data for Teams Updates events.
+   */
+  @open
+  @complex model teamsUpdatesAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Tenant Allow Block List events.
+   */
+  @open
+  @complex model tenantAllowBlockListAuditRecord extends auditData {
+  }
+
+  @complex model threatDetectionDetail {
+    confidenceLevel: string | null;
+    priorityAccountProtection: string | null;
+    threats: string | null;
+  }
+
+  /**
+   * Audit data for Threat Finder events.
+   */
+  @open
+  @complex model threatFinderAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Atp Content events.
+   */
+  @open
+  @complex model threatIntelligenceAtpContentData extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Export events.
+   */
+  @open
+  @complex model threatIntelligenceExportAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Mail events.
+   */
+  @open
+  @complex model threatIntelligenceMailData extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Object events.
+   */
+  @open
+  @complex model threatIntelligenceObjectAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Url Click events.
+   */
+  @open
+  @complex model threatIntelligenceUrlClickData extends auditData {
+  }
+
+  @complex model timelineEvent {
+    eventDateTime: offsetDateTime | null;
+    eventDetails: string | null;
+    eventResult: string | null;
+    eventSource: eventSource | null;
+    eventThreats: string[] | null;
+    eventType: timelineEventType | null;
+  }
+
+  /**
+   * Audit data for Microsoft To Do events.
+   */
+  @open
+  @complex model todoAuditRecord extends auditData {
+  }
+
+  @complex model topicModelingSettings {
+    dynamicallyAdjustTopicCount: boolean | null;
+    ignoreNumbers: boolean | null;
+    isEnabled: boolean | null;
+    topicCount: int32 | null;
+  }
+
+  /**
+   * Audit data for Trainable Classifier events.
+   */
+  @open
+  @complex model trainableClassifierAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for UAM Operation events.
+   */
+  @open
+  @complex model uamOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Unified Group events.
+   */
+  @open
+  @complex model unifiedGroupAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Unified Simulation Matched Item events.
+   */
+  @open
+  @complex model unifiedSimulationMatchedItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Unified Simulation Summary events.
+   */
+  @open
+  @complex model unifiedSimulationSummaryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Universal Print Management events.
+   */
+  @open
+  @complex model universalPrintManagementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Universal Print Print Job events.
+   */
+  @open
+  @complex model universalPrintPrintJobAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for URBAC Assignment events.
+   */
+  @open
+  @complex model urbacAssignmentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for URBAC Enable State events.
+   */
+  @open
+  @complex model urbacEnableStateAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for URBAC Role events.
+   */
+  @open
+  @complex model urbacRoleAuditRecord extends auditData {
+  }
+
+  @complex model urlEvidence extends alertEvidence {
+    url: string | null;
+  }
+
+  @complex model userAccount {
+    accountName: string | null;
+    activeDirectoryObjectGuid: guid | null;
+    azureAdUserId: string | null;
+    displayName: string | null;
+    domainName: string | null;
+    resourceAccessEvents: resourceAccessEvent[] | null;
+    tenantId: string | null;
+    userPrincipalName: string | null;
+    userSid: string | null;
+  }
+
+  @complex model userEvidence extends alertEvidence {
+    stream: stream | null;
+    userAccount: userAccount | null;
+  }
+
+  /**
+   * Audit data for User Training events.
+   */
+  @open
+  @complex model userTrainingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for USX Workspace Onboarding events.
+   */
+  @open
+  @complex model usxWorkspaceOnboardingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for VFAM Create Policy events.
+   */
+  @open
+  @complex model vfamCreatePolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for VFAM Delete Policy events.
+   */
+  @open
+  @complex model vfamDeletePolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for VFAM Update Policy events.
+   */
+  @open
+  @complex model vfamUpdatePolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Amplify events.
+   */
+  @open
+  @complex model vivaAmplifyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Engage Events events.
+   */
+  @open
+  @complex model vivaEngageEventsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Engage Network Association events.
+   */
+  @open
+  @complex model vivaEngageNetworkAssociationAuditRecord extends auditData {
   }
 
-  @abstract
-  @complex model retentionDuration {
+  /**
+   * Audit data for Viva Engage Segment events.
+   */
+  @open
+  @complex model vivaEngageSegmentAuditRecord extends auditData {
   }
 
-  @complex model retentionDurationForever extends retentionDuration {
+  /**
+   * Audit data for Viva Glint Advanced Configuration events.
+   */
+  @open
+  @complex model vivaGlintAdvancedConfigurationAuditRecord extends auditData {
   }
 
-  @complex model retentionDurationInDays extends retentionDuration {
-    days: int32 | null;
+  /**
+   * Audit data for Viva Glint Agentic Campaign events.
+   */
+  @open
+  @complex model vivaGlintAgenticCampaignAuditRecord extends auditData {
   }
 
