# coding=utf-8
# --------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for license information.
# Code generated by Microsoft (R) AutoRest Code Generator.
# Changes may cause incorrect behavior and will be lost if the code is regenerated.
# --------------------------------------------------------------------------

from azure.core.exceptions import HttpResponseError
import msrest.serialization


class CollectionOfAlert(msrest.serialization.Model):
    """Collection of alert.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param value:
    :type value: list[~security.models.MicrosoftGraphAlert]
    :param odata_next_link:
    :type odata_next_link: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'value': {'key': 'value', 'type': '[MicrosoftGraphAlert]'},
        'odata_next_link': {'key': '@odata\\.nextLink', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(CollectionOfAlert, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.value = kwargs.get('value', None)
        self.odata_next_link = kwargs.get('odata_next_link', None)


class CollectionOfSecureScore(msrest.serialization.Model):
    """Collection of secureScore.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param value:
    :type value: list[~security.models.MicrosoftGraphSecureScore]
    :param odata_next_link:
    :type odata_next_link: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'value': {'key': 'value', 'type': '[MicrosoftGraphSecureScore]'},
        'odata_next_link': {'key': '@odata\\.nextLink', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(CollectionOfSecureScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.value = kwargs.get('value', None)
        self.odata_next_link = kwargs.get('odata_next_link', None)


class CollectionOfSecureScoreControlProfile(msrest.serialization.Model):
    """Collection of secureScoreControlProfile.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param value:
    :type value: list[~security.models.MicrosoftGraphSecureScoreControlProfile]
    :param odata_next_link:
    :type odata_next_link: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'value': {'key': 'value', 'type': '[MicrosoftGraphSecureScoreControlProfile]'},
        'odata_next_link': {'key': '@odata\\.nextLink', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(CollectionOfSecureScoreControlProfile, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.value = kwargs.get('value', None)
        self.odata_next_link = kwargs.get('odata_next_link', None)


class MicrosoftGraphEntity(msrest.serialization.Model):
    """entity.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param id: Read-only.
    :type id: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'id': {'key': 'id', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphEntity, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.id = kwargs.get('id', None)


class MicrosoftGraphAlert(MicrosoftGraphEntity):
    """alert.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param activity_group_name: Name or alias of the activity group (attacker) this alert is
     attributed to.
    :type activity_group_name: str
    :param assigned_to: Name of the analyst the alert is assigned to for triage, investigation, or
     remediation (supports update).
    :type assigned_to: str
    :param azure_subscription_id: Azure subscription ID, present if this alert is related to an
     Azure resource.
    :type azure_subscription_id: str
    :param azure_tenant_id: Azure Active Directory tenant ID. Required.
    :type azure_tenant_id: str
    :param category: Category of the alert (for example, credentialTheft, ransomware, etc.).
    :type category: str
    :param closed_date_time: Time at which the alert was closed. The Timestamp type represents date
     and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC
     on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z' (supports update).
    :type closed_date_time: ~datetime.datetime
    :param cloud_app_states: Security-related stateful information generated by the provider about
     the cloud application/s related to this alert.
    :type cloud_app_states: list[~security.models.MicrosoftGraphCloudAppSecurityState]
    :param comments: Customer-provided comments on alert (for customer alert management) (supports
     update).
    :type comments: list[str]
    :param confidence: Confidence of the detection logic (percentage between 1-100).
    :type confidence: int
    :param created_date_time: Time at which the alert was created by the alert provider. The
     Timestamp type represents date and time information using ISO 8601 format and is always in UTC
     time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
     Required.
    :type created_date_time: ~datetime.datetime
    :param description: Alert description.
    :type description: str
    :param detection_ids: Set of alerts related to this alert entity (each alert is pushed to the
     SIEM as a separate record).
    :type detection_ids: list[str]
    :param event_date_time: Time at which the event(s) that served as the trigger(s) to generate
     the alert occurred. The Timestamp type represents date and time information using ISO 8601
     format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like
     this: '2014-01-01T00:00:00Z'. Required.
    :type event_date_time: ~datetime.datetime
    :param feedback:  Possible values include: "unknown", "truePositive", "falsePositive",
     "benignPositive", "unknownFutureValue".
    :type feedback: str or ~security.models.MicrosoftGraphAlertFeedback
    :param file_states: Security-related stateful information generated by the provider about the
     file(s) related to this alert.
    :type file_states: list[~security.models.MicrosoftGraphFileSecurityState]
    :param history_states:
    :type history_states: list[~security.models.MicrosoftGraphAlertHistoryState]
    :param host_states: Security-related stateful information generated by the provider about the
     host(s) related to this alert.
    :type host_states: list[~security.models.MicrosoftGraphHostSecurityState]
    :param incident_ids: IDs of incidents related to current alert.
    :type incident_ids: list[str]
    :param last_modified_date_time: Time at which the alert entity was last modified. The Timestamp
     type represents date and time information using ISO 8601 format and is always in UTC time. For
     example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type last_modified_date_time: ~datetime.datetime
    :param malware_states: Threat Intelligence pertaining to malware related to this alert.
    :type malware_states: list[~security.models.MicrosoftGraphMalwareState]
    :param network_connections: Security-related stateful information generated by the provider
     about the network connection(s) related to this alert.
    :type network_connections: list[~security.models.MicrosoftGraphNetworkConnection]
    :param processes: Security-related stateful information generated by the provider about the
     process or processes related to this alert.
    :type processes: list[~security.models.MicrosoftGraphProcess]
    :param recommended_actions: Vendor/provider recommended action(s) to take as a result of the
     alert (for example, isolate machine, enforce2FA, reimage host).
    :type recommended_actions: list[str]
    :param registry_key_states: Security-related stateful information generated by the provider
     about the registry keys related to this alert.
    :type registry_key_states: list[~security.models.MicrosoftGraphRegistryKeyState]
    :param security_resources: Resources related to current alert. For example, for some alerts
     this can have the Azure Resource value.
    :type security_resources: list[~security.models.MicrosoftGraphSecurityResource]
    :param severity:  Possible values include: "unknown", "informational", "low", "medium", "high",
     "unknownFutureValue".
    :type severity: str or ~security.models.MicrosoftGraphAlertSeverity
    :param source_materials: Hyperlinks (URIs) to the source material related to the alert, for
     example, provider's user interface for alerts or log search, etc.
    :type source_materials: list[str]
    :param status:  Possible values include: "unknown", "newAlert", "inProgress", "resolved",
     "dismissed", "unknownFutureValue".
    :type status: str or ~security.models.MicrosoftGraphAlertStatus
    :param tags: A set of tags. User-definable labels that can be applied to an alert and can serve
     as filter conditions (for example 'HVA', 'SAW', etc.) (supports update).
    :type tags: list[str]
    :param title: Alert title. Required.
    :type title: str
    :param triggers: Security-related information about the specific properties that triggered the
     alert (properties appearing in the alert). Alerts might contain information about multiple
     users, hosts, files, ip addresses. This field indicates which properties triggered the alert
     generation.
    :type triggers: list[~security.models.MicrosoftGraphAlertTrigger]
    :param user_states: Security-related stateful information generated by the provider about the
     user accounts related to this alert.
    :type user_states: list[~security.models.MicrosoftGraphUserSecurityState]
    :param vendor_information: securityVendorInformation.
    :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation
    :param vulnerability_states: Threat intelligence pertaining to one or more vulnerabilities
     related to this alert.
    :type vulnerability_states: list[~security.models.MicrosoftGraphVulnerabilityState]
    """

    _validation = {
        'confidence': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'activity_group_name': {'key': 'activityGroupName', 'type': 'str'},
        'assigned_to': {'key': 'assignedTo', 'type': 'str'},
        'azure_subscription_id': {'key': 'azureSubscriptionId', 'type': 'str'},
        'azure_tenant_id': {'key': 'azureTenantId', 'type': 'str'},
        'category': {'key': 'category', 'type': 'str'},
        'closed_date_time': {'key': 'closedDateTime', 'type': 'iso-8601'},
        'cloud_app_states': {'key': 'cloudAppStates', 'type': '[MicrosoftGraphCloudAppSecurityState]'},
        'comments': {'key': 'comments', 'type': '[str]'},
        'confidence': {'key': 'confidence', 'type': 'int'},
        'created_date_time': {'key': 'createdDateTime', 'type': 'iso-8601'},
        'description': {'key': 'description', 'type': 'str'},
        'detection_ids': {'key': 'detectionIds', 'type': '[str]'},
        'event_date_time': {'key': 'eventDateTime', 'type': 'iso-8601'},
        'feedback': {'key': 'feedback', 'type': 'str'},
        'file_states': {'key': 'fileStates', 'type': '[MicrosoftGraphFileSecurityState]'},
        'history_states': {'key': 'historyStates', 'type': '[MicrosoftGraphAlertHistoryState]'},
        'host_states': {'key': 'hostStates', 'type': '[MicrosoftGraphHostSecurityState]'},
        'incident_ids': {'key': 'incidentIds', 'type': '[str]'},
        'last_modified_date_time': {'key': 'lastModifiedDateTime', 'type': 'iso-8601'},
        'malware_states': {'key': 'malwareStates', 'type': '[MicrosoftGraphMalwareState]'},
        'network_connections': {'key': 'networkConnections', 'type': '[MicrosoftGraphNetworkConnection]'},
        'processes': {'key': 'processes', 'type': '[MicrosoftGraphProcess]'},
        'recommended_actions': {'key': 'recommendedActions', 'type': '[str]'},
        'registry_key_states': {'key': 'registryKeyStates', 'type': '[MicrosoftGraphRegistryKeyState]'},
        'security_resources': {'key': 'securityResources', 'type': '[MicrosoftGraphSecurityResource]'},
        'severity': {'key': 'severity', 'type': 'str'},
        'source_materials': {'key': 'sourceMaterials', 'type': '[str]'},
        'status': {'key': 'status', 'type': 'str'},
        'tags': {'key': 'tags', 'type': '[str]'},
        'title': {'key': 'title', 'type': 'str'},
        'triggers': {'key': 'triggers', 'type': '[MicrosoftGraphAlertTrigger]'},
        'user_states': {'key': 'userStates', 'type': '[MicrosoftGraphUserSecurityState]'},
        'vendor_information': {'key': 'vendorInformation', 'type': 'MicrosoftGraphSecurityVendorInformation'},
        'vulnerability_states': {'key': 'vulnerabilityStates', 'type': '[MicrosoftGraphVulnerabilityState]'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAlert, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.activity_group_name = kwargs.get('activity_group_name', None)
        self.assigned_to = kwargs.get('assigned_to', None)
        self.azure_subscription_id = kwargs.get('azure_subscription_id', None)
        self.azure_tenant_id = kwargs.get('azure_tenant_id', None)
        self.category = kwargs.get('category', None)
        self.closed_date_time = kwargs.get('closed_date_time', None)
        self.cloud_app_states = kwargs.get('cloud_app_states', None)
        self.comments = kwargs.get('comments', None)
        self.confidence = kwargs.get('confidence', None)
        self.created_date_time = kwargs.get('created_date_time', None)
        self.description = kwargs.get('description', None)
        self.detection_ids = kwargs.get('detection_ids', None)
        self.event_date_time = kwargs.get('event_date_time', None)
        self.feedback = kwargs.get('feedback', None)
        self.file_states = kwargs.get('file_states', None)
        self.history_states = kwargs.get('history_states', None)
        self.host_states = kwargs.get('host_states', None)
        self.incident_ids = kwargs.get('incident_ids', None)
        self.last_modified_date_time = kwargs.get('last_modified_date_time', None)
        self.malware_states = kwargs.get('malware_states', None)
        self.network_connections = kwargs.get('network_connections', None)
        self.processes = kwargs.get('processes', None)
        self.recommended_actions = kwargs.get('recommended_actions', None)
        self.registry_key_states = kwargs.get('registry_key_states', None)
        self.security_resources = kwargs.get('security_resources', None)
        self.severity = kwargs.get('severity', None)
        self.source_materials = kwargs.get('source_materials', None)
        self.status = kwargs.get('status', None)
        self.tags = kwargs.get('tags', None)
        self.title = kwargs.get('title', None)
        self.triggers = kwargs.get('triggers', None)
        self.user_states = kwargs.get('user_states', None)
        self.vendor_information = kwargs.get('vendor_information', None)
        self.vulnerability_states = kwargs.get('vulnerability_states', None)


class MicrosoftGraphAlertHistoryState(msrest.serialization.Model):
    """alertHistoryState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param app_id:
    :type app_id: str
    :param assigned_to:
    :type assigned_to: str
    :param comments:
    :type comments: list[str]
    :param feedback:  Possible values include: "unknown", "truePositive", "falsePositive",
     "benignPositive", "unknownFutureValue".
    :type feedback: str or ~security.models.MicrosoftGraphAlertFeedback
    :param status:  Possible values include: "unknown", "newAlert", "inProgress", "resolved",
     "dismissed", "unknownFutureValue".
    :type status: str or ~security.models.MicrosoftGraphAlertStatus
    :param updated_date_time:
    :type updated_date_time: ~datetime.datetime
    :param user:
    :type user: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'app_id': {'key': 'appId', 'type': 'str'},
        'assigned_to': {'key': 'assignedTo', 'type': 'str'},
        'comments': {'key': 'comments', 'type': '[str]'},
        'feedback': {'key': 'feedback', 'type': 'str'},
        'status': {'key': 'status', 'type': 'str'},
        'updated_date_time': {'key': 'updatedDateTime', 'type': 'iso-8601'},
        'user': {'key': 'user', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAlertHistoryState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.app_id = kwargs.get('app_id', None)
        self.assigned_to = kwargs.get('assigned_to', None)
        self.comments = kwargs.get('comments', None)
        self.feedback = kwargs.get('feedback', None)
        self.status = kwargs.get('status', None)
        self.updated_date_time = kwargs.get('updated_date_time', None)
        self.user = kwargs.get('user', None)


