Office365-REST-Python-Client 2.4.2__py3-none-any.whl → 2.4.4__py3-none-any.whl

office365/directory/protection/riskyusers/activity.py

@@ -0,0 +1,5 @@
+from office365.runtime.client_value import ClientValue
+
+
+class RiskUserActivity(ClientValue):
+    """Represents the risk activites of an Azure AD user as determined by Azure AD Identity Protection."""

office365/directory/protection/riskyusers/collection.py

@@ -0,0 +1,32 @@
+from office365.directory.protection.riskyusers.risky_user import RiskyUser
+from office365.entity_collection import EntityCollection
+from office365.runtime.queries.service_operation import ServiceOperationQuery
+from office365.runtime.types.collections import StringCollection
+
+
+class RiskyUserCollection(EntityCollection):
+    """RiskyUser's collection"""
+
+    def __init__(self, context, resource_path=None):
+        super(RiskyUserCollection, self).__init__(context, RiskyUser, resource_path)
+
+    def confirm_compromised(self, user_ids=None):
+        """Confirm one or more riskyUser objects as compromised. This action sets the targeted user's risk level
+        to high.
+
+        :param list[str] user_ids: Specify the risky user IDs to dismiss in the request body.
+        """
+        payload = {"userIds": StringCollection(user_ids)}
+        qry = ServiceOperationQuery(self, "confirmCompromised", None, payload)
+        self.context.add_query(qry)
+        return self
+
+    def dismiss(self, user_ids=None):
+        """Dismiss the risk of one or more riskyUser objects. This action sets the targeted user's risk level to none.
+
+        :param list[str] user_ids: Specify the risky user IDs to dismiss in the request body.
+        """
+        payload = {"userIds": StringCollection(user_ids)}
+        qry = ServiceOperationQuery(self, "dismiss", None, payload)
+        self.context.add_query(qry)
+        return self

office365/directory/protection/riskyusers/history_item.py

@@ -0,0 +1,20 @@
+from office365.directory.protection.riskyusers.activity import RiskUserActivity
+from office365.directory.protection.riskyusers.risky_user import RiskyUser
+
+
+class RiskyUserHistoryItem(RiskyUser):
+    """Represents the risk history of an Azure Active Directory (Azure AD) user as determined
+    by Azure AD Identity Protection."""
+
+    @property
+    def activity(self):
+        """The activity related to user risk level change.
+        """
+        return self.properties.get("activity", RiskUserActivity())
+
+    @property
+    def initiated_by(self):
+        """The ID of actor that does the operation.
+        :rtype: str
+        """
+        return self.properties.get("initiatedBy", None)

office365/directory/protection/riskyusers/risky_user.py

@@ -0,0 +1,26 @@
+from office365.entity import Entity
+from office365.entity_collection import EntityCollection
+from office365.runtime.paths.resource_path import ResourcePath
+
+
+class RiskyUser(Entity):
+    """
+    Represents Azure AD users who are at risk. Azure AD continually evaluates user risk based on various
+    signals and machine learning. This API provides programmatic access to all at-risk users in your Azure AD.
+    """
+
+    @property
+    def history(self):
+        """The activity related to user risk level change"""
+        from office365.directory.protection.riskyusers.history_item import RiskyUserHistoryItem
+        return self.properties.get('history',
+                                   EntityCollection(self.context, RiskyUserHistoryItem,
+                                                    ResourcePath("history", self.resource_path)))
+
+    @property
+    def user_principal_name(self):
+        """
+        Risky user principal name.
+        :rtype: str or None
+        """
+        return self.properties.get('userPrincipalName', None)