-  @complex model retentionEventStatus {
-    error: reference.`microsoft.graph`.publicError | null;
-    status: eventStatusType | null;
+  /**
+   * Audit data for Viva Glint Feedback Program events.
+   */
+  @open
+  @complex model vivaGlintFeedbackProgramAuditRecord extends auditData {
   }
 
-  @complex model sasTokenEvidence extends alertEvidence {
-    allowedIpAddresses: string | null;
-    allowedResourceTypes: string[] | null;
-    allowedServices: string[] | null;
-    expiryDateTime: offsetDateTime | null;
-    permissions: string[] | null;
-    protocol: string | null;
-    signatureHash: string | null;
-    signedWith: string | null;
-    startDateTime: offsetDateTime | null;
-    storageResource: azureResourceEvidence | null;
+  /**
+   * Audit data for Viva Glint Organizational events.
+   */
+  @open
+  @complex model vivaGlintOrganizationalDataAuditRecord extends auditData {
   }
 
-  @complex model securityGroupEvidence extends alertEvidence {
-    activeDirectoryObjectGuid: guid | null;
-    displayName: string | null;
-    distinguishedName: string | null;
-    friendlyName: string | null;
-    securityGroupId: string | null;
-    sid: string | null;
+  /**
+   * Audit data for Viva Glint Pulse Program events.
+   */
+  @open
+  @complex model vivaGlintPulseProgramAuditRecord extends auditData {
   }
 
-  @complex model sensorDeploymentPackage {
-    downloadUrl: string;
-    version: string;
+  /**
+   * Audit data for Viva Glint Pulse Program Respondent Rate events.
+   */
+  @open
+  @complex model vivaGlintPulseProgramRespondentRateAuditRecord extends auditData {
   }
 
-  @complex model sensorSettings {
-    description: string;
-    domainControllerDnsNames: string[] | null;
-    isDelayedDeploymentEnabled: boolean | null;
-    @contains networkAdapters: networkAdapter[];
+  /**
+   * Audit data for Viva Glint Question events.
+   */
+  @open
+  @complex model vivaGlintQuestionAuditRecord extends auditData {
   }
 
-  @complex model servicePrincipalEvidence extends alertEvidence {
-    appId: string | null;
-    appOwnerTenantId: string | null;
-    servicePrincipalName: string | null;
-    servicePrincipalObjectId: string | null;
-    servicePrincipalType: servicePrincipalType | null;
-    tenantId: string | null;
+  /**
+   * Audit data for Viva Glint Role events.
+   */
+  @open
+  @complex model vivaGlintRoleAuditRecord extends auditData {
   }
 
-  @complex model singlePropertySchema {
-    name: string | null;
-    type: string | null;
+  /**
+   * Audit data for Viva Glint Rubicon events.
+   */
+  @open
+  @complex model vivaGlintRubiconAuditRecord extends auditData {
   }
 
-  @complex model sslCertificateEntity {
-    address: reference.`microsoft.graph`.physicalAddress | null;
-    alternateNames: string[] | null;
-    commonName: string | null;
-    email: string | null;
-    givenName: string | null;
-    organizationName: string | null;
-    organizationUnitName: string | null;
-    serialNumber: string | null;
-    surname: string | null;
+  /**
+   * Audit data for Viva Glint Support Access events.
+   */
+  @open
+  @complex model vivaGlintSupportAccessAuditRecord extends auditData {
   }
 
-  @complex model stream {
-    name: string | null;
+  /**
+   * Audit data for Viva Glint System events.
+   */
+  @open
+  @complex model vivaGlintSystemAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Viva Glint User events.
+   */
   @open
-  @complex model stringValueDictionary {
+  @complex model vivaGlintUserAuditRecord extends auditData {
   }
 
-  @complex model submissionMailEvidence extends alertEvidence {
-    networkMessageId: string | null;
-    recipient: string | null;
-    reportType: string | null;
-    sender: string | null;
-    senderIp: string | null;
-    subject: string | null;
-    submissionDateTime: offsetDateTime | null;
-    submissionId: string | null;
-    submitter: string | null;
+  /**
+   * Audit data for Viva Glint User Group events.
+   */
+  @open
+  @complex model vivaGlintUserGroupAuditRecord extends auditData {
   }
 