class MicrosoftGraphAlertTrigger(msrest.serialization.Model):
    """alertTrigger.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param name: Name of the property serving as a detection trigger.
    :type name: str
    :param type: Type of the property in the key:value pair for interpretation. For example,
     String, Boolean, etc.
    :type type: str
    :param value: Value of the property serving as a detection trigger.
    :type value: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'name': {'key': 'name', 'type': 'str'},
        'type': {'key': 'type', 'type': 'str'},
        'value': {'key': 'value', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAlertTrigger, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.name = kwargs.get('name', None)
        self.type = kwargs.get('type', None)
        self.value = kwargs.get('value', None)


class MicrosoftGraphAverageComparativeScore(msrest.serialization.Model):
    """averageComparativeScore.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param average_score: Average score within specified basis.
    :type average_score: float
    :param basis: Scope type. The possible values are: AllTenants, TotalSeats, IndustryTypes.
    :type basis: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'average_score': {'key': 'averageScore', 'type': 'float'},
        'basis': {'key': 'basis', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAverageComparativeScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.average_score = kwargs.get('average_score', None)
        self.basis = kwargs.get('basis', None)


class MicrosoftGraphCertificationControl(msrest.serialization.Model):
    """certificationControl.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param name: Certification control name.
    :type name: str
    :param url: URL for the Microsoft Service Trust Portal.
    :type url: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'name': {'key': 'name', 'type': 'str'},
        'url': {'key': 'url', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphCertificationControl, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.name = kwargs.get('name', None)
        self.url = kwargs.get('url', None)


class MicrosoftGraphCloudAppSecurityState(msrest.serialization.Model):
    """cloudAppSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param destination_service_ip: Destination IP Address of the connection to the cloud
     application/service.
    :type destination_service_ip: str
    :param destination_service_name: Cloud application/service name (for example 'Salesforce',
     'DropBox', etc.).
    :type destination_service_name: str
    :param risk_score: Provider-generated/calculated risk score of the Cloud Application/Service.
     Recommended value range of 0-1, which equates to a percentage.
    :type risk_score: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'destination_service_ip': {'key': 'destinationServiceIp', 'type': 'str'},
        'destination_service_name': {'key': 'destinationServiceName', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphCloudAppSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.destination_service_ip = kwargs.get('destination_service_ip', None)
        self.destination_service_name = kwargs.get('destination_service_name', None)
        self.risk_score = kwargs.get('risk_score', None)


class MicrosoftGraphComplianceInformation(msrest.serialization.Model):
    """complianceInformation.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param certification_controls: Collection of the certification controls associated with
     certification.
    :type certification_controls: list[~security.models.MicrosoftGraphCertificationControl]
    :param certification_name: Compliance certification name (for example, ISO 27018:2014, GDPR,
     FedRAMP, NIST 800-171).
    :type certification_name: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'certification_controls': {'key': 'certificationControls', 'type': '[MicrosoftGraphCertificationControl]'},
        'certification_name': {'key': 'certificationName', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphComplianceInformation, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.certification_controls = kwargs.get('certification_controls', None)
        self.certification_name = kwargs.get('certification_name', None)


class MicrosoftGraphControlScore(msrest.serialization.Model):
    """controlScore.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param control_category: Control action category (Identity, Data, Device, Apps,
     Infrastructure).
    :type control_category: str
    :param control_name: Control unique name.
    :type control_name: str
    :param description: Description of the control.
    :type description: str
    :param score: Tenant achieved score for the control (it varies day by day depending on tenant
     operations on the control).
    :type score: float
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'control_category': {'key': 'controlCategory', 'type': 'str'},
        'control_name': {'key': 'controlName', 'type': 'str'},
        'description': {'key': 'description', 'type': 'str'},
        'score': {'key': 'score', 'type': 'float'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphControlScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.control_category = kwargs.get('control_category', None)
        self.control_name = kwargs.get('control_name', None)
        self.description = kwargs.get('description', None)
        self.score = kwargs.get('score', None)


class MicrosoftGraphFileHash(msrest.serialization.Model):
    """fileHash.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param hash_type:  Possible values include: "unknown", "sha1", "sha256", "md5",
     "authenticodeHash256", "lsHash", "ctph", "unknownFutureValue".
    :type hash_type: str or ~security.models.MicrosoftGraphFileHashType
    :param hash_value: Value of the file hash.
    :type hash_value: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'hash_type': {'key': 'hashType', 'type': 'str'},
        'hash_value': {'key': 'hashValue', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphFileHash, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.hash_type = kwargs.get('hash_type', None)
        self.hash_value = kwargs.get('hash_value', None)


class MicrosoftGraphFileSecurityState(msrest.serialization.Model):
    """fileSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param file_hash: fileHash.
    :type file_hash: ~security.models.MicrosoftGraphFileHash
    :param name: File name (without path).
    :type name: str
    :param path: Full file path of the file/imageFile.
    :type path: str
    :param risk_score: Provider generated/calculated risk score of the alert file. Recommended
     value range of 0-1, which equates to a percentage.
    :type risk_score: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'file_hash': {'key': 'fileHash', 'type': 'MicrosoftGraphFileHash'},
        'name': {'key': 'name', 'type': 'str'},
        'path': {'key': 'path', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphFileSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.file_hash = kwargs.get('file_hash', None)
        self.name = kwargs.get('name', None)
        self.path = kwargs.get('path', None)
        self.risk_score = kwargs.get('risk_score', None)


class MicrosoftGraphHostSecurityState(msrest.serialization.Model):
    """hostSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param fqdn: Host FQDN (Fully Qualified Domain Name) (for example, machine.company.com).
    :type fqdn: str
    :param is_azure_ad_joined:
    :type is_azure_ad_joined: bool
    :param is_azure_ad_registered:
    :type is_azure_ad_registered: bool
    :param is_hybrid_azure_domain_joined: True if the host is domain joined to an on-premises
     Active Directory domain.
    :type is_hybrid_azure_domain_joined: bool
    :param net_bios_name: The local host name, without the DNS domain name.
    :type net_bios_name: str
    :param os: Host Operating System. (For example, Windows10, MacOS, RHEL, etc.).
    :type os: str
    :param private_ip_address: Private (not routable) IPv4 or IPv6 address (see RFC 1918) at the
     time of the alert.
    :type private_ip_address: str
    :param public_ip_address: Publicly routable IPv4 or IPv6 address (see RFC 1918) at time of the
     alert.
    :type public_ip_address: str
    :param risk_score: Provider-generated/calculated risk score of the host.  Recommended value
     range of 0-1, which equates to a percentage.
    :type risk_score: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'fqdn': {'key': 'fqdn', 'type': 'str'},
        'is_azure_ad_joined': {'key': 'isAzureAdJoined', 'type': 'bool'},
        'is_azure_ad_registered': {'key': 'isAzureAdRegistered', 'type': 'bool'},
        'is_hybrid_azure_domain_joined': {'key': 'isHybridAzureDomainJoined', 'type': 'bool'},
        'net_bios_name': {'key': 'netBiosName', 'type': 'str'},
        'os': {'key': 'os', 'type': 'str'},
        'private_ip_address': {'key': 'privateIpAddress', 'type': 'str'},
        'public_ip_address': {'key': 'publicIpAddress', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphHostSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.fqdn = kwargs.get('fqdn', None)
        self.is_azure_ad_joined = kwargs.get('is_azure_ad_joined', None)
        self.is_azure_ad_registered = kwargs.get('is_azure_ad_registered', None)
        self.is_hybrid_azure_domain_joined = kwargs.get('is_hybrid_azure_domain_joined', None)
        self.net_bios_name = kwargs.get('net_bios_name', None)
        self.os = kwargs.get('os', None)
        self.private_ip_address = kwargs.get('private_ip_address', None)
        self.public_ip_address = kwargs.get('public_ip_address', None)
        self.risk_score = kwargs.get('risk_score', None)


class MicrosoftGraphMalwareState(msrest.serialization.Model):
    """malwareState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param category: Provider-generated malware category (for example, trojan, ransomware, etc.).
    :type category: str
    :param family: Provider-generated malware family (for example, 'wannacry', 'notpetya', etc.).
    :type family: str
    :param name: Provider-generated malware variant name (for example, Trojan:Win32/Powessere.H).
    :type name: str
    :param severity: Provider-determined severity of this malware.
    :type severity: str
    :param was_running: Indicates whether the detected file (malware/vulnerability) was running at
     the time of detection or was detected at rest on the disk.
    :type was_running: bool
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'category': {'key': 'category', 'type': 'str'},
        'family': {'key': 'family', 'type': 'str'},
        'name': {'key': 'name', 'type': 'str'},
        'severity': {'key': 'severity', 'type': 'str'},
        'was_running': {'key': 'wasRunning', 'type': 'bool'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphMalwareState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.category = kwargs.get('category', None)
        self.family = kwargs.get('family', None)
        self.name = kwargs.get('name', None)
        self.severity = kwargs.get('severity', None)
        self.was_running = kwargs.get('was_running', None)


class MicrosoftGraphNetworkConnection(msrest.serialization.Model):
    """networkConnection.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param application_name: Name of the application managing the network connection (for example,
     Facebook or SMTP).
    :type application_name: str
    :param destination_address: Destination IP address (of the network connection).
    :type destination_address: str
    :param destination_domain: Destination domain portion of the destination URL. (for example
     'www.contoso.com').
    :type destination_domain: str
    :param destination_location: Location (by IP address mapping) associated with the destination
     of a network connection.
    :type destination_location: str
    :param destination_port: Destination port (of the network connection).
    :type destination_port: str
    :param destination_url: Network connection URL/URI string - excluding parameters. (for example
     'www.contoso.com/products/default.html').
    :type destination_url: str
    :param direction:  Possible values include: "unknown", "inbound", "outbound",
     "unknownFutureValue".
    :type direction: str or ~security.models.MicrosoftGraphConnectionDirection
    :param domain_registered_date_time: Date when the destination domain was registered. The
     Timestamp type represents date and time information using ISO 8601 format and is always in UTC
     time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type domain_registered_date_time: ~datetime.datetime
    :param local_dns_name: The local DNS name resolution as it appears in the host's local DNS
     cache (for example, in case the 'hosts' file was tampered with).
    :type local_dns_name: str
    :param nat_destination_address: Network Address Translation destination IP address.
    :type nat_destination_address: str
    :param nat_destination_port: Network Address Translation destination port.
    :type nat_destination_port: str
    :param nat_source_address: Network Address Translation source IP address.
    :type nat_source_address: str
    :param nat_source_port: Network Address Translation source port.
    :type nat_source_port: str
    :param protocol:  Possible values include: "ip", "icmp", "unknown", "igmp", "ggp", "ipv4",
     "tcp", "pup", "udp", "idp", "ipv6", "ipv6RoutingHeader", "ipv6FragmentHeader",
     "ipSecEncapsulatingSecurityPayload", "ipSecAuthenticationHeader", "icmpV6", "ipv6NoNextHeader",
     "ipv6DestinationOptions", "nd", "raw", "ipx", "spx", "spxII", "unknownFutureValue".
    :type protocol: str or ~security.models.MicrosoftGraphSecurityNetworkProtocol
    :param risk_score: Provider generated/calculated risk score of the network connection.
     Recommended value range of 0-1, which equates to a percentage.
    :type risk_score: str
    :param source_address: Source (i.e. origin) IP address (of the network connection).
    :type source_address: str
    :param source_location: Location (by IP address mapping) associated with the source of a
     network connection.
    :type source_location: str
    :param source_port: Source (i.e. origin) IP port (of the network connection).
    :type source_port: str
    :param status:  Possible values include: "unknown", "attempted", "succeeded", "blocked",
     "failed", "unknownFutureValue".
    :type status: str or ~security.models.MicrosoftGraphConnectionStatus
    :param url_parameters: Parameters (suffix) of the destination URL.
    :type url_parameters: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'application_name': {'key': 'applicationName', 'type': 'str'},
        'destination_address': {'key': 'destinationAddress', 'type': 'str'},
        'destination_domain': {'key': 'destinationDomain', 'type': 'str'},
        'destination_location': {'key': 'destinationLocation', 'type': 'str'},
        'destination_port': {'key': 'destinationPort', 'type': 'str'},
        'destination_url': {'key': 'destinationUrl', 'type': 'str'},
        'direction': {'key': 'direction', 'type': 'str'},
        'domain_registered_date_time': {'key': 'domainRegisteredDateTime', 'type': 'iso-8601'},
        'local_dns_name': {'key': 'localDnsName', 'type': 'str'},
        'nat_destination_address': {'key': 'natDestinationAddress', 'type': 'str'},
        'nat_destination_port': {'key': 'natDestinationPort', 'type': 'str'},
        'nat_source_address': {'key': 'natSourceAddress', 'type': 'str'},
        'nat_source_port': {'key': 'natSourcePort', 'type': 'str'},
        'protocol': {'key': 'protocol', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
        'source_address': {'key': 'sourceAddress', 'type': 'str'},
        'source_location': {'key': 'sourceLocation', 'type': 'str'},
        'source_port': {'key': 'sourcePort', 'type': 'str'},
        'status': {'key': 'status', 'type': 'str'},
        'url_parameters': {'key': 'urlParameters', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphNetworkConnection, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.application_name = kwargs.get('application_name', None)
        self.destination_address = kwargs.get('destination_address', None)
        self.destination_domain = kwargs.get('destination_domain', None)
        self.destination_location = kwargs.get('destination_location', None)
        self.destination_port = kwargs.get('destination_port', None)
        self.destination_url = kwargs.get('destination_url', None)
        self.direction = kwargs.get('direction', None)
        self.domain_registered_date_time = kwargs.get('domain_registered_date_time', None)
        self.local_dns_name = kwargs.get('local_dns_name', None)
        self.nat_destination_address = kwargs.get('nat_destination_address', None)
        self.nat_destination_port = kwargs.get('nat_destination_port', None)
        self.nat_source_address = kwargs.get('nat_source_address', None)
        self.nat_source_port = kwargs.get('nat_source_port', None)
        self.protocol = kwargs.get('protocol', None)
        self.risk_score = kwargs.get('risk_score', None)
        self.source_address = kwargs.get('source_address', None)
        self.source_location = kwargs.get('source_location', None)
        self.source_port = kwargs.get('source_port', None)
        self.status = kwargs.get('status', None)
        self.url_parameters = kwargs.get('url_parameters', None)


class MicrosoftGraphProcess(msrest.serialization.Model):
    """process.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param account_name: User account identifier (user account context the process ran under) for
     example, AccountName, SID, and so on.
    :type account_name: str
    :param command_line: The full process invocation commandline including all parameters.
    :type command_line: str
    :param created_date_time: Time at which the process was started. The Timestamp type represents
     date and time information using ISO 8601 format and is always in UTC time. For example,
     midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type created_date_time: ~datetime.datetime
    :param file_hash: fileHash.
    :type file_hash: ~security.models.MicrosoftGraphFileHash
    :param integrity_level:  Possible values include: "unknown", "untrusted", "low", "medium",
     "high", "system", "unknownFutureValue".
    :type integrity_level: str or ~security.models.MicrosoftGraphProcessIntegrityLevel
    :param is_elevated: True if the process is elevated.
    :type is_elevated: bool
    :param name: The name of the process' Image file.
    :type name: str
    :param parent_process_created_date_time: DateTime at which the parent process was started. The
     Timestamp type represents date and time information using ISO 8601 format and is always in UTC
     time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type parent_process_created_date_time: ~datetime.datetime
    :param parent_process_id: The Process ID (PID) of the parent process.
    :type parent_process_id: int
    :param parent_process_name: The name of the image file of the parent process.
    :type parent_process_name: str
    :param path: Full path, including filename.
    :type path: str
    :param process_id: The Process ID (PID) of the process.
    :type process_id: int
    """