office365/directory/protection/root.py

@@ -0,0 +1,31 @@
+from office365.directory.protection.risk_detection import RiskDetection
+from office365.directory.protection.riskyusers.collection import RiskyUserCollection
+from office365.entity import Entity
+from office365.entity_collection import EntityCollection
+from office365.runtime.paths.resource_path import ResourcePath
+
+
+class IdentityProtectionRoot(Entity):
+    """Container for the navigation properties for Microsoft Graph identity protection resources."""
+
+    @property
+    def risk_detections(self):
+        """Risk detection in Azure AD Identity Protection and the associated information about the detection."""
+        return self.properties.get('riskDetections',
+                                   EntityCollection(self.context, RiskDetection,
+                                                    ResourcePath("riskDetections", self.resource_path)))
+
+    @property
+    def risky_users(self):
+        """Get the teams in Microsoft Teams that the user is a direct member of."""
+        return self.properties.get('riskyUsers',
+                                   RiskyUserCollection(self.context, ResourcePath("riskyUsers", self.resource_path)))
+
+    def get_property(self, name, default_value=None):
+        if default_value is None:
+            property_mapping = {
+                "riskDetections": self.risk_detections,
+                "riskyUsers": self.risky_users
+            }
+            default_value = property_mapping.get(name, None)
+        return super(IdentityProtectionRoot, self).get_property(name, default_value)

office365/directory/rolemanagement/application.py

@@ -0,0 +1,35 @@
+from office365.directory.rolemanagement.unified_role_assignment import UnifiedRoleAssignment
+from office365.directory.rolemanagement.unified_role_definition import UnifiedRoleDefinition
+from office365.entity import Entity
+from office365.entity_collection import EntityCollection
+from office365.runtime.paths.resource_path import ResourcePath
+
+
+class RbacApplication(Entity):
+    """Role management container for unified role definitions and role assignments for Microsoft 365 role-based
+    access control (RBAC) providers. The role assignments support only a single principal and a single scope.
+    Currently directory and entitlementManagement are the two RBAC providers supported."""
+
+    @property
+    def role_assignments(self):
+        """Resource to grant access to users or groups."""
+        return self.properties.get('roleAssignments',
+                                   EntityCollection(self.context, UnifiedRoleAssignment,
+                                                    ResourcePath("roleAssignments", self.resource_path)))
+
+    def role_definitions(self):
+        """Resource representing the roles allowed by RBAC providers and the permissions assigned to the roles."""
+        return self.properties.get('roleDefinitions',
+                                   EntityCollection(self.context, UnifiedRoleDefinition,
+                                                    ResourcePath("roleDefinitions", self.resource_path)))
+
+    def get_property(self, name, default_value=None):
+        if default_value is None:
+            property_mapping = {
+                "roleAssignments": self.role_assignments,
+                "roleDefinitions": self.role_definitions
+            }
+            default_value = property_mapping.get(name, None)
+        return super(RbacApplication, self).get_property(name, default_value)
+
+

office365/directory/{roles → rolemanagement}/management.py

@@ -1,4 +1,4 @@
-from office365.directory.rbac.application import RbacApplication
+from office365.directory.rolemanagement.application import RbacApplication
 from office365.entity import Entity
 from office365.runtime.paths.resource_path import ResourcePath
 
@@ -15,3 +15,10 @@ class RoleManagement(Entity):
     def directory(self):
         return self.properties.get('directory',
                                    RbacApplication(self.context, ResourcePath("directory", self.resource_path)))
+
+    @property
+    def entitlement_management(self):
+        """Container for roles and assignments for entitlement management resources."""
+        return self.properties.get('entitlementManagement',
+                                   RbacApplication(self.context,
+                                                   ResourcePath("entitlementManagement", self.resource_path)))

office365/directory/{roles → rolemanagement}/role.py

@@ -5,6 +5,20 @@ from office365.runtime.paths.resource_path import ResourcePath
 class DirectoryRole(DirectoryObject):
     """Represents an Azure AD directory role. Azure AD directory roles are also known as administrator roles """
 