-  @complex model teamsMessageEvidence extends alertEvidence {
-    campaignId: string | null;
-    channelId: string | null;
-    deliveryAction: teamsMessageDeliveryAction | null;
-    deliveryLocation: teamsDeliveryLocation | null;
-    files: fileEvidence[] | null;
-    groupId: string | null;
-    isExternal: boolean | null;
-    isOwned: boolean | null;
-    @computed lastModifiedDateTime: offsetDateTime | null;
-    messageDirection: antispamTeamsDirection | null;
-    messageId: string | null;
-    owningTenantId: guid | null;
-    parentMessageId: string | null;
-    receivedDateTime: offsetDateTime | null;
-    recipients: string[] | null;
-    senderFromAddress: string | null;
-    senderIP: string | null;
-    sourceAppName: string | null;
-    sourceId: string | null;
-    subject: string | null;
-    suspiciousRecipients: string[] | null;
-    threadId: string | null;
-    threadType: string | null;
-    urls: urlEvidence[] | null;
+  /**
+   * Audit data for Viva Goals events.
+   */
+  @open
+  @complex model vivaGoalsAuditRecord extends auditData {
   }
 
-  @complex model threatDetectionDetail {
-    confidenceLevel: string | null;
-    priorityAccountProtection: string | null;
-    threats: string | null;
+  /**
+   * Audit data for Viva Learning Admin events.
+   */
+  @open
+  @complex model vivaLearningAdminAuditRecord extends auditData {
   }
 
-  @complex model timelineEvent {
-    eventDateTime: offsetDateTime | null;
-    eventDetails: string | null;
-    eventResult: string | null;
-    eventSource: eventSource | null;
-    eventThreats: string[] | null;
-    eventType: timelineEventType | null;
+  /**
+   * Audit data for Viva Learning events.
+   */
+  @open
+  @complex model vivaLearningAuditRecord extends auditData {
   }
 
-  @complex model topicModelingSettings {
-    dynamicallyAdjustTopicCount: boolean | null;
-    ignoreNumbers: boolean | null;
-    isEnabled: boolean | null;
-    topicCount: int32 | null;
+  /**
+   * Audit data for Viva Pulse Admin events.
+   */
+  @open
+  @complex model vivaPulseAdminAuditRecord extends auditData {
   }
 
-  @complex model urlEvidence extends alertEvidence {
-    url: string | null;
+  /**
+   * Audit data for Viva Pulse Organizer events.
+   */
+  @open
+  @complex model vivaPulseOrganizerAuditRecord extends auditData {
   }
 
-  @complex model userAccount {
-    accountName: string | null;
-    activeDirectoryObjectGuid: guid | null;
-    azureAdUserId: string | null;
-    displayName: string | null;
-    domainName: string | null;
-    resourceAccessEvents: resourceAccessEvent[] | null;
-    tenantId: string | null;
-    userPrincipalName: string | null;
-    userSid: string | null;
+  /**
+   * Audit data for Viva Pulse Report events.
+   */
+  @open
+  @complex model vivaPulseReportAuditRecord extends auditData {
   }
 
-  @complex model userEvidence extends alertEvidence {
-    stream: stream | null;
-    userAccount: userAccount | null;
+  /**
+   * Audit data for Viva Pulse Response events.
+   */
+  @open
+  @complex model vivaPulseResponseAuditRecord extends auditData {
   }
 
   @complex model vmMetadata {
@@ -38469,6 +41401,20 @@ namespace reference.`microsoft.graph.security` {
     vmId: string | null;
   }
 
+  /**
+   * Audit data for WDATP Alerts events.
+   */
+  @open
+  @complex model wdatpAlertsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Web Content Filtering events.
+   */
+  @open
+  @complex model webContentFilteringAuditRecord extends auditData {
+  }
+
   @complex model whoisContact {
     address: reference.`microsoft.graph`.physicalAddress | null;
     email: string | null;
@@ -38484,6 +41430,34 @@ namespace reference.`microsoft.graph.security` {
     @references host: host;
   }
 
+  /**
+   * Audit data for Windows365 Customer Lockbox events.
+   */
+  @open
+  @complex model windows365CustomerLockboxAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Workplace Analytics events.
+   */
+  @open
+  @complex model workplaceAnalyticsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Yammer events.
+   */
+  @open
+  @complex model yammerAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Yammer User Hiding events.
+   */
+  @open
+  @complex model yammerUserHidingAuditRecord extends auditData {
+  }
+
   @entity model alert extends reference.`microsoft.graph`.entity {
     actorDisplayName: string | null;
     additionalData: dictionary | null;
@@ -38583,6 +41557,50 @@ namespace reference.`microsoft.graph.security` {
   @entity model artifact extends reference.`microsoft.graph`.entity {
   }
 