    _validation = {
        'parent_process_id': {'maximum': 2147483647, 'minimum': -2147483648},
        'process_id': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'account_name': {'key': 'accountName', 'type': 'str'},
        'command_line': {'key': 'commandLine', 'type': 'str'},
        'created_date_time': {'key': 'createdDateTime', 'type': 'iso-8601'},
        'file_hash': {'key': 'fileHash', 'type': 'MicrosoftGraphFileHash'},
        'integrity_level': {'key': 'integrityLevel', 'type': 'str'},
        'is_elevated': {'key': 'isElevated', 'type': 'bool'},
        'name': {'key': 'name', 'type': 'str'},
        'parent_process_created_date_time': {'key': 'parentProcessCreatedDateTime', 'type': 'iso-8601'},
        'parent_process_id': {'key': 'parentProcessId', 'type': 'int'},
        'parent_process_name': {'key': 'parentProcessName', 'type': 'str'},
        'path': {'key': 'path', 'type': 'str'},
        'process_id': {'key': 'processId', 'type': 'int'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphProcess, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.account_name = kwargs.get('account_name', None)
        self.command_line = kwargs.get('command_line', None)
        self.created_date_time = kwargs.get('created_date_time', None)
        self.file_hash = kwargs.get('file_hash', None)
        self.integrity_level = kwargs.get('integrity_level', None)
        self.is_elevated = kwargs.get('is_elevated', None)
        self.name = kwargs.get('name', None)
        self.parent_process_created_date_time = kwargs.get('parent_process_created_date_time', None)
        self.parent_process_id = kwargs.get('parent_process_id', None)
        self.parent_process_name = kwargs.get('parent_process_name', None)
        self.path = kwargs.get('path', None)
        self.process_id = kwargs.get('process_id', None)


class MicrosoftGraphRegistryKeyState(msrest.serialization.Model):
    """registryKeyState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param hive:  Possible values include: "unknown", "currentConfig", "currentUser",
     "localMachineSam", "localMachineSecurity", "localMachineSoftware", "localMachineSystem",
     "usersDefault", "unknownFutureValue".
    :type hive: str or ~security.models.MicrosoftGraphRegistryHive
    :param key: Current (i.e. changed) registry key (excludes HIVE).
    :type key: str
    :param old_key: Previous (i.e. before changed) registry key (excludes HIVE).
    :type old_key: str
    :param old_value_data: Previous (i.e. before changed) registry key value data (contents).
    :type old_value_data: str
    :param old_value_name: Previous (i.e. before changed) registry key value name.
    :type old_value_name: str
    :param operation:  Possible values include: "unknown", "create", "modify", "delete",
     "unknownFutureValue".
    :type operation: str or ~security.models.MicrosoftGraphRegistryOperation
    :param process_id: Process ID (PID) of the process that modified the registry key (process
     details will appear in the alert 'processes' collection).
    :type process_id: int
    :param value_data: Current (i.e. changed) registry key value data (contents).
    :type value_data: str
    :param value_name: Current (i.e. changed) registry key value name.
    :type value_name: str
    :param value_type:  Possible values include: "unknown", "binary", "dword", "dwordLittleEndian",
     "dwordBigEndian", "expandSz", "link", "multiSz", "none", "qword", "qwordlittleEndian", "sz",
     "unknownFutureValue".
    :type value_type: str or ~security.models.MicrosoftGraphRegistryValueType
    """

    _validation = {
        'process_id': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'hive': {'key': 'hive', 'type': 'str'},
        'key': {'key': 'key', 'type': 'str'},
        'old_key': {'key': 'oldKey', 'type': 'str'},
        'old_value_data': {'key': 'oldValueData', 'type': 'str'},
        'old_value_name': {'key': 'oldValueName', 'type': 'str'},
        'operation': {'key': 'operation', 'type': 'str'},
        'process_id': {'key': 'processId', 'type': 'int'},
        'value_data': {'key': 'valueData', 'type': 'str'},
        'value_name': {'key': 'valueName', 'type': 'str'},
        'value_type': {'key': 'valueType', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphRegistryKeyState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.hive = kwargs.get('hive', None)
        self.key = kwargs.get('key', None)
        self.old_key = kwargs.get('old_key', None)
        self.old_value_data = kwargs.get('old_value_data', None)
        self.old_value_name = kwargs.get('old_value_name', None)
        self.operation = kwargs.get('operation', None)
        self.process_id = kwargs.get('process_id', None)
        self.value_data = kwargs.get('value_data', None)
        self.value_name = kwargs.get('value_name', None)
        self.value_type = kwargs.get('value_type', None)


class MicrosoftGraphSecureScore(MicrosoftGraphEntity):
    """secureScore.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param active_user_count: Active user count of the given tenant.
    :type active_user_count: int
    :param average_comparative_scores: Average score by different scopes (for example, average by
     industry, average by seating) and control category (Identity, Data, Device, Apps,
     Infrastructure) within the scope.
    :type average_comparative_scores: list[~security.models.MicrosoftGraphAverageComparativeScore]
    :param azure_tenant_id: GUID string for tenant ID.
    :type azure_tenant_id: str
    :param control_scores: Contains tenant scores for a set of controls.
    :type control_scores: list[~security.models.MicrosoftGraphControlScore]
    :param created_date_time: The date when the entity is created.
    :type created_date_time: ~datetime.datetime
    :param current_score: Tenant current attained score on specified date.
    :type current_score: float
    :param enabled_services: Microsoft-provided services for the tenant (for example, Exchange
     online, Skype, Sharepoint).
    :type enabled_services: list[str]
    :param licensed_user_count: Licensed user count of the given tenant.
    :type licensed_user_count: int
    :param max_score: Tenant maximum possible score on specified date.
    :type max_score: float
    :param vendor_information: securityVendorInformation.
    :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation
    """

    _validation = {
        'active_user_count': {'maximum': 2147483647, 'minimum': -2147483648},
        'licensed_user_count': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'active_user_count': {'key': 'activeUserCount', 'type': 'int'},
        'average_comparative_scores': {'key': 'averageComparativeScores', 'type': '[MicrosoftGraphAverageComparativeScore]'},
        'azure_tenant_id': {'key': 'azureTenantId', 'type': 'str'},
        'control_scores': {'key': 'controlScores', 'type': '[MicrosoftGraphControlScore]'},
        'created_date_time': {'key': 'createdDateTime', 'type': 'iso-8601'},
        'current_score': {'key': 'currentScore', 'type': 'float'},
        'enabled_services': {'key': 'enabledServices', 'type': '[str]'},
        'licensed_user_count': {'key': 'licensedUserCount', 'type': 'int'},
        'max_score': {'key': 'maxScore', 'type': 'float'},
        'vendor_information': {'key': 'vendorInformation', 'type': 'MicrosoftGraphSecurityVendorInformation'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecureScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.active_user_count = kwargs.get('active_user_count', None)
        self.average_comparative_scores = kwargs.get('average_comparative_scores', None)
        self.azure_tenant_id = kwargs.get('azure_tenant_id', None)
        self.control_scores = kwargs.get('control_scores', None)
        self.created_date_time = kwargs.get('created_date_time', None)
        self.current_score = kwargs.get('current_score', None)
        self.enabled_services = kwargs.get('enabled_services', None)
        self.licensed_user_count = kwargs.get('licensed_user_count', None)
        self.max_score = kwargs.get('max_score', None)
        self.vendor_information = kwargs.get('vendor_information', None)


class MicrosoftGraphSecureScoreControlProfile(MicrosoftGraphEntity):
    """secureScoreControlProfile.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param action_type: Control action type (Config, Review, Behavior).
    :type action_type: str
    :param action_url: URL to where the control can be actioned.
    :type action_url: str
    :param azure_tenant_id: GUID string for tenant ID.
    :type azure_tenant_id: str
    :param compliance_information:
    :type compliance_information: list[~security.models.MicrosoftGraphComplianceInformation]
    :param control_category: Control action category (Identity, Data, Device, Apps,
     Infrastructure).
    :type control_category: str
    :param control_state_updates:
    :type control_state_updates: list[~security.models.MicrosoftGraphSecureScoreControlStateUpdate]
    :param deprecated: Flag to indicate if a control is depreciated.
    :type deprecated: bool
    :param implementation_cost: Resource cost of implemmentating control (low, moderate, high).
    :type implementation_cost: str
    :param last_modified_date_time: Time at which the control profile entity was last modified. The
     Timestamp type represents date and time.
    :type last_modified_date_time: ~datetime.datetime
    :param max_score: max attainable score for the control.
    :type max_score: float
    :param rank: Microsoft's stack ranking of control.
    :type rank: int
    :param remediation: Description of what the control will help remediate.
    :type remediation: str
    :param remediation_impact: Description of the impact on users of the remediation.
    :type remediation_impact: str
    :param service: Service that owns the control (Exchange, Sharepoint, Azure AD).
    :type service: str
    :param threats: List of threats the control mitigates
     (accountBreach,dataDeletion,dataExfiltration,dataSpillage,.
    :type threats: list[str]
    :param tier:
    :type tier: str
    :param title: Title of the control.
    :type title: str
    :param user_impact:
    :type user_impact: str
    :param vendor_information: securityVendorInformation.
    :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation
    """

    _validation = {
        'rank': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'action_type': {'key': 'actionType', 'type': 'str'},
        'action_url': {'key': 'actionUrl', 'type': 'str'},
        'azure_tenant_id': {'key': 'azureTenantId', 'type': 'str'},
        'compliance_information': {'key': 'complianceInformation', 'type': '[MicrosoftGraphComplianceInformation]'},
        'control_category': {'key': 'controlCategory', 'type': 'str'},
        'control_state_updates': {'key': 'controlStateUpdates', 'type': '[MicrosoftGraphSecureScoreControlStateUpdate]'},
        'deprecated': {'key': 'deprecated', 'type': 'bool'},
        'implementation_cost': {'key': 'implementationCost', 'type': 'str'},
        'last_modified_date_time': {'key': 'lastModifiedDateTime', 'type': 'iso-8601'},
        'max_score': {'key': 'maxScore', 'type': 'float'},
        'rank': {'key': 'rank', 'type': 'int'},
        'remediation': {'key': 'remediation', 'type': 'str'},
        'remediation_impact': {'key': 'remediationImpact', 'type': 'str'},
        'service': {'key': 'service', 'type': 'str'},
        'threats': {'key': 'threats', 'type': '[str]'},
        'tier': {'key': 'tier', 'type': 'str'},
        'title': {'key': 'title', 'type': 'str'},
        'user_impact': {'key': 'userImpact', 'type': 'str'},
        'vendor_information': {'key': 'vendorInformation', 'type': 'MicrosoftGraphSecurityVendorInformation'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecureScoreControlProfile, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.action_type = kwargs.get('action_type', None)
        self.action_url = kwargs.get('action_url', None)
        self.azure_tenant_id = kwargs.get('azure_tenant_id', None)
        self.compliance_information = kwargs.get('compliance_information', None)
        self.control_category = kwargs.get('control_category', None)
        self.control_state_updates = kwargs.get('control_state_updates', None)
        self.deprecated = kwargs.get('deprecated', None)
        self.implementation_cost = kwargs.get('implementation_cost', None)
        self.last_modified_date_time = kwargs.get('last_modified_date_time', None)
        self.max_score = kwargs.get('max_score', None)
        self.rank = kwargs.get('rank', None)
        self.remediation = kwargs.get('remediation', None)
        self.remediation_impact = kwargs.get('remediation_impact', None)
        self.service = kwargs.get('service', None)
        self.threats = kwargs.get('threats', None)
        self.tier = kwargs.get('tier', None)
        self.title = kwargs.get('title', None)
        self.user_impact = kwargs.get('user_impact', None)
        self.vendor_information = kwargs.get('vendor_information', None)


class MicrosoftGraphSecureScoreControlStateUpdate(msrest.serialization.Model):
    """secureScoreControlStateUpdate.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param assigned_to: Assigns the control to the user who will take the action.
    :type assigned_to: str
    :param comment: Provides optional comment about the control.
    :type comment: str
    :param state: State of the control, which can be modified via a PATCH command (for example,
     ignored, thirdParty).
    :type state: str
    :param updated_by: ID of the user who updated tenant state.
    :type updated_by: str
    :param updated_date_time: Time at which the control state was updated.
    :type updated_date_time: ~datetime.datetime
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'assigned_to': {'key': 'assignedTo', 'type': 'str'},
        'comment': {'key': 'comment', 'type': 'str'},
        'state': {'key': 'state', 'type': 'str'},
        'updated_by': {'key': 'updatedBy', 'type': 'str'},
        'updated_date_time': {'key': 'updatedDateTime', 'type': 'iso-8601'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecureScoreControlStateUpdate, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.assigned_to = kwargs.get('assigned_to', None)
        self.comment = kwargs.get('comment', None)
        self.state = kwargs.get('state', None)
        self.updated_by = kwargs.get('updated_by', None)
        self.updated_date_time = kwargs.get('updated_date_time', None)


class MicrosoftGraphSecurity(MicrosoftGraphEntity):
    """security.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param alerts: Read-only. Nullable.
    :type alerts: list[~security.models.MicrosoftGraphAlert]
    :param secure_score_control_profiles:
    :type secure_score_control_profiles:
     list[~security.models.MicrosoftGraphSecureScoreControlProfile]
    :param secure_scores:
    :type secure_scores: list[~security.models.MicrosoftGraphSecureScore]
    """

