@@ -36,7 +36,7 @@ public class Alert extends Entity implements IJsonBackedObject {
3636
3737 /**
3838 * The Actor Display Name.
39- *
39+ * The adversary or activity group that is associated with this alert.
4040 */
4141 @ SerializedName (value = "actorDisplayName" , alternate = {"ActorDisplayName" })
4242 @ Expose
@@ -45,7 +45,7 @@ public class Alert extends Entity implements IJsonBackedObject {
4545
4646 /**
4747 * The Alert Web Url.
48- *
48+ * URL for the alert page in the Microsoft 365 Defender portal.
4949 */
5050 @ SerializedName (value = "alertWebUrl" , alternate = {"AlertWebUrl" })
5151 @ Expose
@@ -54,7 +54,7 @@ public class Alert extends Entity implements IJsonBackedObject {
5454
5555 /**
5656 * The Assigned To.
57- *
57+ * Owner of the alert, or null if no owner is assigned.
5858 */
5959 @ SerializedName (value = "assignedTo" , alternate = {"AssignedTo" })
6060 @ Expose
@@ -63,7 +63,7 @@ public class Alert extends Entity implements IJsonBackedObject {
6363
6464 /**
6565 * The Category.
66- *
66+ * The attack kill-chain category that the alert belongs to. Aligned with the MITRE ATT&CK framework.
6767 */
6868 @ SerializedName (value = "category" , alternate = {"Category" })
6969 @ Expose
@@ -72,7 +72,7 @@ public class Alert extends Entity implements IJsonBackedObject {
7272
7373 /**
7474 * The Classification.
75- *
75+ * Specifies whether the alert represents a true threat. Possible values are: unknown, falsePositive, truePositive, benignPositive, unknownFutureValue.
7676 */
7777 @ SerializedName (value = "classification" , alternate = {"Classification" })
7878 @ Expose
@@ -81,7 +81,7 @@ public class Alert extends Entity implements IJsonBackedObject {
8181
8282 /**
8383 * The Comments.
84- *
84+ * Array of comments created by the Security Operations (SecOps) team during the alert management process.
8585 */
8686 @ SerializedName (value = "comments" , alternate = {"Comments" })
8787 @ Expose
@@ -90,7 +90,7 @@ public class Alert extends Entity implements IJsonBackedObject {
9090
9191 /**
9292 * The Created Date Time.
93- *
93+ * Time when Microsoft 365 Defender created the alert.
9494 */
9595 @ SerializedName (value = "createdDateTime" , alternate = {"CreatedDateTime" })
9696 @ Expose
@@ -99,7 +99,7 @@ public class Alert extends Entity implements IJsonBackedObject {
9999
100100 /**
101101 * The Description.
102- *
102+ * String value describing each alert.
103103 */
104104 @ SerializedName (value = "description" , alternate = {"Description" })
105105 @ Expose
@@ -108,7 +108,7 @@ public class Alert extends Entity implements IJsonBackedObject {
108108
109109 /**
110110 * The Detection Source.
111- *
111+ * Detection technology or sensor that identified the notable component or activity.
112112 */
113113 @ SerializedName (value = "detectionSource" , alternate = {"DetectionSource" })
114114 @ Expose
@@ -117,7 +117,7 @@ public class Alert extends Entity implements IJsonBackedObject {
117117
118118 /**
119119 * The Detector Id.
120- *
120+ * The ID of the detector that triggered the alert.
121121 */
122122 @ SerializedName (value = "detectorId" , alternate = {"DetectorId" })
123123 @ Expose
@@ -126,7 +126,7 @@ public class Alert extends Entity implements IJsonBackedObject {
126126
127127 /**
128128 * The Determination.
129- *
129+ * Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. Possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
130130 */
131131 @ SerializedName (value = "determination" , alternate = {"Determination" })
132132 @ Expose
@@ -135,7 +135,7 @@ public class Alert extends Entity implements IJsonBackedObject {
135135
136136 /**
137137 * The Evidence.
138- *
138+ * Collection of evidence related to the alert.
139139 */
140140 @ SerializedName (value = "evidence" , alternate = {"Evidence" })
141141 @ Expose
@@ -144,7 +144,7 @@ public class Alert extends Entity implements IJsonBackedObject {
144144
145145 /**
146146 * The First Activity Date Time.
147- *
147+ * The earliest activity associated with the alert.
148148 */
149149 @ SerializedName (value = "firstActivityDateTime" , alternate = {"FirstActivityDateTime" })
150150 @ Expose
@@ -153,7 +153,7 @@ public class Alert extends Entity implements IJsonBackedObject {
153153
154154 /**
155155 * The Incident Id.
156- *
156+ * Unique identifier to represent the incident this alert resource is associated with.
157157 */
158158 @ SerializedName (value = "incidentId" , alternate = {"IncidentId" })
159159 @ Expose
@@ -162,7 +162,7 @@ public class Alert extends Entity implements IJsonBackedObject {
162162
163163 /**
164164 * The Incident Web Url.
165- *
165+ * URL for the incident page in the Microsoft 365 Defender portal.