+  /**
+   * Root entity for the audit log API.
+   */
+  @entity model auditCoreRoot extends reference.`microsoft.graph`.entity {
+    @contains queries: auditLogQuery[];
+  }
+
+  /**
+   * Represents a query against the unified audit log.
+   */
+  @entity model auditLogQuery extends reference.`microsoft.graph`.entity {
+    administrativeUnitIdFilters: string[] | null;
+    displayName: string | null;
+    filterEndDateTime: offsetDateTime | null;
+    filterStartDateTime: offsetDateTime | null;
+    ipAddressFilters: string[] | null;
+    keywordFilter: string | null;
+    objectIdFilters: string[] | null;
+    operationFilters: string[] | null;
+    recordTypeFilters: auditLogRecordType[] | null;
+    serviceFilters: string[] | null;
+    status: auditLogQueryStatus | null;
+    userPrincipalNameFilters: string[] | null;
+    @contains records: auditLogRecord[];
+  }
+
+  /**
+   * Represents an individual audit log record.
+   */
+  @entity model auditLogRecord extends reference.`microsoft.graph`.entity {
+    administrativeUnits: string[] | null;
+    auditData: auditData | null;
+    auditLogRecordType: auditLogRecordType | null;
+    clientIp: string | null;
+    @computed createdDateTime: offsetDateTime | null;
+    objectId: string | null;
+    operation: string | null;
+    organizationId: string | null;
+    service: string | null;
+    userId: string | null;
+    userPrincipalName: string | null;
+    userType: auditLogUserType | null;
+  }
+
   @entity model authorityTemplate extends filePlanDescriptorTemplate {
   }
 
@@ -39347,6 +42365,514 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 31,
   }
 