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'alerts': {'key': 'alerts', 'type': '[MicrosoftGraphAlert]'},
        'secure_score_control_profiles': {'key': 'secureScoreControlProfiles', 'type': '[MicrosoftGraphSecureScoreControlProfile]'},
        'secure_scores': {'key': 'secureScores', 'type': '[MicrosoftGraphSecureScore]'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecurity, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.alerts = kwargs.get('alerts', None)
        self.secure_score_control_profiles = kwargs.get('secure_score_control_profiles', None)
        self.secure_scores = kwargs.get('secure_scores', None)


class MicrosoftGraphSecurityResource(msrest.serialization.Model):
    """securityResource.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param resource: Name of the resource that is related to current alert. Required.
    :type resource: str
    :param resource_type:  Possible values include: "unknown", "attacked", "related",
     "unknownFutureValue".
    :type resource_type: str or ~security.models.MicrosoftGraphSecurityResourceType
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'resource': {'key': 'resource', 'type': 'str'},
        'resource_type': {'key': 'resourceType', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecurityResource, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.resource = kwargs.get('resource', None)
        self.resource_type = kwargs.get('resource_type', None)


class MicrosoftGraphSecurityVendorInformation(msrest.serialization.Model):
    """securityVendorInformation.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param provider: Specific provider (product/service - not vendor company); for example,
     WindowsDefenderATP.
    :type provider: str
    :param provider_version: Version of the provider or subprovider, if it exists, that generated
     the alert. Required.
    :type provider_version: str
    :param sub_provider: Specific subprovider (under aggregating provider); for example,
     WindowsDefenderATP.SmartScreen.
    :type sub_provider: str
    :param vendor: Name of the alert vendor (for example, Microsoft, Dell, FireEye). Required.
    :type vendor: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'provider': {'key': 'provider', 'type': 'str'},
        'provider_version': {'key': 'providerVersion', 'type': 'str'},
        'sub_provider': {'key': 'subProvider', 'type': 'str'},
        'vendor': {'key': 'vendor', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecurityVendorInformation, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.provider = kwargs.get('provider', None)
        self.provider_version = kwargs.get('provider_version', None)
        self.sub_provider = kwargs.get('sub_provider', None)
        self.vendor = kwargs.get('vendor', None)


class MicrosoftGraphUserSecurityState(msrest.serialization.Model):
    """userSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param aad_user_id: AAD User object identifier (GUID) - represents the physical/multi-account
     user entity.
    :type aad_user_id: str
    :param account_name: Account name of user account (without Active Directory domain or DNS
     domain) - (also called mailNickName).
    :type account_name: str
    :param domain_name: NetBIOS/Active Directory domain of user account (that is, domain/account
     format).
    :type domain_name: str
    :param email_role:  Possible values include: "unknown", "sender", "recipient",
     "unknownFutureValue".
    :type email_role: str or ~security.models.MicrosoftGraphEmailRole
    :param is_vpn: Indicates whether the user logged on through a VPN.
    :type is_vpn: bool
    :param logon_date_time: Time at which the sign-in occurred. The Timestamp type represents date
     and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC
     on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type logon_date_time: ~datetime.datetime
    :param logon_id: User sign-in ID.
    :type logon_id: str
    :param logon_ip: IP Address the sign-in request originated from.
    :type logon_ip: str
    :param logon_location: Location (by IP address mapping) associated with a user sign-in event by
     this user.
    :type logon_location: str
    :param logon_type:  Possible values include: "unknown", "interactive", "remoteInteractive",
     "network", "batch", "service", "unknownFutureValue".
    :type logon_type: str or ~security.models.MicrosoftGraphLogonType
    :param on_premises_security_identifier: Active Directory (on-premises) Security Identifier
     (SID) of the user.
    :type on_premises_security_identifier: str
    :param risk_score: Provider-generated/calculated risk score of the user account. Recommended
     value range of 0-1, which equates to a percentage.
    :type risk_score: str
    :param user_account_type:  Possible values include: "unknown", "standard", "power",
     "administrator", "unknownFutureValue".
    :type user_account_type: str or ~security.models.MicrosoftGraphUserAccountSecurityType
    :param user_principal_name: User sign-in name - internet format: (user account name)@(user
     account DNS domain name).
    :type user_principal_name: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'aad_user_id': {'key': 'aadUserId', 'type': 'str'},
        'account_name': {'key': 'accountName', 'type': 'str'},
        'domain_name': {'key': 'domainName', 'type': 'str'},
        'email_role': {'key': 'emailRole', 'type': 'str'},
        'is_vpn': {'key': 'isVpn', 'type': 'bool'},
        'logon_date_time': {'key': 'logonDateTime', 'type': 'iso-8601'},
        'logon_id': {'key': 'logonId', 'type': 'str'},
        'logon_ip': {'key': 'logonIp', 'type': 'str'},
        'logon_location': {'key': 'logonLocation', 'type': 'str'},
        'logon_type': {'key': 'logonType', 'type': 'str'},
        'on_premises_security_identifier': {'key': 'onPremisesSecurityIdentifier', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
        'user_account_type': {'key': 'userAccountType', 'type': 'str'},
        'user_principal_name': {'key': 'userPrincipalName', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphUserSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.aad_user_id = kwargs.get('aad_user_id', None)
        self.account_name = kwargs.get('account_name', None)
        self.domain_name = kwargs.get('domain_name', None)
        self.email_role = kwargs.get('email_role', None)
        self.is_vpn = kwargs.get('is_vpn', None)
        self.logon_date_time = kwargs.get('logon_date_time', None)
        self.logon_id = kwargs.get('logon_id', None)
        self.logon_ip = kwargs.get('logon_ip', None)
        self.logon_location = kwargs.get('logon_location', None)
        self.logon_type = kwargs.get('logon_type', None)
        self.on_premises_security_identifier = kwargs.get('on_premises_security_identifier', None)
        self.risk_score = kwargs.get('risk_score', None)
        self.user_account_type = kwargs.get('user_account_type', None)
        self.user_principal_name = kwargs.get('user_principal_name', None)


class MicrosoftGraphVulnerabilityState(msrest.serialization.Model):
    """vulnerabilityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param cve: Common Vulnerabilities and Exposures (CVE) for the vulnerability.
    :type cve: str
    :param severity: Base Common Vulnerability Scoring System (CVSS) severity score for this
     vulnerability.
    :type severity: str
    :param was_running: Indicates whether the detected vulnerability (file) was running at the time
     of detection or was the file detected at rest on the disk.
    :type was_running: bool
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'cve': {'key': 'cve', 'type': 'str'},
        'severity': {'key': 'severity', 'type': 'str'},
        'was_running': {'key': 'wasRunning', 'type': 'bool'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphVulnerabilityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.cve = kwargs.get('cve', None)
        self.severity = kwargs.get('severity', None)
        self.was_running = kwargs.get('was_running', None)


class OdataError(msrest.serialization.Model):
    """OdataError.

    All required parameters must be populated in order to send to Azure.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param error: Required.
    :type error: ~security.models.OdataErrorMain
    """

    _validation = {
        'error': {'required': True},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'error': {'key': 'error', 'type': 'OdataErrorMain'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(OdataError, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.error = kwargs['error']


class OdataErrorDetail(msrest.serialization.Model):
    """OdataErrorDetail.

    All required parameters must be populated in order to send to Azure.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param code: Required.
    :type code: str
    :param message: Required.
    :type message: str
    :param target:
    :type target: str
    """

    _validation = {
        'code': {'required': True},
        'message': {'required': True},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'code': {'key': 'code', 'type': 'str'},
        'message': {'key': 'message', 'type': 'str'},
        'target': {'key': 'target', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(OdataErrorDetail, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.code = kwargs['code']
        self.message = kwargs['message']
        self.target = kwargs.get('target', None)


class OdataErrorMain(msrest.serialization.Model):
    """OdataErrorMain.

    All required parameters must be populated in order to send to Azure.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param code: Required.
    :type code: str
    :param message: Required.
    :type message: str
    :param target:
    :type target: str
    :param details:
    :type details: list[~security.models.OdataErrorDetail]
    :param innererror: The structure of this object is service-specific.
    :type innererror: dict[str, object]
    """

    _validation = {
        'code': {'required': True},
        'message': {'required': True},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'code': {'key': 'code', 'type': 'str'},
        'message': {'key': 'message', 'type': 'str'},
        'target': {'key': 'target', 'type': 'str'},
        'details': {'key': 'details', 'type': '[OdataErrorDetail]'},
        'innererror': {'key': 'innererror', 'type': '{object}'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(OdataErrorMain, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.code = kwargs['code']
        self.message = kwargs['message']
        self.target = kwargs.get('target', None)
        self.details = kwargs.get('details', None)
        self.innererror = kwargs.get('innererror', None)

# coding=utf-8
# --------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for license information.
# Code generated by Microsoft (R) AutoRest Code Generator.
# Changes may cause incorrect behavior and will be lost if the code is regenerated.
# --------------------------------------------------------------------------

from azure.core.exceptions import HttpResponseError
import msrest.serialization


class CollectionOfAlert(msrest.serialization.Model):
    """Collection of alert.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param value:
    :type value: list[~security.models.MicrosoftGraphAlert]
    :param odata_next_link:
    :type odata_next_link: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'value': {'key': 'value', 'type': '[MicrosoftGraphAlert]'},
        'odata_next_link': {'key': '@odata\\.nextLink', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(CollectionOfAlert, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.value = kwargs.get('value', None)
        self.odata_next_link = kwargs.get('odata_next_link', None)


class CollectionOfSecureScore(msrest.serialization.Model):
    """Collection of secureScore.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param value:
    :type value: list[~security.models.MicrosoftGraphSecureScore]
    :param odata_next_link:
    :type odata_next_link: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'value': {'key': 'value', 'type': '[MicrosoftGraphSecureScore]'},
        'odata_next_link': {'key': '@odata\\.nextLink', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(CollectionOfSecureScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.value = kwargs.get('value', None)
        self.odata_next_link = kwargs.get('odata_next_link', None)


class CollectionOfSecureScoreControlProfile(msrest.serialization.Model):
    """Collection of secureScoreControlProfile.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param value:
    :type value: list[~security.models.MicrosoftGraphSecureScoreControlProfile]
    :param odata_next_link:
    :type odata_next_link: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'value': {'key': 'value', 'type': '[MicrosoftGraphSecureScoreControlProfile]'},
        'odata_next_link': {'key': '@odata\\.nextLink', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(CollectionOfSecureScoreControlProfile, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.value = kwargs.get('value', None)
        self.odata_next_link = kwargs.get('odata_next_link', None)


class MicrosoftGraphEntity(msrest.serialization.Model):
    """entity.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param id: Read-only.
    :type id: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'id': {'key': 'id', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphEntity, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.id = kwargs.get('id', None)