166166 */
167167 @ SerializedName (value = "incidentWebUrl" , alternate = {"IncidentWebUrl" })
168168 @ Expose
@@ -171,7 +171,7 @@ public class Alert extends Entity implements IJsonBackedObject {
171171
172172 /**
173173 * The Last Activity Date Time.
174- *
174+ * The oldest activity associated with the alert.
175175 */
176176 @ SerializedName (value = "lastActivityDateTime" , alternate = {"LastActivityDateTime" })
177177 @ Expose
@@ -180,7 +180,7 @@ public class Alert extends Entity implements IJsonBackedObject {
180180
181181 /**
182182 * The Last Update Date Time.
183- *
183+ * Time when the alert was last updated at Microsoft 365 Defender.
184184 */
185185 @ SerializedName (value = "lastUpdateDateTime" , alternate = {"LastUpdateDateTime" })
186186 @ Expose
@@ -189,7 +189,7 @@ public class Alert extends Entity implements IJsonBackedObject {
189189
190190 /**
191191 * The Mitre Techniques.
192- *
192+ * The attack techniques, as aligned with the MITRE ATT&CK framework.
193193 */
194194 @ SerializedName (value = "mitreTechniques" , alternate = {"MitreTechniques" })
195195 @ Expose
@@ -198,7 +198,7 @@ public class Alert extends Entity implements IJsonBackedObject {
198198
199199 /**
200200 * The Provider Alert Id.
201- *
201+ * The ID of the alert as it appears in the security provider product that generated the alert.
202202 */
203203 @ SerializedName (value = "providerAlertId" , alternate = {"ProviderAlertId" })
204204 @ Expose
@@ -207,7 +207,7 @@ public class Alert extends Entity implements IJsonBackedObject {
207207
208208 /**
209209 * The Recommended Actions.
210- *
210+ * Recommended response and remediation actions to take in the event this alert was generated.
211211 */
212212 @ SerializedName (value = "recommendedActions" , alternate = {"RecommendedActions" })
213213 @ Expose
@@ -216,7 +216,7 @@ public class Alert extends Entity implements IJsonBackedObject {
216216
217217 /**
218218 * The Resolved Date Time.
219- *
219+ * Time when the alert was resolved.
220220 */
221221 @ SerializedName (value = "resolvedDateTime" , alternate = {"ResolvedDateTime" })
222222 @ Expose
@@ -225,7 +225,7 @@ public class Alert extends Entity implements IJsonBackedObject {
225225
226226 /**
227227 * The Service Source.
228- *
228+ * The service or product that created this alert. Possible values are: microsoftDefenderForEndpoint, microsoftDefenderForIdentity, microsoftCloudAppSecurity, microsoftDefenderForOffice365, microsoft365Defender, aadIdentityProtection, appGovernance, dataLossPrevention.
229229 */
230230 @ SerializedName (value = "serviceSource" , alternate = {"ServiceSource" })
231231 @ Expose
@@ -234,7 +234,7 @@ public class Alert extends Entity implements IJsonBackedObject {
234234
235235 /**
236236 * The Severity.
237- *
237+ * Indicates the possible impact on assets. The higher the severity the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are: unknown, informational, low, medium, high, unknownFutureValue.
238238 */
239239 @ SerializedName (value = "severity" , alternate = {"Severity" })
240240 @ Expose
@@ -243,7 +243,7 @@ public class Alert extends Entity implements IJsonBackedObject {
243243
244244 /**
245245 * The Status.
246- *
246+ * The status of the alert. Possible values are: new, inProgress, resolved, unknownFutureValue.
247247 */
248248 @ SerializedName (value = "status" , alternate = {"Status" })
249249 @ Expose
@@ -252,7 +252,7 @@ public class Alert extends Entity implements IJsonBackedObject {
252252
253253 /**
254254 * The Tenant Id.
255- *
255+ * The Azure Active Directory tenant the alert was created in.
256256 */
257257 @ SerializedName (value = "tenantId" , alternate = {"TenantId" })
258258 @ Expose
@@ -261,7 +261,7 @@ public class Alert extends Entity implements IJsonBackedObject {
261261
262262 /**
263263 * The Threat Display Name.
264- *
264+ * The threat associated with this alert.
265265 */
266266 @ SerializedName (value = "threatDisplayName" , alternate = {"ThreatDisplayName" })
267267 @ Expose
@@ -270,7 +270,7 @@ public class Alert extends Entity implements IJsonBackedObject {
270270
271271 /**
272272 * The Threat Family Name.
273- *
273+ * Threat family associated with this alert.
274274 */
275275 @ SerializedName (value = "threatFamilyName" , alternate = {"ThreatFamilyName" })
276276 @ Expose
@@ -279,7 +279,7 @@ public class Alert extends Entity implements IJsonBackedObject {
279279
280280 /**
281281 * The Title.
282- *
282+ * Brief identifying string value describing the alert.
283283 */
284284 @ SerializedName (value = "title" , alternate = {"Title" })
285285 @ Expose
0 commit comments