+  /**
+   * Status of an audit log query.
+   */
+  enum auditLogQueryStatus {
+    notStarted: 0,
+    running: 1,
+    succeeded: 2,
+    failed: 3,
+    cancelled: 4,
+    unknownFutureValue: 5,
+  }
+
+  /**
+   * Specifies the type of audit log record.
+   */
+  enum auditLogRecordType {
+    ExchangeAdmin: 1,
+    ExchangeItem: 2,
+    ExchangeItemGroup: 3,
+    SharePoint: 4,
+    SyntheticProbe: 5,
+    SharePointFileOperation: 6,
+    OneDrive: 7,
+    AzureActiveDirectory: 8,
+    AzureActiveDirectoryAccountLogon: 9,
+    DataCenterSecurityCmdlet: 10,
+    ComplianceDLPSharePoint: 11,
+    Sway: 12,
+    ComplianceDLPExchange: 13,
+    SharePointSharingOperation: 14,
+    AzureActiveDirectoryStsLogon: 15,
+    SkypeForBusinessPSTNUsage: 16,
+    SkypeForBusinessUsersBlocked: 17,
+    SecurityComplianceCenterEOPCmdlet: 18,
+    ExchangeAggregatedOperation: 19,
+    PowerBIAudit: 20,
+    CRM: 21,
+    Yammer: 22,
+    SkypeForBusinessCmdlets: 23,
+    Discovery: 24,
+    MicrosoftTeams: 25,
+    ThreatIntelligence: 28,
+    MailSubmission: 29,
+    MicrosoftFlow: 30,
+    AeD: 31,
+    MicrosoftStream: 32,
+    ComplianceDLPSharePointClassification: 33,
+    ThreatFinder: 34,
+    Project: 35,
+    SharePointListOperation: 36,
+    SharePointCommentOperation: 37,
+    DataGovernance: 38,
+    Kaizala: 39,
+    SecurityComplianceAlerts: 40,
+    ThreatIntelligenceUrl: 41,
+    SecurityComplianceInsights: 42,
+    MIPLabel: 43,
+    WorkplaceAnalytics: 44,
+    PowerAppsApp: 45,
+    PowerAppsPlan: 46,
+    ThreatIntelligenceAtpContent: 47,
+    LabelContentExplorer: 48,
+    TeamsHealthcare: 49,
+    ExchangeItemAggregated: 50,
+    HygieneEvent: 51,
+    DataInsightsRestApiAudit: 52,
+    InformationBarrierPolicyApplication: 53,
+    SharePointListItemOperation: 54,
+    SharePointContentTypeOperation: 55,
+    SharePointFieldOperation: 56,
+    MicrosoftTeamsAdmin: 57,
+    HRSignal: 58,
+    MicrosoftTeamsDevice: 59,
+    MicrosoftTeamsAnalytics: 60,
+    InformationWorkerProtection: 61,
+    Campaign: 62,
+    DLPEndpoint: 63,
+    AirInvestigation: 64,
+    Quarantine: 65,
+    MicrosoftForms: 66,
+    ApplicationAudit: 67,
+    ComplianceSupervisionExchange: 68,
+    CustomerKeyServiceEncryption: 69,
+    OfficeNative: 70,
+    MipAutoLabelSharePointItem: 71,
+    MipAutoLabelSharePointPolicyLocation: 72,
+    MicrosoftTeamsShifts: 73,
+    SecureScore: 74,
+    MipAutoLabelExchangeItem: 75,
+    CortanaBriefing: 76,
+    Search: 77,
+    WDATPAlerts: 78,
+    PowerPlatformAdminDlp: 79,
+    PowerPlatformAdminEnvironment: 80,
+    MDATPAudit: 81,
+    SensitivityLabelPolicyMatch: 82,
+    SensitivityLabelAction: 83,
+    SensitivityLabeledFileAction: 84,
+    AttackSim: 85,
+    AirManualInvestigation: 86,
+    SecurityComplianceRBAC: 87,
+    UserTraining: 88,
+    AirAdminActionInvestigation: 89,
+    MSTIC: 90,
+    PhysicalBadgingSignal: 91,
+    TeamsEasyApprovals: 92,
+    AipDiscover: 93,
+    AipSensitivityLabelAction: 94,
+    AipProtectionAction: 95,
+    AipFileDeleted: 96,
+    AipHeartBeat: 97,
+    MCASAlerts: 98,
+    OnPremisesFileShareScannerDlp: 99,
+    OnPremisesSharePointScannerDlp: 100,
+    ExchangeSearch: 101,
+    SharePointSearch: 102,
+    PrivacyDataMinimization: 103,
+    LabelAnalyticsAggregate: 104,
+    MyAnalyticsSettings: 105,
+    SecurityComplianceUserChange: 106,
+    ComplianceDLPExchangeClassification: 107,
+    ComplianceDLPEndpoint: 108,
+    MipExactDataMatch: 109,
+    MSDEResponseActions: 110,
+    MSDEGeneralSettings: 111,
+    MSDEIndicatorsSettings: 112,
+    MS365DCustomDetection: 113,
+    MSDERolesSettings: 114,
+    MAPGAlerts: 115,
+    MAPGPolicy: 116,
+    MAPGRemediation: 117,
+    PrivacyRemediationAction: 118,
+    PrivacyDigestEmail: 119,
+    MipAutoLabelSimulationProgress: 120,
+    MipAutoLabelSimulationCompletion: 121,
+    MipAutoLabelProgressFeedback: 122,
+    DlpSensitiveInformationType: 123,
+    MipAutoLabelSimulationStatistics: 124,
+    LargeContentMetadata: 125,
+    Microsoft365Group: 126,
+    CDPMlInferencingResult: 127,