class MicrosoftGraphAlert(MicrosoftGraphEntity):
    """alert.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param activity_group_name: Name or alias of the activity group (attacker) this alert is
     attributed to.
    :type activity_group_name: str
    :param assigned_to: Name of the analyst the alert is assigned to for triage, investigation, or
     remediation (supports update).
    :type assigned_to: str
    :param azure_subscription_id: Azure subscription ID, present if this alert is related to an
     Azure resource.
    :type azure_subscription_id: str
    :param azure_tenant_id: Azure Active Directory tenant ID. Required.
    :type azure_tenant_id: str
    :param category: Category of the alert (for example, credentialTheft, ransomware, etc.).
    :type category: str
    :param closed_date_time: Time at which the alert was closed. The Timestamp type represents date
     and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC
     on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z' (supports update).
    :type closed_date_time: ~datetime.datetime
    :param cloud_app_states: Security-related stateful information generated by the provider about
     the cloud application/s related to this alert.
    :type cloud_app_states: list[~security.models.MicrosoftGraphCloudAppSecurityState]
    :param comments: Customer-provided comments on alert (for customer alert management) (supports
     update).
    :type comments: list[str]
    :param confidence: Confidence of the detection logic (percentage between 1-100).
    :type confidence: int
    :param created_date_time: Time at which the alert was created by the alert provider. The
     Timestamp type represents date and time information using ISO 8601 format and is always in UTC
     time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
     Required.
    :type created_date_time: ~datetime.datetime
    :param description: Alert description.
    :type description: str
    :param detection_ids: Set of alerts related to this alert entity (each alert is pushed to the
     SIEM as a separate record).
    :type detection_ids: list[str]
    :param event_date_time: Time at which the event(s) that served as the trigger(s) to generate
     the alert occurred. The Timestamp type represents date and time information using ISO 8601
     format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like
     this: '2014-01-01T00:00:00Z'. Required.
    :type event_date_time: ~datetime.datetime
    :param feedback:  Possible values include: "unknown", "truePositive", "falsePositive",
     "benignPositive", "unknownFutureValue".
    :type feedback: str or ~security.models.MicrosoftGraphAlertFeedback
    :param file_states: Security-related stateful information generated by the provider about the
     file(s) related to this alert.
    :type file_states: list[~security.models.MicrosoftGraphFileSecurityState]
    :param history_states:
    :type history_states: list[~security.models.MicrosoftGraphAlertHistoryState]
    :param host_states: Security-related stateful information generated by the provider about the
     host(s) related to this alert.
    :type host_states: list[~security.models.MicrosoftGraphHostSecurityState]
    :param incident_ids: IDs of incidents related to current alert.
    :type incident_ids: list[str]
    :param last_modified_date_time: Time at which the alert entity was last modified. The Timestamp
     type represents date and time information using ISO 8601 format and is always in UTC time. For
     example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type last_modified_date_time: ~datetime.datetime
    :param malware_states: Threat Intelligence pertaining to malware related to this alert.
    :type malware_states: list[~security.models.MicrosoftGraphMalwareState]
    :param network_connections: Security-related stateful information generated by the provider
     about the network connection(s) related to this alert.
    :type network_connections: list[~security.models.MicrosoftGraphNetworkConnection]
    :param processes: Security-related stateful information generated by the provider about the
     process or processes related to this alert.
    :type processes: list[~security.models.MicrosoftGraphProcess]
    :param recommended_actions: Vendor/provider recommended action(s) to take as a result of the
     alert (for example, isolate machine, enforce2FA, reimage host).
    :type recommended_actions: list[str]
    :param registry_key_states: Security-related stateful information generated by the provider
     about the registry keys related to this alert.
    :type registry_key_states: list[~security.models.MicrosoftGraphRegistryKeyState]
    :param security_resources: Resources related to current alert. For example, for some alerts
     this can have the Azure Resource value.
    :type security_resources: list[~security.models.MicrosoftGraphSecurityResource]
    :param severity:  Possible values include: "unknown", "informational", "low", "medium", "high",
     "unknownFutureValue".
    :type severity: str or ~security.models.MicrosoftGraphAlertSeverity
    :param source_materials: Hyperlinks (URIs) to the source material related to the alert, for
     example, provider's user interface for alerts or log search, etc.
    :type source_materials: list[str]
    :param status:  Possible values include: "unknown", "newAlert", "inProgress", "resolved",
     "dismissed", "unknownFutureValue".
    :type status: str or ~security.models.MicrosoftGraphAlertStatus
    :param tags: A set of tags. User-definable labels that can be applied to an alert and can serve
     as filter conditions (for example 'HVA', 'SAW', etc.) (supports update).
    :type tags: list[str]
    :param title: Alert title. Required.
    :type title: str
    :param triggers: Security-related information about the specific properties that triggered the
     alert (properties appearing in the alert). Alerts might contain information about multiple
     users, hosts, files, ip addresses. This field indicates which properties triggered the alert
     generation.
    :type triggers: list[~security.models.MicrosoftGraphAlertTrigger]
    :param user_states: Security-related stateful information generated by the provider about the
     user accounts related to this alert.
    :type user_states: list[~security.models.MicrosoftGraphUserSecurityState]
    :param vendor_information: securityVendorInformation.
    :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation
    :param vulnerability_states: Threat intelligence pertaining to one or more vulnerabilities
     related to this alert.
    :type vulnerability_states: list[~security.models.MicrosoftGraphVulnerabilityState]
    """

    _validation = {
        'confidence': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'activity_group_name': {'key': 'activityGroupName', 'type': 'str'},
        'assigned_to': {'key': 'assignedTo', 'type': 'str'},
        'azure_subscription_id': {'key': 'azureSubscriptionId', 'type': 'str'},
        'azure_tenant_id': {'key': 'azureTenantId', 'type': 'str'},
        'category': {'key': 'category', 'type': 'str'},
        'closed_date_time': {'key': 'closedDateTime', 'type': 'iso-8601'},
        'cloud_app_states': {'key': 'cloudAppStates', 'type': '[MicrosoftGraphCloudAppSecurityState]'},
        'comments': {'key': 'comments', 'type': '[str]'},
        'confidence': {'key': 'confidence', 'type': 'int'},
        'created_date_time': {'key': 'createdDateTime', 'type': 'iso-8601'},
        'description': {'key': 'description', 'type': 'str'},
        'detection_ids': {'key': 'detectionIds', 'type': '[str]'},
        'event_date_time': {'key': 'eventDateTime', 'type': 'iso-8601'},
        'feedback': {'key': 'feedback', 'type': 'str'},
        'file_states': {'key': 'fileStates', 'type': '[MicrosoftGraphFileSecurityState]'},
        'history_states': {'key': 'historyStates', 'type': '[MicrosoftGraphAlertHistoryState]'},
        'host_states': {'key': 'hostStates', 'type': '[MicrosoftGraphHostSecurityState]'},
        'incident_ids': {'key': 'incidentIds', 'type': '[str]'},
        'last_modified_date_time': {'key': 'lastModifiedDateTime', 'type': 'iso-8601'},
        'malware_states': {'key': 'malwareStates', 'type': '[MicrosoftGraphMalwareState]'},
        'network_connections': {'key': 'networkConnections', 'type': '[MicrosoftGraphNetworkConnection]'},
        'processes': {'key': 'processes', 'type': '[MicrosoftGraphProcess]'},
        'recommended_actions': {'key': 'recommendedActions', 'type': '[str]'},
        'registry_key_states': {'key': 'registryKeyStates', 'type': '[MicrosoftGraphRegistryKeyState]'},
        'security_resources': {'key': 'securityResources', 'type': '[MicrosoftGraphSecurityResource]'},
        'severity': {'key': 'severity', 'type': 'str'},
        'source_materials': {'key': 'sourceMaterials', 'type': '[str]'},
        'status': {'key': 'status', 'type': 'str'},
        'tags': {'key': 'tags', 'type': '[str]'},
        'title': {'key': 'title', 'type': 'str'},
        'triggers': {'key': 'triggers', 'type': '[MicrosoftGraphAlertTrigger]'},
        'user_states': {'key': 'userStates', 'type': '[MicrosoftGraphUserSecurityState]'},
        'vendor_information': {'key': 'vendorInformation', 'type': 'MicrosoftGraphSecurityVendorInformation'},
        'vulnerability_states': {'key': 'vulnerabilityStates', 'type': '[MicrosoftGraphVulnerabilityState]'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAlert, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.activity_group_name = kwargs.get('activity_group_name', None)
        self.assigned_to = kwargs.get('assigned_to', None)
        self.azure_subscription_id = kwargs.get('azure_subscription_id', None)
        self.azure_tenant_id = kwargs.get('azure_tenant_id', None)
        self.category = kwargs.get('category', None)
        self.closed_date_time = kwargs.get('closed_date_time', None)
        self.cloud_app_states = kwargs.get('cloud_app_states', None)
        self.comments = kwargs.get('comments', None)
        self.confidence = kwargs.get('confidence', None)
        self.created_date_time = kwargs.get('created_date_time', None)
        self.description = kwargs.get('description', None)
        self.detection_ids = kwargs.get('detection_ids', None)
        self.event_date_time = kwargs.get('event_date_time', None)
        self.feedback = kwargs.get('feedback', None)
        self.file_states = kwargs.get('file_states', None)
        self.history_states = kwargs.get('history_states', None)
        self.host_states = kwargs.get('host_states', None)
        self.incident_ids = kwargs.get('incident_ids', None)
        self.last_modified_date_time = kwargs.get('last_modified_date_time', None)
        self.malware_states = kwargs.get('malware_states', None)
        self.network_connections = kwargs.get('network_connections', None)
        self.processes = kwargs.get('processes', None)
        self.recommended_actions = kwargs.get('recommended_actions', None)
        self.registry_key_states = kwargs.get('registry_key_states', None)
        self.security_resources = kwargs.get('security_resources', None)
        self.severity = kwargs.get('severity', None)
        self.source_materials = kwargs.get('source_materials', None)
        self.status = kwargs.get('status', None)
        self.tags = kwargs.get('tags', None)
        self.title = kwargs.get('title', None)
        self.triggers = kwargs.get('triggers', None)
        self.user_states = kwargs.get('user_states', None)
        self.vendor_information = kwargs.get('vendor_information', None)
        self.vulnerability_states = kwargs.get('vulnerability_states', None)


class MicrosoftGraphAlertHistoryState(msrest.serialization.Model):
    """alertHistoryState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param app_id:
    :type app_id: str
    :param assigned_to:
    :type assigned_to: str
    :param comments:
    :type comments: list[str]
    :param feedback:  Possible values include: "unknown", "truePositive", "falsePositive",
     "benignPositive", "unknownFutureValue".
    :type feedback: str or ~security.models.MicrosoftGraphAlertFeedback
    :param status:  Possible values include: "unknown", "newAlert", "inProgress", "resolved",
     "dismissed", "unknownFutureValue".
    :type status: str or ~security.models.MicrosoftGraphAlertStatus
    :param updated_date_time:
    :type updated_date_time: ~datetime.datetime
    :param user:
    :type user: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'app_id': {'key': 'appId', 'type': 'str'},
        'assigned_to': {'key': 'assignedTo', 'type': 'str'},
        'comments': {'key': 'comments', 'type': '[str]'},
        'feedback': {'key': 'feedback', 'type': 'str'},
        'status': {'key': 'status', 'type': 'str'},
        'updated_date_time': {'key': 'updatedDateTime', 'type': 'iso-8601'},
        'user': {'key': 'user', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAlertHistoryState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.app_id = kwargs.get('app_id', None)
        self.assigned_to = kwargs.get('assigned_to', None)
        self.comments = kwargs.get('comments', None)
        self.feedback = kwargs.get('feedback', None)
        self.status = kwargs.get('status', None)
        self.updated_date_time = kwargs.get('updated_date_time', None)
        self.user = kwargs.get('user', None)


class MicrosoftGraphAlertTrigger(msrest.serialization.Model):
    """alertTrigger.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param name: Name of the property serving as a detection trigger.
    :type name: str
    :param type: Type of the property in the key:value pair for interpretation. For example,
     String, Boolean, etc.
    :type type: str
    :param value: Value of the property serving as a detection trigger.
    :type value: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'name': {'key': 'name', 'type': 'str'},
        'type': {'key': 'type', 'type': 'str'},
        'value': {'key': 'value', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAlertTrigger, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.name = kwargs.get('name', None)
        self.type = kwargs.get('type', None)
        self.value = kwargs.get('value', None)


class MicrosoftGraphAverageComparativeScore(msrest.serialization.Model):
    """averageComparativeScore.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param average_score: Average score within specified basis.
    :type average_score: float
    :param basis: Scope type. The possible values are: AllTenants, TotalSeats, IndustryTypes.
    :type basis: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'average_score': {'key': 'averageScore', 'type': 'float'},
        'basis': {'key': 'basis', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphAverageComparativeScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.average_score = kwargs.get('average_score', None)
        self.basis = kwargs.get('basis', None)


class MicrosoftGraphCertificationControl(msrest.serialization.Model):
    """certificationControl.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param name: Certification control name.
    :type name: str
    :param url: URL for the Microsoft Service Trust Portal.
    :type url: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'name': {'key': 'name', 'type': 'str'},
        'url': {'key': 'url', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphCertificationControl, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.name = kwargs.get('name', None)
        self.url = kwargs.get('url', None)


class MicrosoftGraphCloudAppSecurityState(msrest.serialization.Model):
    """cloudAppSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param destination_service_ip: Destination IP Address of the connection to the cloud
     application/service.
    :type destination_service_ip: str
    :param destination_service_name: Cloud application/service name (for example 'Salesforce',
     'DropBox', etc.).
    :type destination_service_name: str
    :param risk_score: Provider-generated/calculated risk score of the Cloud Application/Service.
     Recommended value range of 0-1, which equates to a percentage.
    :type risk_score: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'destination_service_ip': {'key': 'destinationServiceIp', 'type': 'str'},
        'destination_service_name': {'key': 'destinationServiceName', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphCloudAppSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.destination_service_ip = kwargs.get('destination_service_ip', None)
        self.destination_service_name = kwargs.get('destination_service_name', None)
        self.risk_score = kwargs.get('risk_score', None)


class MicrosoftGraphComplianceInformation(msrest.serialization.Model):
    """complianceInformation.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param certification_controls: Collection of the certification controls associated with
     certification.
    :type certification_controls: list[~security.models.MicrosoftGraphCertificationControl]
    :param certification_name: Compliance certification name (for example, ISO 27018:2014, GDPR,
     FedRAMP, NIST 800-171).
    :type certification_name: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'certification_controls': {'key': 'certificationControls', 'type': '[MicrosoftGraphCertificationControl]'},
        'certification_name': {'key': 'certificationName', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphComplianceInformation, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.certification_controls = kwargs.get('certification_controls', None)
        self.certification_name = kwargs.get('certification_name', None)


class MicrosoftGraphControlScore(msrest.serialization.Model):
    """controlScore.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param control_category: Control action category (Identity, Data, Device, Apps,
     Infrastructure).
    :type control_category: str
    :param control_name: Control unique name.
    :type control_name: str
    :param description: Description of the control.
    :type description: str
    :param score: Tenant achieved score for the control (it varies day by day depending on tenant
     operations on the control).
    :type score: float
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'control_category': {'key': 'controlCategory', 'type': 'str'},
        'control_name': {'key': 'controlName', 'type': 'str'},
        'description': {'key': 'description', 'type': 'str'},
        'score': {'key': 'score', 'type': 'float'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphControlScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.control_category = kwargs.get('control_category', None)
        self.control_name = kwargs.get('control_name', None)
        self.description = kwargs.get('description', None)
        self.score = kwargs.get('score', None)