+    @property
+    def description(self):
+        """The description for the directory role.
+        :rtype: str or None
+        """
+        return self.properties.get("Description", None)
+
+    @property
+    def display_name(self):
+        """The display name for the directory role.
+        :rtype: str or None
+        """
+        return self.properties.get("displayName", None)
+
     @property
     def members(self):
         """

office365/directory/{roles → rolemanagement}/template.py

@@ -4,3 +4,11 @@ from office365.directory.object import DirectoryObject
 class DirectoryRoleTemplate(DirectoryObject):
     """Represents a directory role template. A directory role template specifies the property values of a directory
     role (directoryRole). """
+
+    @property
+    def display_name(self):
+        """
+        The display name to set for the directory role
+        :rtype: str
+        """
+        return self.properties.get("displayName", None)

office365/directory/rolemanagement/unified_role_assignment.py

@@ -0,0 +1,45 @@
+from office365.directory.rolemanagement.unified_role_definition import UnifiedRoleDefinition
+from office365.entity import Entity
+from office365.runtime.paths.resource_path import ResourcePath
+
+
+class UnifiedRoleAssignment(Entity):
+    """
+    A role assignment is used to grant access to resources. It represents a role definition assigned to a principal
+    (for example, a user or a role-assignable group) at a particular scope.
+    """
+
+    @property
+    def app_scope_id(self):
+        """
+        Identifier of the app-specific scope when the assignment scope is app-specific. Either this property or
+        directoryScopeId is required. App scopes are scopes that are defined and understood by this application only.
+        Use / for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects,
+        for example, administrative units. Supports $filter (eq, in).
+        :rtype: str
+        """
+        return self.properties.get("appScopeId", None)
+
+    @property
+    def condition(self):
+        """
+        :rtype: str
+        """
+        return self.properties.get("condition", None)
+
+    @property
+    def role_definition(self):
+        """
+        The roleDefinition the assignment is for. Supports $expand. roleDefinition.Id will be auto expanded.
+        """
+        return self.properties.get('roleDefinition',
+                                   UnifiedRoleDefinition(self.context,
+                                                         ResourcePath("roleDefinition", self.resource_path)))
+
+    def get_property(self, name, default_value=None):
+        if default_value is None:
+            property_mapping = {
+                "roleDefinition": self.role_definition,
+            }
+            default_value = property_mapping.get(name, None)
+        return super(UnifiedRoleAssignment, self).get_property(name, default_value)

office365/directory/rolemanagement/unified_role_definition.py

@@ -0,0 +1,6 @@
+from office365.entity import Entity
+
+
+class UnifiedRoleDefinition(Entity):
+    """A role definition is a collection of permissions in Azure Active Directory (Azure AD) listing the operations
+    that can be performed and the resources against which they can performed."""

office365/directory/security/alerts/alert.py

@@ -1,4 +1,5 @@
 from office365.directory.security.alerts.evidence import AlertEvidence
+from office365.directory.security.alerts.history_state import AlertHistoryState
 from office365.entity import Entity
 from office365.runtime.client_value_collection import ClientValueCollection
 
@@ -8,7 +9,27 @@ class Alert(Entity):
     representing potential security issues within a customer's tenant that Microsoft 365 Defender,
     or a security provider integrated with Microsoft 365 Defender, has identified."""
 
+    @property
+    def actor_display_name(self):
+        """
+        The adversary or activity group that is associated with this alert.
+        :rtype: str
+        """
+        return self.properties.get("actorDisplayName", None)
+
+    @property
+    def alert_policy_id(self):
+        """
+        :rtype: str
+        """
+        return self.properties.get("alertPolicyId", None)
+
     @property
     def evidence(self):
         """Collection of evidence related to the alert."""
         return self.properties.get("evidence", ClientValueCollection(AlertEvidence))
+
+    @property
+    def history_states(self):
+        """Collection of changes for the alert."""
+        return self.properties.get("historyStates", ClientValueCollection(AlertHistoryState))

office365/directory/security/alerts/history_state.py

@@ -0,0 +1,5 @@
+from office365.runtime.client_value import ClientValue
+
+
+class AlertHistoryState(ClientValue):
+    """Stores changes made to alerts."""