+    FilteringMailMetadata: 128,
+    CDPClassificationMailItem: 129,
+    CDPClassificationDocument: 130,
+    OfficeScriptsRunAction: 131,
+    FilteringPostMailDeliveryAction: 132,
+    CDPUnifiedFeedback: 133,
+    TenantAllowBlockList: 134,
+    ConsumptionResource: 135,
+    HealthcareSignal: 136,
+    DlpImportResult: 138,
+    CDPCompliancePolicyExecution: 139,
+    MultiStageDisposition: 140,
+    PrivacyDataMatch: 141,
+    FilteringDocMetadata: 142,
+    FilteringEmailFeatures: 143,
+    PowerBIDlp: 144,
+    FilteringUrlInfo: 145,
+    FilteringAttachmentInfo: 146,
+    CoreReportingSettings: 147,
+    ComplianceConnector: 148,
+    PowerPlatformLockboxResourceAccessRequest: 149,
+    PowerPlatformLockboxResourceCommand: 150,
+    CDPPredictiveCodingLabel: 151,
+    CDPCompliancePolicyUserFeedback: 152,
+    WebpageActivityEndpoint: 153,
+    OMEPortal: 154,
+    CMImprovementActionChange: 155,
+    FilteringUrlClick: 156,
+    MipLabelAnalyticsAuditRecord: 157,
+    FilteringEntityEvent: 158,
+    FilteringRuleHits: 159,
+    FilteringMailSubmission: 160,
+    LabelExplorer: 161,
+    MicrosoftManagedServicePlatform: 162,
+    PowerPlatformServiceActivity: 163,
+    ScorePlatformGenericAuditRecord: 164,
+    FilteringTimeTravelDocMetadata: 165,
+    Alert: 166,
+    AlertStatus: 167,
+    AlertIncident: 168,
+    IncidentStatus: 169,
+    Case: 170,
+    CaseInvestigation: 171,
+    RecordsManagement: 172,
+    PrivacyRemediation: 173,
+    DataShareOperation: 174,
+    CdpDlpSensitive: 175,
+    EHRConnector: 176,
+    FilteringMailGradingResult: 177,
+    PublicFolder: 178,
+    PrivacyTenantAuditHistoryRecord: 179,
+    AipScannerDiscoverEvent: 180,
+    EduDataLakeDownloadOperation: 181,
+    M365ComplianceConnector: 182,
+    MicrosoftGraphDataConnectOperation: 183,
+    MicrosoftPurview: 184,
+    FilteringEmailContentFeatures: 185,
+    PowerPagesSite: 186,
+    PowerAppsResource: 187,
+    PlannerPlan: 188,
+    PlannerCopyPlan: 189,
+    PlannerTask: 190,
+    PlannerRoster: 191,
+    PlannerPlanList: 192,
+    PlannerTaskList: 193,
+    PlannerTenantSettings: 194,
+    ProjectForTheWebProject: 195,
+    ProjectForTheWebTask: 196,
+    ProjectForTheWebRoadmap: 197,
+    ProjectForTheWebRoadmapItem: 198,
+    ProjectForTheWebProjectSettings: 199,
+    ProjectForTheWebRoadmapSettings: 200,
+    QuarantineMetadata: 201,
+    MicrosoftTodoAudit: 202,
+    TimeTravelFilteringDocMetadata: 203,
+    TeamsQuarantineMetadata: 204,
+    SharePointAppPermissionOperation: 205,
+    MicrosoftTeamsSensitivityLabelAction: 206,
+    FilteringTeamsMetadata: 207,
+    FilteringTeamsUrlInfo: 208,
+    FilteringTeamsPostDeliveryAction: 209,
+    MDCAssessments: 210,
+    MDCRegulatoryComplianceStandards: 211,
+    MDCRegulatoryComplianceControls: 212,
+    MDCRegulatoryComplianceAssessments: 213,
+    MDCSecurityConnectors: 214,
+    MDADataSecuritySignal: 215,
+    VivaGoals: 216,
+    FilteringRuntimeInfo: 217,
+    AttackSimAdmin: 218,
+    MicrosoftGraphDataConnectConsent: 219,
+    FilteringAtpDetonationInfo: 220,
+    PrivacyPortal: 221,
+    ManagedTenants: 222,
+    UnifiedSimulationMatchedItem: 223,
+    UnifiedSimulationSummary: 224,
+    UpdateQuarantineMetadata: 225,
+    MS365DSuppressionRule: 226,
+    PurviewDataMapOperation: 227,
+    FilteringUrlPostClickAction: 228,
+    IrmUserDefinedDetectionSignal: 229,
+    TeamsUpdates: 230,
+    PlannerRosterSensitivityLabel: 231,
+    MS365DIncident: 232,
+    FilteringDelistingMetadata: 233,
+    ComplianceDLPSharePointClassificationExtended: 234,
+    MicrosoftDefenderForIdentityAudit: 235,
+    SupervisoryReviewDayXInsight: 236,
+    DefenderExpertsforXDRAdmin: 237,
+    CDPEdgeBlockedMessage: 238,
+    HostedRpa: 239,
+    CdpContentExplorerAggregateRecord: 240,
+    CDPHygieneAttachmentInfo: 241,
+    CDPHygieneSummary: 242,
+    CDPPostMailDeliveryAction: 243,
+    CDPEmailFeatures: 244,
+    CDPHygieneUrlInfo: 245,
+    CDPUrlClick: 246,
+    CDPPackageManagerHygieneEvent: 247,
+    FilteringDocScan: 248,
+    TimeTravelFilteringDocScan: 249,