class MicrosoftGraphFileHash(msrest.serialization.Model):
    """fileHash.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param hash_type:  Possible values include: "unknown", "sha1", "sha256", "md5",
     "authenticodeHash256", "lsHash", "ctph", "unknownFutureValue".
    :type hash_type: str or ~security.models.MicrosoftGraphFileHashType
    :param hash_value: Value of the file hash.
    :type hash_value: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'hash_type': {'key': 'hashType', 'type': 'str'},
        'hash_value': {'key': 'hashValue', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphFileHash, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.hash_type = kwargs.get('hash_type', None)
        self.hash_value = kwargs.get('hash_value', None)


class MicrosoftGraphFileSecurityState(msrest.serialization.Model):
    """fileSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param file_hash: fileHash.
    :type file_hash: ~security.models.MicrosoftGraphFileHash
    :param name: File name (without path).
    :type name: str
    :param path: Full file path of the file/imageFile.
    :type path: str
    :param risk_score: Provider generated/calculated risk score of the alert file. Recommended
     value range of 0-1, which equates to a percentage.
    :type risk_score: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'file_hash': {'key': 'fileHash', 'type': 'MicrosoftGraphFileHash'},
        'name': {'key': 'name', 'type': 'str'},
        'path': {'key': 'path', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphFileSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.file_hash = kwargs.get('file_hash', None)
        self.name = kwargs.get('name', None)
        self.path = kwargs.get('path', None)
        self.risk_score = kwargs.get('risk_score', None)


class MicrosoftGraphHostSecurityState(msrest.serialization.Model):
    """hostSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param fqdn: Host FQDN (Fully Qualified Domain Name) (for example, machine.company.com).
    :type fqdn: str
    :param is_azure_ad_joined:
    :type is_azure_ad_joined: bool
    :param is_azure_ad_registered:
    :type is_azure_ad_registered: bool
    :param is_hybrid_azure_domain_joined: True if the host is domain joined to an on-premises
     Active Directory domain.
    :type is_hybrid_azure_domain_joined: bool
    :param net_bios_name: The local host name, without the DNS domain name.
    :type net_bios_name: str
    :param os: Host Operating System. (For example, Windows10, MacOS, RHEL, etc.).
    :type os: str
    :param private_ip_address: Private (not routable) IPv4 or IPv6 address (see RFC 1918) at the
     time of the alert.
    :type private_ip_address: str
    :param public_ip_address: Publicly routable IPv4 or IPv6 address (see RFC 1918) at time of the
     alert.
    :type public_ip_address: str
    :param risk_score: Provider-generated/calculated risk score of the host.  Recommended value
     range of 0-1, which equates to a percentage.
    :type risk_score: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'fqdn': {'key': 'fqdn', 'type': 'str'},
        'is_azure_ad_joined': {'key': 'isAzureAdJoined', 'type': 'bool'},
        'is_azure_ad_registered': {'key': 'isAzureAdRegistered', 'type': 'bool'},
        'is_hybrid_azure_domain_joined': {'key': 'isHybridAzureDomainJoined', 'type': 'bool'},
        'net_bios_name': {'key': 'netBiosName', 'type': 'str'},
        'os': {'key': 'os', 'type': 'str'},
        'private_ip_address': {'key': 'privateIpAddress', 'type': 'str'},
        'public_ip_address': {'key': 'publicIpAddress', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphHostSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.fqdn = kwargs.get('fqdn', None)
        self.is_azure_ad_joined = kwargs.get('is_azure_ad_joined', None)
        self.is_azure_ad_registered = kwargs.get('is_azure_ad_registered', None)
        self.is_hybrid_azure_domain_joined = kwargs.get('is_hybrid_azure_domain_joined', None)
        self.net_bios_name = kwargs.get('net_bios_name', None)
        self.os = kwargs.get('os', None)
        self.private_ip_address = kwargs.get('private_ip_address', None)
        self.public_ip_address = kwargs.get('public_ip_address', None)
        self.risk_score = kwargs.get('risk_score', None)


class MicrosoftGraphMalwareState(msrest.serialization.Model):
    """malwareState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param category: Provider-generated malware category (for example, trojan, ransomware, etc.).
    :type category: str
    :param family: Provider-generated malware family (for example, 'wannacry', 'notpetya', etc.).
    :type family: str
    :param name: Provider-generated malware variant name (for example, Trojan:Win32/Powessere.H).
    :type name: str
    :param severity: Provider-determined severity of this malware.
    :type severity: str
    :param was_running: Indicates whether the detected file (malware/vulnerability) was running at
     the time of detection or was detected at rest on the disk.
    :type was_running: bool
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'category': {'key': 'category', 'type': 'str'},
        'family': {'key': 'family', 'type': 'str'},
        'name': {'key': 'name', 'type': 'str'},
        'severity': {'key': 'severity', 'type': 'str'},
        'was_running': {'key': 'wasRunning', 'type': 'bool'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphMalwareState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.category = kwargs.get('category', None)
        self.family = kwargs.get('family', None)
        self.name = kwargs.get('name', None)
        self.severity = kwargs.get('severity', None)
        self.was_running = kwargs.get('was_running', None)


class MicrosoftGraphNetworkConnection(msrest.serialization.Model):
    """networkConnection.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param application_name: Name of the application managing the network connection (for example,
     Facebook or SMTP).
    :type application_name: str
    :param destination_address: Destination IP address (of the network connection).
    :type destination_address: str
    :param destination_domain: Destination domain portion of the destination URL. (for example
     'www.contoso.com').
    :type destination_domain: str
    :param destination_location: Location (by IP address mapping) associated with the destination
     of a network connection.
    :type destination_location: str
    :param destination_port: Destination port (of the network connection).
    :type destination_port: str
    :param destination_url: Network connection URL/URI string - excluding parameters. (for example
     'www.contoso.com/products/default.html').
    :type destination_url: str
    :param direction:  Possible values include: "unknown", "inbound", "outbound",
     "unknownFutureValue".
    :type direction: str or ~security.models.MicrosoftGraphConnectionDirection
    :param domain_registered_date_time: Date when the destination domain was registered. The
     Timestamp type represents date and time information using ISO 8601 format and is always in UTC
     time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type domain_registered_date_time: ~datetime.datetime
    :param local_dns_name: The local DNS name resolution as it appears in the host's local DNS
     cache (for example, in case the 'hosts' file was tampered with).
    :type local_dns_name: str
    :param nat_destination_address: Network Address Translation destination IP address.
    :type nat_destination_address: str
    :param nat_destination_port: Network Address Translation destination port.
    :type nat_destination_port: str
    :param nat_source_address: Network Address Translation source IP address.
    :type nat_source_address: str
    :param nat_source_port: Network Address Translation source port.
    :type nat_source_port: str
    :param protocol:  Possible values include: "ip", "icmp", "unknown", "igmp", "ggp", "ipv4",
     "tcp", "pup", "udp", "idp", "ipv6", "ipv6RoutingHeader", "ipv6FragmentHeader",
     "ipSecEncapsulatingSecurityPayload", "ipSecAuthenticationHeader", "icmpV6", "ipv6NoNextHeader",
     "ipv6DestinationOptions", "nd", "raw", "ipx", "spx", "spxII", "unknownFutureValue".
    :type protocol: str or ~security.models.MicrosoftGraphSecurityNetworkProtocol
    :param risk_score: Provider generated/calculated risk score of the network connection.
     Recommended value range of 0-1, which equates to a percentage.
    :type risk_score: str
    :param source_address: Source (i.e. origin) IP address (of the network connection).
    :type source_address: str
    :param source_location: Location (by IP address mapping) associated with the source of a
     network connection.
    :type source_location: str
    :param source_port: Source (i.e. origin) IP port (of the network connection).
    :type source_port: str
    :param status:  Possible values include: "unknown", "attempted", "succeeded", "blocked",
     "failed", "unknownFutureValue".
    :type status: str or ~security.models.MicrosoftGraphConnectionStatus
    :param url_parameters: Parameters (suffix) of the destination URL.
    :type url_parameters: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'application_name': {'key': 'applicationName', 'type': 'str'},
        'destination_address': {'key': 'destinationAddress', 'type': 'str'},
        'destination_domain': {'key': 'destinationDomain', 'type': 'str'},
        'destination_location': {'key': 'destinationLocation', 'type': 'str'},
        'destination_port': {'key': 'destinationPort', 'type': 'str'},
        'destination_url': {'key': 'destinationUrl', 'type': 'str'},
        'direction': {'key': 'direction', 'type': 'str'},
        'domain_registered_date_time': {'key': 'domainRegisteredDateTime', 'type': 'iso-8601'},
        'local_dns_name': {'key': 'localDnsName', 'type': 'str'},
        'nat_destination_address': {'key': 'natDestinationAddress', 'type': 'str'},
        'nat_destination_port': {'key': 'natDestinationPort', 'type': 'str'},
        'nat_source_address': {'key': 'natSourceAddress', 'type': 'str'},
        'nat_source_port': {'key': 'natSourcePort', 'type': 'str'},
        'protocol': {'key': 'protocol', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
        'source_address': {'key': 'sourceAddress', 'type': 'str'},
        'source_location': {'key': 'sourceLocation', 'type': 'str'},
        'source_port': {'key': 'sourcePort', 'type': 'str'},
        'status': {'key': 'status', 'type': 'str'},
        'url_parameters': {'key': 'urlParameters', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphNetworkConnection, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.application_name = kwargs.get('application_name', None)
        self.destination_address = kwargs.get('destination_address', None)
        self.destination_domain = kwargs.get('destination_domain', None)
        self.destination_location = kwargs.get('destination_location', None)
        self.destination_port = kwargs.get('destination_port', None)
        self.destination_url = kwargs.get('destination_url', None)
        self.direction = kwargs.get('direction', None)
        self.domain_registered_date_time = kwargs.get('domain_registered_date_time', None)
        self.local_dns_name = kwargs.get('local_dns_name', None)
        self.nat_destination_address = kwargs.get('nat_destination_address', None)
        self.nat_destination_port = kwargs.get('nat_destination_port', None)
        self.nat_source_address = kwargs.get('nat_source_address', None)
        self.nat_source_port = kwargs.get('nat_source_port', None)
        self.protocol = kwargs.get('protocol', None)
        self.risk_score = kwargs.get('risk_score', None)
        self.source_address = kwargs.get('source_address', None)
        self.source_location = kwargs.get('source_location', None)
        self.source_port = kwargs.get('source_port', None)
        self.status = kwargs.get('status', None)
        self.url_parameters = kwargs.get('url_parameters', None)


class MicrosoftGraphProcess(msrest.serialization.Model):
    """process.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param account_name: User account identifier (user account context the process ran under) for
     example, AccountName, SID, and so on.
    :type account_name: str
    :param command_line: The full process invocation commandline including all parameters.
    :type command_line: str
    :param created_date_time: Time at which the process was started. The Timestamp type represents
     date and time information using ISO 8601 format and is always in UTC time. For example,
     midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type created_date_time: ~datetime.datetime
    :param file_hash: fileHash.
    :type file_hash: ~security.models.MicrosoftGraphFileHash
    :param integrity_level:  Possible values include: "unknown", "untrusted", "low", "medium",
     "high", "system", "unknownFutureValue".
    :type integrity_level: str or ~security.models.MicrosoftGraphProcessIntegrityLevel
    :param is_elevated: True if the process is elevated.
    :type is_elevated: bool
    :param name: The name of the process' Image file.
    :type name: str
    :param parent_process_created_date_time: DateTime at which the parent process was started. The
     Timestamp type represents date and time information using ISO 8601 format and is always in UTC
     time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type parent_process_created_date_time: ~datetime.datetime
    :param parent_process_id: The Process ID (PID) of the parent process.
    :type parent_process_id: int
    :param parent_process_name: The name of the image file of the parent process.
    :type parent_process_name: str
    :param path: Full path, including filename.
    :type path: str
    :param process_id: The Process ID (PID) of the process.
    :type process_id: int
    """