office365/directory/security/attacksimulations/automation.py

@@ -0,0 +1,21 @@
+from office365.directory.permissions.email_identity import EmailIdentity
+from office365.directory.security.attacksimulations.automation_run import SimulationAutomationRun
+from office365.entity import Entity
+from office365.entity_collection import EntityCollection
+from office365.runtime.paths.resource_path import ResourcePath
+
+
+class SimulationAutomation(Entity):
+    """Represents simulation automation created to run on a tenant."""
+
+    @property
+    def created_by(self):
+        """Identity of the user who created the attack simulation automation."""
+        return self.properties.get('createdBy', EmailIdentity())
+
+    @property
+    def runs(self):
+        """A collection of simulation automation runs."""
+        return self.properties.get('runs',
+                                   EntityCollection(self.context, SimulationAutomationRun,
+                                                    ResourcePath("runs", self.resource_path)))

office365/directory/security/attacksimulations/automation_run.py

@@ -0,0 +1,5 @@
+from office365.entity import Entity
+
+
+class SimulationAutomationRun(Entity):
+    """Represents a run of an attack simulation automation on a tenant."""

office365/directory/security/attacksimulations/repeat_offender.py

@@ -0,0 +1,6 @@
+from office365.runtime.client_value import ClientValue
+
+
+class AttackSimulationRepeatOffender(ClientValue):
+    """Represents a user in a tenant who has given way to attacks more than once across various attack simulation
+    and training campaigns."""

office365/directory/security/attacksimulations/root.py

@@ -1,6 +1,32 @@
+from office365.directory.security.attacksimulations.automation import SimulationAutomation
+from office365.directory.security.attacksimulations.simulation import Simulation
 from office365.entity import Entity
+from office365.entity_collection import EntityCollection
+from office365.runtime.paths.resource_path import ResourcePath
 
 
 class AttackSimulationRoot(Entity):
     """Represents an abstract type that provides the ability to launch a realistic phishing attack that organizations
     can learn from."""
+
+    @property
+    def simulations(self):
+        """Represents an attack simulation training campaign in a tenant."""
+        return self.properties.get('simulations',
+                                   EntityCollection(self.context, Simulation,
+                                                    ResourcePath("simulations", self.resource_path)))
+
+    @property
+    def simulation_automations(self):
+        """Represents simulation automation created to run on a tenant."""
+        return self.properties.get('simulationAutomations',
+                                   EntityCollection(self.context, SimulationAutomation,
+                                                    ResourcePath("simulationAutomations", self.resource_path)))
+
+    def get_property(self, name, default_value=None):
+        if default_value is None:
+            property_mapping = {
+                "simulationAutomations": self.simulation_automations,
+            }
+            default_value = property_mapping.get(name, None)
+        return super(AttackSimulationRoot, self).get_property(name, default_value)

office365/directory/security/attacksimulations/simulation.py

@@ -0,0 +1,17 @@
+from office365.entity import Entity
+
+
+class Simulation(Entity):
+    """
+    Represents an attack simulation training campaign in a tenant.
+
+    Attack simulation and training is a service available as part of Microsoft Defender for Office 365.
+    This service lets tenant users experience a realistic benign phishing attack and learn from it.
+    The service enables tenant administrators to simulate, assign trainings, and read derived insights into online
+    behaviors of users in the phishing simulations. The service provides attack simulation reports that help tenants
+    identify security knowledge gaps, so that they can further train their users to decrease their susceptibility
+    to attacks.
+
+    The attack simulation and training API enables tenant administrators to list launched simulation exercises
+    and trainings, and get reports on derived insights into online behaviors of users in the phishing simulations.
+    """

office365/directory/security/cases/ediscovery.py

@@ -0,0 +1,6 @@
+from office365.entity import Entity
+
+
+class EdiscoveryCase(Entity):
+    """In the context of eDiscovery, contains custodians, searches, review sets. For details, see Overview of
+    Microsoft Purview eDiscovery (Premium)."""