+    MAPGOnboard: 250,
+    VfamCreatePolicy: 251,
+    VfamUpdatePolicy: 252,
+    VfamDeletePolicy: 253,
+    M365DAAD: 254,
+    CdpColdCrawlStatus: 255,
+    PowerPlatformAdministratorActivity: 256,
+    Windows365CustomerLockbox: 257,
+    CdpResourceScopeChangeEvent: 258,
+    ComplianceCCExchangeExecutionResult: 259,
+    CdpOcrCostEstimatorRecord: 260,
+    CopilotInteraction: 261,
+    CdpOcrBillingRecord: 262,
+    ComplianceDLPApplications: 263,
+    UAMOperation: 264,
+    VivaLearning: 265,
+    VivaLearningAdmin: 266,
+    PurviewPolicyOperation: 267,
+    PurviewMetadataPolicyOperation: 268,
+    PeopleAdminSettings: 269,
+    CdpComplianceDLPExchangeClassification: 270,
+    CdpComplianceDLPSharePointClassification: 271,
+    FilteringBulkSenderInsightData: 272,
+    FilteringBulkThresholdInsightData: 273,
+    PrivacyOpenAccess: 274,
+    OWAAuth: 275,
+    ComplianceDLPApplicationsClassification: 276,
+    SharePointESignature: 277,
+    Dynamics365BusinessCentral: 278,
+    MeshWorlds: 279,
+    VivaPulseResponse: 280,
+    VivaPulseOrganizer: 281,
+    VivaPulseAdmin: 282,
+    VivaPulseReport: 283,
+    AIAppInteraction: 284,
+    ComplianceDLMExchange: 285,
+    ComplianceDLMSharePoint: 286,
+    ProjectForTheWebAssignedToMeSettings: 287,
+    CPSOperation: 288,
+    ComplianceDLPExchangeDiscovery: 289,
+    PurviewMCRecommendation: 290,
+    ComplianceDLPEndpointDiscovery: 291,
+    InsiderRiskScopedUserInsights: 292,
+    MicrosoftTeamsRetentionLabelAction: 293,
+    AadRiskDetection: 294,
+    AuditSearch: 295,
+    AuditRetentionPolicy: 296,
+    AuditConfig: 297,
+    Microsoft365BackupBackupPolicy: 298,
+    Microsoft365BackupRestoreTask: 299,
+    Microsoft365BackupRestoreItem: 300,
+    Microsoft365BackupBackupItem: 301,
+    URBACAssignment: 302,
+    URBACRole: 303,
+    URBACEnableState: 304,
+    IRMSecurityAlert: 305,
+    PurviewInsiderRiskCases: 306,
+    PurviewInsiderRiskAlerts: 307,
+    InsiderRiskScopedUsers: 308,
+    CdpConsumptionResource: 309,
+    CreateCopilotPlugin: 310,
+    UpdateCopilotPlugin: 311,
+    DeleteCopilotPlugin: 312,
+    EnableCopilotPlugin: 313,
+    DisableCopilotPlugin: 314,
+    CreateCopilotWorkspace: 315,
+    UpdateCopilotWorkspace: 316,
+    DeleteCopilotWorkspace: 317,
+    EnableCopilotWorkspace: 318,
+    DisableCopilotWorkspace: 319,
+    CreateCopilotPromptBook: 320,
+    UpdateCopilotPromptBook: 321,
+    DeleteCopilotPromptBook: 322,
+    EnableCopilotPromptBook: 323,
+    DisableCopilotPromptBook: 324,
+    UpdateCopilotSettings: 325,
+    P4AIAssessmentRecord: 326,
+    P4AIAssessmentLocationResultRecord: 327,
+    ConnectedAIAppInteraction: 328,
+    PrivaPrivacyConsentOperation: 329,
+    PrivaPrivacyAssessmentOperation: 330,
+    DataCatalogAccessRequests: 331,
+    ComplianceSettingsChange: 332,
+    DataSecurityInvestigation: 333,
+    TeamCopilotInteraction: 334,
+    IRMActivityAuditTrail: 335,
+    SharePointContentSecurityPolicy: 336,
+    CloudUpdateProfileConfig: 337,
+    CloudUpdateTenantConfig: 338,
+    CloudUpdateDeviceConfig: 339,
+    DefenderPreviewFeatures: 340,
+    DeviceDiscoverySettingsExclusion: 341,
+    DeviceDiscoverySettingsAuthenticatedScans: 342,
+    CriticalAssetManagementClassification: 343,
+    DeviceDiscoverySettings: 344,
+    USXWorkspaceOnboarding: 345,
+    VivaGlintAdvancedConfiguration: 346,
+    VivaGlintPulseProgram: 347,
+    VivaGlintPulseProgramRespondentRate: 348,
+    VivaGlintQuestion: 349,
+    VivaGlintRole: 350,
+    VivaGlintRubicon: 351,
+    VivaGlintSupportAccess: 352,
+    VivaGlintSystem: 353,
+    VivaGlintUser: 354,
+    VivaGlintUserGroup: 355,
+    VivaGlintFeedbackProgram: 356,
+    FabricAudit: 357,
+    TrainableClassifier: 358,
+    WebContentFiltering: 359,
+    NoisyAlertPolicy: 360,
+    OnDemandSharePointClassification: 361,
+    AIInteractionsExport: 362,
+    Microsoft365CopilotScheduledPrompt: 363,
+    PlacesDirectory: 364,
+    MDAAudit: 365,
+    OpticalCharacterRecognition: 366,
+    M365SearchSections: 368,
+    OfficeClientRestrictedModeAction: 369,