    _validation = {
        'parent_process_id': {'maximum': 2147483647, 'minimum': -2147483648},
        'process_id': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'account_name': {'key': 'accountName', 'type': 'str'},
        'command_line': {'key': 'commandLine', 'type': 'str'},
        'created_date_time': {'key': 'createdDateTime', 'type': 'iso-8601'},
        'file_hash': {'key': 'fileHash', 'type': 'MicrosoftGraphFileHash'},
        'integrity_level': {'key': 'integrityLevel', 'type': 'str'},
        'is_elevated': {'key': 'isElevated', 'type': 'bool'},
        'name': {'key': 'name', 'type': 'str'},
        'parent_process_created_date_time': {'key': 'parentProcessCreatedDateTime', 'type': 'iso-8601'},
        'parent_process_id': {'key': 'parentProcessId', 'type': 'int'},
        'parent_process_name': {'key': 'parentProcessName', 'type': 'str'},
        'path': {'key': 'path', 'type': 'str'},
        'process_id': {'key': 'processId', 'type': 'int'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphProcess, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.account_name = kwargs.get('account_name', None)
        self.command_line = kwargs.get('command_line', None)
        self.created_date_time = kwargs.get('created_date_time', None)
        self.file_hash = kwargs.get('file_hash', None)
        self.integrity_level = kwargs.get('integrity_level', None)
        self.is_elevated = kwargs.get('is_elevated', None)
        self.name = kwargs.get('name', None)
        self.parent_process_created_date_time = kwargs.get('parent_process_created_date_time', None)
        self.parent_process_id = kwargs.get('parent_process_id', None)
        self.parent_process_name = kwargs.get('parent_process_name', None)
        self.path = kwargs.get('path', None)
        self.process_id = kwargs.get('process_id', None)


class MicrosoftGraphRegistryKeyState(msrest.serialization.Model):
    """registryKeyState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param hive:  Possible values include: "unknown", "currentConfig", "currentUser",
     "localMachineSam", "localMachineSecurity", "localMachineSoftware", "localMachineSystem",
     "usersDefault", "unknownFutureValue".
    :type hive: str or ~security.models.MicrosoftGraphRegistryHive
    :param key: Current (i.e. changed) registry key (excludes HIVE).
    :type key: str
    :param old_key: Previous (i.e. before changed) registry key (excludes HIVE).
    :type old_key: str
    :param old_value_data: Previous (i.e. before changed) registry key value data (contents).
    :type old_value_data: str
    :param old_value_name: Previous (i.e. before changed) registry key value name.
    :type old_value_name: str
    :param operation:  Possible values include: "unknown", "create", "modify", "delete",
     "unknownFutureValue".
    :type operation: str or ~security.models.MicrosoftGraphRegistryOperation
    :param process_id: Process ID (PID) of the process that modified the registry key (process
     details will appear in the alert 'processes' collection).
    :type process_id: int
    :param value_data: Current (i.e. changed) registry key value data (contents).
    :type value_data: str
    :param value_name: Current (i.e. changed) registry key value name.
    :type value_name: str
    :param value_type:  Possible values include: "unknown", "binary", "dword", "dwordLittleEndian",
     "dwordBigEndian", "expandSz", "link", "multiSz", "none", "qword", "qwordlittleEndian", "sz",
     "unknownFutureValue".
    :type value_type: str or ~security.models.MicrosoftGraphRegistryValueType
    """

    _validation = {
        'process_id': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'hive': {'key': 'hive', 'type': 'str'},
        'key': {'key': 'key', 'type': 'str'},
        'old_key': {'key': 'oldKey', 'type': 'str'},
        'old_value_data': {'key': 'oldValueData', 'type': 'str'},
        'old_value_name': {'key': 'oldValueName', 'type': 'str'},
        'operation': {'key': 'operation', 'type': 'str'},
        'process_id': {'key': 'processId', 'type': 'int'},
        'value_data': {'key': 'valueData', 'type': 'str'},
        'value_name': {'key': 'valueName', 'type': 'str'},
        'value_type': {'key': 'valueType', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphRegistryKeyState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.hive = kwargs.get('hive', None)
        self.key = kwargs.get('key', None)
        self.old_key = kwargs.get('old_key', None)
        self.old_value_data = kwargs.get('old_value_data', None)
        self.old_value_name = kwargs.get('old_value_name', None)
        self.operation = kwargs.get('operation', None)
        self.process_id = kwargs.get('process_id', None)
        self.value_data = kwargs.get('value_data', None)
        self.value_name = kwargs.get('value_name', None)
        self.value_type = kwargs.get('value_type', None)


class MicrosoftGraphSecureScore(MicrosoftGraphEntity):
    """secureScore.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param active_user_count: Active user count of the given tenant.
    :type active_user_count: int
    :param average_comparative_scores: Average score by different scopes (for example, average by
     industry, average by seating) and control category (Identity, Data, Device, Apps,
     Infrastructure) within the scope.
    :type average_comparative_scores: list[~security.models.MicrosoftGraphAverageComparativeScore]
    :param azure_tenant_id: GUID string for tenant ID.
    :type azure_tenant_id: str
    :param control_scores: Contains tenant scores for a set of controls.
    :type control_scores: list[~security.models.MicrosoftGraphControlScore]
    :param created_date_time: The date when the entity is created.
    :type created_date_time: ~datetime.datetime
    :param current_score: Tenant current attained score on specified date.
    :type current_score: float
    :param enabled_services: Microsoft-provided services for the tenant (for example, Exchange
     online, Skype, Sharepoint).
    :type enabled_services: list[str]
    :param licensed_user_count: Licensed user count of the given tenant.
    :type licensed_user_count: int
    :param max_score: Tenant maximum possible score on specified date.
    :type max_score: float
    :param vendor_information: securityVendorInformation.
    :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation
    """

    _validation = {
        'active_user_count': {'maximum': 2147483647, 'minimum': -2147483648},
        'licensed_user_count': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'active_user_count': {'key': 'activeUserCount', 'type': 'int'},
        'average_comparative_scores': {'key': 'averageComparativeScores', 'type': '[MicrosoftGraphAverageComparativeScore]'},
        'azure_tenant_id': {'key': 'azureTenantId', 'type': 'str'},
        'control_scores': {'key': 'controlScores', 'type': '[MicrosoftGraphControlScore]'},
        'created_date_time': {'key': 'createdDateTime', 'type': 'iso-8601'},
        'current_score': {'key': 'currentScore', 'type': 'float'},
        'enabled_services': {'key': 'enabledServices', 'type': '[str]'},
        'licensed_user_count': {'key': 'licensedUserCount', 'type': 'int'},
        'max_score': {'key': 'maxScore', 'type': 'float'},
        'vendor_information': {'key': 'vendorInformation', 'type': 'MicrosoftGraphSecurityVendorInformation'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecureScore, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.active_user_count = kwargs.get('active_user_count', None)
        self.average_comparative_scores = kwargs.get('average_comparative_scores', None)
        self.azure_tenant_id = kwargs.get('azure_tenant_id', None)
        self.control_scores = kwargs.get('control_scores', None)
        self.created_date_time = kwargs.get('created_date_time', None)
        self.current_score = kwargs.get('current_score', None)
        self.enabled_services = kwargs.get('enabled_services', None)
        self.licensed_user_count = kwargs.get('licensed_user_count', None)
        self.max_score = kwargs.get('max_score', None)
        self.vendor_information = kwargs.get('vendor_information', None)


class MicrosoftGraphSecureScoreControlProfile(MicrosoftGraphEntity):
    """secureScoreControlProfile.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param action_type: Control action type (Config, Review, Behavior).
    :type action_type: str
    :param action_url: URL to where the control can be actioned.
    :type action_url: str
    :param azure_tenant_id: GUID string for tenant ID.
    :type azure_tenant_id: str
    :param compliance_information:
    :type compliance_information: list[~security.models.MicrosoftGraphComplianceInformation]
    :param control_category: Control action category (Identity, Data, Device, Apps,
     Infrastructure).
    :type control_category: str
    :param control_state_updates:
    :type control_state_updates: list[~security.models.MicrosoftGraphSecureScoreControlStateUpdate]
    :param deprecated: Flag to indicate if a control is depreciated.
    :type deprecated: bool
    :param implementation_cost: Resource cost of implemmentating control (low, moderate, high).
    :type implementation_cost: str
    :param last_modified_date_time: Time at which the control profile entity was last modified. The
     Timestamp type represents date and time.
    :type last_modified_date_time: ~datetime.datetime
    :param max_score: max attainable score for the control.
    :type max_score: float
    :param rank: Microsoft's stack ranking of control.
    :type rank: int
    :param remediation: Description of what the control will help remediate.
    :type remediation: str
    :param remediation_impact: Description of the impact on users of the remediation.
    :type remediation_impact: str
    :param service: Service that owns the control (Exchange, Sharepoint, Azure AD).
    :type service: str
    :param threats: List of threats the control mitigates
     (accountBreach,dataDeletion,dataExfiltration,dataSpillage,.
    :type threats: list[str]
    :param tier:
    :type tier: str
    :param title: Title of the control.
    :type title: str
    :param user_impact:
    :type user_impact: str
    :param vendor_information: securityVendorInformation.
    :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation
    """

    _validation = {
        'rank': {'maximum': 2147483647, 'minimum': -2147483648},
    }

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'action_type': {'key': 'actionType', 'type': 'str'},
        'action_url': {'key': 'actionUrl', 'type': 'str'},
        'azure_tenant_id': {'key': 'azureTenantId', 'type': 'str'},
        'compliance_information': {'key': 'complianceInformation', 'type': '[MicrosoftGraphComplianceInformation]'},
        'control_category': {'key': 'controlCategory', 'type': 'str'},
        'control_state_updates': {'key': 'controlStateUpdates', 'type': '[MicrosoftGraphSecureScoreControlStateUpdate]'},
        'deprecated': {'key': 'deprecated', 'type': 'bool'},
        'implementation_cost': {'key': 'implementationCost', 'type': 'str'},
        'last_modified_date_time': {'key': 'lastModifiedDateTime', 'type': 'iso-8601'},
        'max_score': {'key': 'maxScore', 'type': 'float'},
        'rank': {'key': 'rank', 'type': 'int'},
        'remediation': {'key': 'remediation', 'type': 'str'},
        'remediation_impact': {'key': 'remediationImpact', 'type': 'str'},
        'service': {'key': 'service', 'type': 'str'},
        'threats': {'key': 'threats', 'type': '[str]'},
        'tier': {'key': 'tier', 'type': 'str'},
        'title': {'key': 'title', 'type': 'str'},
        'user_impact': {'key': 'userImpact', 'type': 'str'},
        'vendor_information': {'key': 'vendorInformation', 'type': 'MicrosoftGraphSecurityVendorInformation'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecureScoreControlProfile, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.action_type = kwargs.get('action_type', None)
        self.action_url = kwargs.get('action_url', None)
        self.azure_tenant_id = kwargs.get('azure_tenant_id', None)
        self.compliance_information = kwargs.get('compliance_information', None)
        self.control_category = kwargs.get('control_category', None)
        self.control_state_updates = kwargs.get('control_state_updates', None)
        self.deprecated = kwargs.get('deprecated', None)
        self.implementation_cost = kwargs.get('implementation_cost', None)
        self.last_modified_date_time = kwargs.get('last_modified_date_time', None)
        self.max_score = kwargs.get('max_score', None)
        self.rank = kwargs.get('rank', None)
        self.remediation = kwargs.get('remediation', None)
        self.remediation_impact = kwargs.get('remediation_impact', None)
        self.service = kwargs.get('service', None)
        self.threats = kwargs.get('threats', None)
        self.tier = kwargs.get('tier', None)
        self.title = kwargs.get('title', None)
        self.user_impact = kwargs.get('user_impact', None)
        self.vendor_information = kwargs.get('vendor_information', None)


class MicrosoftGraphSecureScoreControlStateUpdate(msrest.serialization.Model):
    """secureScoreControlStateUpdate.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param assigned_to: Assigns the control to the user who will take the action.
    :type assigned_to: str
    :param comment: Provides optional comment about the control.
    :type comment: str
    :param state: State of the control, which can be modified via a PATCH command (for example,
     ignored, thirdParty).
    :type state: str
    :param updated_by: ID of the user who updated tenant state.
    :type updated_by: str
    :param updated_date_time: Time at which the control state was updated.
    :type updated_date_time: ~datetime.datetime
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'assigned_to': {'key': 'assignedTo', 'type': 'str'},
        'comment': {'key': 'comment', 'type': 'str'},
        'state': {'key': 'state', 'type': 'str'},
        'updated_by': {'key': 'updatedBy', 'type': 'str'},
        'updated_date_time': {'key': 'updatedDateTime', 'type': 'iso-8601'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecureScoreControlStateUpdate, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.assigned_to = kwargs.get('assigned_to', None)
        self.comment = kwargs.get('comment', None)
        self.state = kwargs.get('state', None)
        self.updated_by = kwargs.get('updated_by', None)
        self.updated_date_time = kwargs.get('updated_date_time', None)


class MicrosoftGraphSecurity(MicrosoftGraphEntity):
    """security.

    :param id: Read-only.
    :type id: str
    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param alerts: Read-only. Nullable.
    :type alerts: list[~security.models.MicrosoftGraphAlert]
    :param secure_score_control_profiles:
    :type secure_score_control_profiles:
     list[~security.models.MicrosoftGraphSecureScoreControlProfile]
    :param secure_scores:
    :type secure_scores: list[~security.models.MicrosoftGraphSecureScore]
    """