office365/directory/security/cases/root.py

@@ -0,0 +1,22 @@
+from office365.directory.security.cases.ediscovery import EdiscoveryCase
+from office365.entity import Entity
+from office365.entity_collection import EntityCollection
+from office365.runtime.paths.resource_path import ResourcePath
+
+
+class CasesRoot(Entity):
+    """"""
+
+    @property
+    def ediscovery_cases(self):
+        return self.properties.get('ediscoveryCases',
+                                   EntityCollection(self.context, EdiscoveryCase,
+                                                    ResourcePath("ediscoveryCases", self.resource_path)))
+
+    def get_property(self, name, default_value=None):
+        if default_value is None:
+            property_mapping = {
+                "ediscoveryCases": self.ediscovery_cases
+            }
+            default_value = property_mapping.get(name, None)
+        return super(CasesRoot, self).get_property(name, default_value)

office365/directory/security/incidents/incident.py

@@ -0,0 +1,67 @@
+from datetime import datetime
+
+from office365.directory.security.alerts.alert import Alert
+from office365.directory.security.alerts.comment import AlertComment
+from office365.entity import Entity
+from office365.entity_collection import EntityCollection
+from office365.runtime.client_value_collection import ClientValueCollection
+from office365.runtime.paths.resource_path import ResourcePath
+
+
+class Incident(Entity):
+    """
+    An incident in Microsoft 365 Defender is a collection of correlated alert instances and associated metadata
+    that reflects the story of an attack in a tenant.
+
+    Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity.
+    Individual alerts provide valuable clues about a completed or ongoing attack. However, attacks typically employ
+    various techniques against different types of entities, such as devices, users, and mailboxes. The result is
+    multiple alerts for multiple entities in your tenant. Because piecing the individual alerts together to gain
+    insight into an attack can be challenging and time-consuming, Microsoft 365 Defender automatically aggregates the
+    alerts and their associated information into an incident.
+    """
+
+    @property
+    def assigned_to(self):
+        """
+        Owner of the incident, or null if no owner is assigned. Free editable text.
+        :rtype: str or None
+        """
+        return self.properties.get("assignedTo", None)
+
+    @property
+    def classification(self):
+        """
+        The specification for the incident.
+        Possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
+        :rtype: str or None
+        """
+        return self.properties.get("classification", None)
+
+    @property
+    def comments(self):
+        """
+        Array of comments created by the Security Operations (SecOps) team when the incident is managed.
+        """
+        return self.properties.get("comments", ClientValueCollection(AlertComment))
+
+    @property
+    def created_datetime(self):
+        """
+        Time when the incident was first created.
+        """
+        return self.properties("createdDateTime", datetime.min)
+
+    @property
+    def alerts(self):
+        """The list of related alerts. Supports $expand."""
+        return self.properties.get('alerts',
+                                   EntityCollection(self.context, Alert, ResourcePath("alerts", self.resource_path)))
+
+    def get_property(self, name, default_value=None):
+        if default_value is None:
+            property_mapping = {
+                "createdDateTime": self.created_datetime
+            }
+            default_value = property_mapping.get(name, None)
+        return super(Incident, self).get_property(name, default_value)

office365/directory/security/security.py

@@ -1,6 +1,7 @@
 from office365.directory.security.alerts.alert import Alert
 from office365.directory.security.attacksimulations.root import AttackSimulationRoot
-from office365.directory.security.cases_root import CasesRoot
+from office365.directory.security.cases.root import CasesRoot
+from office365.directory.security.incidents.incident import Incident
 from office365.directory.security.triggers.root import TriggersRoot
 from office365.entity import Entity
 from office365.entity_collection import EntityCollection
@@ -37,6 +38,14 @@ class Security(Entity):
                                    AttackSimulationRoot(self.context,
                                                         ResourcePath("attackSimulation", self.resource_path)))
 
+    @property
+    def incidents(self):
+        """A collection of correlated alert instances and associated metadata that reflects the story of
+        an attack in a tenant"""
+        return self.properties.get('incidents',
+                                   EntityCollection(self.context, Incident,
+                                                    ResourcePath("incidents", self.resource_path)))
+
     @property
     def triggers(self):
         return self.properties.get('triggers',