+    CrossTenantAccessPolicy: 370,
+    OutlookCopilotAutomation: 371,
+    VivaEngageNetworkAssociation: 372,
+    AppAdminActivity: 373,
+    AppSettingsAdminActivity: 374,
+    UniversalPrintPrintJob: 375,
+    SentinelNotebookOnLake: 376,
+    SentinelJob: 377,
+    SentinelGraph: 378,
+    SentinelKQLOnLake: 379,
+    SentinelPackage: 380,
+    VivaAmplifyOutlookSensitivityLabel: 381,
+    CopilotActions: 382,
+    AIInteractionsSubscription: 383,
+    AIInteractionsChangeNotification: 384,
+    FilteringMailMetadataExtended: 385,
+    SentinelLakeOnboarding: 386,
+    SentinelLakeDataOnboarding: 387,
+    OfficeRestrictedModeAction: 388,
+    CopilotForSecurityTrigger: 389,
+    CopilotAgentManagement: 390,
+    P4AIAssessmentFabricScannerRecord: 391,
+    PlannerGoal: 392,
+    PlannerGoalList: 393,
+    ThreatIntelligenceObject: 394,
+    ThreatIntelligenceExport: 395,
+    SubmissionAgenticGradingResult: 396,
+    AgentAdminActivity: 397,
+    DeployFeatureActivity: 398,
+    AgentSettingsAdminActivity: 399,
+    OrganizationalDataInM365: 400,
+    PlannerChatMessage: 401,
+    PlannerChatMessageList: 402,
+    SentinelAITool: 403,
+    M365ODSPAssetMetadata: 404,
+    AIExecuteTool: 405,
+    AIInvokeAgent: 406,
+    AIInferenceCall: 407,
+    CdpClassifierHealthRecord: 408,
+    SensitiveInfoRemediationAgentData: 409,
+    ComplianceDLPEnforcement: 410,
+    A365AIExecuteTool: 411,
+    A365AIInvokeAgent: 412,
+    A365AIInferenceCall: 413,
+    VivaEngageSegment: 414,
+    RTIOperationsAgent: 415,
+    ContentStoreMetadata: 416,
+    CCRAIPolicyViolation: 417,
+    PlannerPlanSensitivityLabel: 418,
+    MosAgentInfoRecord: 419,
+    A365AIRunSummary: 420,
+    UnifiedCatalogConceptAction: 421,
+    DefenderCaseManagement: 422,
+    CopilotForSecurityLogging: 423,
+    VivaEngageEvents: 424,
+    CallActivityEvent: 425,
+    SonarDetonationContentMetadata: 426,
+    UniversalPrintManagement: 427,
+    YammerUserHiding: 428,
+    Microsoft365BackupGranularBrowseTask: 429,
+    PurviewPostureAgent: 430,
+    MSDECustomCollection: 431,
+    SCPUsageEvent: 432,
+    SCPConfigurationEvent: 433,
+    MDCConfigurationEvent: 434,
+    MDCUsageEvent: 435,
+    A365SpanOutputs: 436,
+    PowerPlatformTenantIsolation: 437,
+    CDPDLMAIInteractionInsights: 438,
+    P4AIAssessmentCategoryRecord: 439,
+    SentinelLakeEncryption: 440,
+    AZFWNetworkRule: 441,
+    AZFWDnsQuery: 442,
+    AZFWApplicationRuleAggregation: 443,
+    TeamsEvalDataHubDataAccess: 444,
+    TeamsEvalDataHubPermissionChange: 445,
+    TeamsEvalDataHubAdminOperation: 446,
+    VivaGlintOrganizationalData: 447,
+    AlertSubmission: 448,
+    AlertSubmissionResultDetail: 449,
+    ComplianceSitGradingSharePoint: 450,
+    CompliancePolicyGradingSharePoint: 451,
+    AzureAISearchAudit: 452,
+    P4AIRiskScoreRecord: 453,
+    DragonCopilotAdmin: 454,
+    AISpanOutputs: 455,
+    EopSubmissionFeedEntity: 456,
+    SonarFileDetonationEntity: 457,
+    SonarSubmissionEntity: 458,
+    SonarUrlDetonationEntity: 459,
+    SubmissionEntity: 460,
+    SonarDetonationEntity: 461,
+    MicrosoftTeamsUserConcern: 462,
+    VivaGlintAgenticCampaign: 463,
+    MSPVectorSearchContentMetadata: 464,
+    FabricPolicy: 465,
+    SecurityCopilotAgentIdentityManagement: 466,
+    CopilotSessionSharing: 467,
+    DragonCopilotAccess: 468,
+    DragonCopilotClinicalData: 469,
+    DragonCopilotSession: 470,
+    MosAgentInfoRecordV2: 471,
+    SecurityDevelopmentLifecycleAILog: 472,
+    MDASH: 473,
+    DefenderSecurityForAIConfiguration: 474,
+    SparkCoreCustomLivePool: 475,
+    unknownFutureValue: 476,
+  }
+
+  /**
+   * Type of user associated with an audit log record.
+   */
+  enum auditLogUserType {
+    Regular: 0,
+    Reserved: 1,
+    Admin: 2,
+    DcAdmin: 3,
+    System: 4,
+    Application: 5,
+    ServicePrincipal: 6,
+    CustomPolicy: 7,
+    SystemPolicy: 8,
+    PartnerTechnician: 9,
+    Guest: 10,
+    unknownFutureValue: 11,
+  }
+
   enum behaviorDuringRetentionPeriod {
     doNotRetain: 0,
     retain: 1,