    _attribute_map = {
        'id': {'key': 'id', 'type': 'str'},
        'additional_properties': {'key': '', 'type': '{object}'},
        'alerts': {'key': 'alerts', 'type': '[MicrosoftGraphAlert]'},
        'secure_score_control_profiles': {'key': 'secureScoreControlProfiles', 'type': '[MicrosoftGraphSecureScoreControlProfile]'},
        'secure_scores': {'key': 'secureScores', 'type': '[MicrosoftGraphSecureScore]'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecurity, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.alerts = kwargs.get('alerts', None)
        self.secure_score_control_profiles = kwargs.get('secure_score_control_profiles', None)
        self.secure_scores = kwargs.get('secure_scores', None)


class MicrosoftGraphSecurityResource(msrest.serialization.Model):
    """securityResource.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param resource: Name of the resource that is related to current alert. Required.
    :type resource: str
    :param resource_type:  Possible values include: "unknown", "attacked", "related",
     "unknownFutureValue".
    :type resource_type: str or ~security.models.MicrosoftGraphSecurityResourceType
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'resource': {'key': 'resource', 'type': 'str'},
        'resource_type': {'key': 'resourceType', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecurityResource, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.resource = kwargs.get('resource', None)
        self.resource_type = kwargs.get('resource_type', None)


class MicrosoftGraphSecurityVendorInformation(msrest.serialization.Model):
    """securityVendorInformation.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param provider: Specific provider (product/service - not vendor company); for example,
     WindowsDefenderATP.
    :type provider: str
    :param provider_version: Version of the provider or subprovider, if it exists, that generated
     the alert. Required.
    :type provider_version: str
    :param sub_provider: Specific subprovider (under aggregating provider); for example,
     WindowsDefenderATP.SmartScreen.
    :type sub_provider: str
    :param vendor: Name of the alert vendor (for example, Microsoft, Dell, FireEye). Required.
    :type vendor: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'provider': {'key': 'provider', 'type': 'str'},
        'provider_version': {'key': 'providerVersion', 'type': 'str'},
        'sub_provider': {'key': 'subProvider', 'type': 'str'},
        'vendor': {'key': 'vendor', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphSecurityVendorInformation, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.provider = kwargs.get('provider', None)
        self.provider_version = kwargs.get('provider_version', None)
        self.sub_provider = kwargs.get('sub_provider', None)
        self.vendor = kwargs.get('vendor', None)


class MicrosoftGraphUserSecurityState(msrest.serialization.Model):
    """userSecurityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param aad_user_id: AAD User object identifier (GUID) - represents the physical/multi-account
     user entity.
    :type aad_user_id: str
    :param account_name: Account name of user account (without Active Directory domain or DNS
     domain) - (also called mailNickName).
    :type account_name: str
    :param domain_name: NetBIOS/Active Directory domain of user account (that is, domain/account
     format).
    :type domain_name: str
    :param email_role:  Possible values include: "unknown", "sender", "recipient",
     "unknownFutureValue".
    :type email_role: str or ~security.models.MicrosoftGraphEmailRole
    :param is_vpn: Indicates whether the user logged on through a VPN.
    :type is_vpn: bool
    :param logon_date_time: Time at which the sign-in occurred. The Timestamp type represents date
     and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC
     on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.
    :type logon_date_time: ~datetime.datetime
    :param logon_id: User sign-in ID.
    :type logon_id: str
    :param logon_ip: IP Address the sign-in request originated from.
    :type logon_ip: str
    :param logon_location: Location (by IP address mapping) associated with a user sign-in event by
     this user.
    :type logon_location: str
    :param logon_type:  Possible values include: "unknown", "interactive", "remoteInteractive",
     "network", "batch", "service", "unknownFutureValue".
    :type logon_type: str or ~security.models.MicrosoftGraphLogonType
    :param on_premises_security_identifier: Active Directory (on-premises) Security Identifier
     (SID) of the user.
    :type on_premises_security_identifier: str
    :param risk_score: Provider-generated/calculated risk score of the user account. Recommended
     value range of 0-1, which equates to a percentage.
    :type risk_score: str
    :param user_account_type:  Possible values include: "unknown", "standard", "power",
     "administrator", "unknownFutureValue".
    :type user_account_type: str or ~security.models.MicrosoftGraphUserAccountSecurityType
    :param user_principal_name: User sign-in name - internet format: (user account name)@(user
     account DNS domain name).
    :type user_principal_name: str
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'aad_user_id': {'key': 'aadUserId', 'type': 'str'},
        'account_name': {'key': 'accountName', 'type': 'str'},
        'domain_name': {'key': 'domainName', 'type': 'str'},
        'email_role': {'key': 'emailRole', 'type': 'str'},
        'is_vpn': {'key': 'isVpn', 'type': 'bool'},
        'logon_date_time': {'key': 'logonDateTime', 'type': 'iso-8601'},
        'logon_id': {'key': 'logonId', 'type': 'str'},
        'logon_ip': {'key': 'logonIp', 'type': 'str'},
        'logon_location': {'key': 'logonLocation', 'type': 'str'},
        'logon_type': {'key': 'logonType', 'type': 'str'},
        'on_premises_security_identifier': {'key': 'onPremisesSecurityIdentifier', 'type': 'str'},
        'risk_score': {'key': 'riskScore', 'type': 'str'},
        'user_account_type': {'key': 'userAccountType', 'type': 'str'},
        'user_principal_name': {'key': 'userPrincipalName', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphUserSecurityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.aad_user_id = kwargs.get('aad_user_id', None)
        self.account_name = kwargs.get('account_name', None)
        self.domain_name = kwargs.get('domain_name', None)
        self.email_role = kwargs.get('email_role', None)
        self.is_vpn = kwargs.get('is_vpn', None)
        self.logon_date_time = kwargs.get('logon_date_time', None)
        self.logon_id = kwargs.get('logon_id', None)
        self.logon_ip = kwargs.get('logon_ip', None)
        self.logon_location = kwargs.get('logon_location', None)
        self.logon_type = kwargs.get('logon_type', None)
        self.on_premises_security_identifier = kwargs.get('on_premises_security_identifier', None)
        self.risk_score = kwargs.get('risk_score', None)
        self.user_account_type = kwargs.get('user_account_type', None)
        self.user_principal_name = kwargs.get('user_principal_name', None)


class MicrosoftGraphVulnerabilityState(msrest.serialization.Model):
    """vulnerabilityState.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param cve: Common Vulnerabilities and Exposures (CVE) for the vulnerability.
    :type cve: str
    :param severity: Base Common Vulnerability Scoring System (CVSS) severity score for this
     vulnerability.
    :type severity: str
    :param was_running: Indicates whether the detected vulnerability (file) was running at the time
     of detection or was the file detected at rest on the disk.
    :type was_running: bool
    """

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'cve': {'key': 'cve', 'type': 'str'},
        'severity': {'key': 'severity', 'type': 'str'},
        'was_running': {'key': 'wasRunning', 'type': 'bool'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(MicrosoftGraphVulnerabilityState, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.cve = kwargs.get('cve', None)
        self.severity = kwargs.get('severity', None)
        self.was_running = kwargs.get('was_running', None)


class OdataError(msrest.serialization.Model):
    """OdataError.

    All required parameters must be populated in order to send to Azure.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param error: Required.
    :type error: ~security.models.OdataErrorMain
    """

    _validation = {
        'error': {'required': True},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'error': {'key': 'error', 'type': 'OdataErrorMain'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(OdataError, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.error = kwargs['error']


class OdataErrorDetail(msrest.serialization.Model):
    """OdataErrorDetail.

    All required parameters must be populated in order to send to Azure.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param code: Required.
    :type code: str
    :param message: Required.
    :type message: str
    :param target:
    :type target: str
    """

    _validation = {
        'code': {'required': True},
        'message': {'required': True},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'code': {'key': 'code', 'type': 'str'},
        'message': {'key': 'message', 'type': 'str'},
        'target': {'key': 'target', 'type': 'str'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(OdataErrorDetail, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.code = kwargs['code']
        self.message = kwargs['message']
        self.target = kwargs.get('target', None)


class OdataErrorMain(msrest.serialization.Model):
    """OdataErrorMain.

    All required parameters must be populated in order to send to Azure.

    :param additional_properties: Unmatched properties from the message are deserialized to this
     collection.
    :type additional_properties: dict[str, object]
    :param code: Required.
    :type code: str
    :param message: Required.
    :type message: str
    :param target:
    :type target: str
    :param details:
    :type details: list[~security.models.OdataErrorDetail]
    :param innererror: The structure of this object is service-specific.
    :type innererror: dict[str, object]
    """

    _validation = {
        'code': {'required': True},
        'message': {'required': True},
    }

    _attribute_map = {
        'additional_properties': {'key': '', 'type': '{object}'},
        'code': {'key': 'code', 'type': 'str'},
        'message': {'key': 'message', 'type': 'str'},
        'target': {'key': 'target', 'type': 'str'},
        'details': {'key': 'details', 'type': '[OdataErrorDetail]'},
        'innererror': {'key': 'innererror', 'type': '{object}'},
    }

    def __init__(
        self,
        **kwargs
    ):
        super(OdataErrorMain, self).__init__(**kwargs)
        self.additional_properties = kwargs.get('additional_properties', None)
        self.code = kwargs['code']
        self.message = kwargs['message']
        self.target = kwargs.get('target', None)
        self.details = kwargs.get('details', None)
        self.innererror = kwargs.get('innererror', None)

# coding=utf-8 # -------------------------------------------------------------------------- # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the MIT License. See License.txt in the project root for license information. # Code generated by Microsoft (R) AutoRest Code Generator. # Changes may cause incorrect behavior and will be lost if the code is regenerated. # -------------------------------------------------------------------------- Collection of alert.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param value:     :type value: list[~security.models.MicrosoftGraphAlert]     :param odata_next_link:     :type odata_next_link: str Collection of secureScore.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param value:     :type value: list[~security.models.MicrosoftGraphSecureScore]     :param odata_next_link:     :type odata_next_link: str Collection of secureScoreControlProfile.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param value:     :type value: list[~security.models.MicrosoftGraphSecureScoreControlProfile]     :param odata_next_link:     :type odata_next_link: str entity.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param id: Read-only.     :type id: str alert.      :param id: Read-only.     :type id: str     :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param activity_group_name: Name or alias of the activity group (attacker) this alert is      attributed to.     :type activity_group_name: str     :param assigned_to: Name of the analyst the alert is assigned to for triage, investigation, or      remediation (supports update).     :type assigned_to: str     :param azure_subscription_id: Azure subscription ID, present if this alert is related to an      Azure resource.     :type azure_subscription_id: str     :param azure_tenant_id: Azure Active Directory tenant ID. Required.     :type azure_tenant_id: str     :param category: Category of the alert (for example, credentialTheft, ransomware, etc.).     :type category: str     :param closed_date_time: Time at which the alert was closed. The Timestamp type represents date      and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC      on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z' (supports update).     :type closed_date_time: ~datetime.datetime     :param cloud_app_states: Security-related stateful information generated by the provider about      the cloud application/s related to this alert.     :type cloud_app_states: list[~security.models.MicrosoftGraphCloudAppSecurityState]     :param comments: Customer-provided comments on alert (for customer alert management) (supports      update).     :type comments: list[str]     :param confidence: Confidence of the detection logic (percentage between 1-100).     :type confidence: int     :param created_date_time: Time at which the alert was created by the alert provider. The      Timestamp type represents date and time information using ISO 8601 format and is always in UTC      time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.      Required.     :type created_date_time: ~datetime.datetime     :param description: Alert description.     :type description: str     :param detection_ids: Set of alerts related to this alert entity (each alert is pushed to the      SIEM as a separate record).     :type detection_ids: list[str]     :param event_date_time: Time at which the event(s) that served as the trigger(s) to generate      the alert occurred. The Timestamp type represents date and time information using ISO 8601      format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like      this: '2014-01-01T00:00:00Z'. Required.     :type event_date_time: ~datetime.datetime     :param feedback:  Possible values include: "unknown", "truePositive", "falsePositive",      "benignPositive", "unknownFutureValue".     :type feedback: str or ~security.models.MicrosoftGraphAlertFeedback     :param file_states: Security-related stateful information generated by the provider about the      file(s) related to this alert.     :type file_states: list[~security.models.MicrosoftGraphFileSecurityState]     :param history_states:     :type history_states: list[~security.models.MicrosoftGraphAlertHistoryState]     :param host_states: Security-related stateful information generated by the provider about the      host(s) related to this alert.     :type host_states: list[~security.models.MicrosoftGraphHostSecurityState]     :param incident_ids: IDs of incidents related to current alert.     :type incident_ids: list[str]     :param last_modified_date_time: Time at which the alert entity was last modified. The Timestamp      type represents date and time information using ISO 8601 format and is always in UTC time. For      example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.     :type last_modified_date_time: ~datetime.datetime     :param malware_states: Threat Intelligence pertaining to malware related to this alert.     :type malware_states: list[~security.models.MicrosoftGraphMalwareState]     :param network_connections: Security-related stateful information generated by the provider      about the network connection(s) related to this alert.     :type network_connections: list[~security.models.MicrosoftGraphNetworkConnection]     :param processes: Security-related stateful information generated by the provider about the      process or processes related to this alert.     :type processes: list[~security.models.MicrosoftGraphProcess]     :param recommended_actions: Vendor/provider recommended action(s) to take as a result of the      alert (for example, isolate machine, enforce2FA, reimage host).     :type recommended_actions: list[str]     :param registry_key_states: Security-related stateful information generated by the provider      about the registry keys related to this alert.     :type registry_key_states: list[~security.models.MicrosoftGraphRegistryKeyState]     :param security_resources: Resources related to current alert. For example, for some alerts      this can have the Azure Resource value.     :type security_resources: list[~security.models.MicrosoftGraphSecurityResource]     :param severity:  Possible values include: "unknown", "informational", "low", "medium", "high",      "unknownFutureValue".     :type severity: str or ~security.models.MicrosoftGraphAlertSeverity     :param source_materials: Hyperlinks (URIs) to the source material related to the alert, for      example, provider's user interface for alerts or log search, etc.     :type source_materials: list[str]     :param status:  Possible values include: "unknown", "newAlert", "inProgress", "resolved",      "dismissed", "unknownFutureValue".     :type status: str or ~security.models.MicrosoftGraphAlertStatus     :param tags: A set of tags. User-definable labels that can be applied to an alert and can serve      as filter conditions (for example 'HVA', 'SAW', etc.) (supports update).     :type tags: list[str]     :param title: Alert title. Required.     :type title: str     :param triggers: Security-related information about the specific properties that triggered the      alert (properties appearing in the alert). Alerts might contain information about multiple      users, hosts, files, ip addresses. This field indicates which properties triggered the alert      generation.     :type triggers: list[~security.models.MicrosoftGraphAlertTrigger]     :param user_states: Security-related stateful information generated by the provider about the      user accounts related to this alert.     :type user_states: list[~security.models.MicrosoftGraphUserSecurityState]     :param vendor_information: securityVendorInformation.     :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation     :param vulnerability_states: Threat intelligence pertaining to one or more vulnerabilities      related to this alert.     :type vulnerability_states: list[~security.models.MicrosoftGraphVulnerabilityState] alertHistoryState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param app_id:     :type app_id: str     :param assigned_to:     :type assigned_to: str     :param comments:     :type comments: list[str]     :param feedback:  Possible values include: "unknown", "truePositive", "falsePositive",      "benignPositive", "unknownFutureValue".     :type feedback: str or ~security.models.MicrosoftGraphAlertFeedback     :param status:  Possible values include: "unknown", "newAlert", "inProgress", "resolved",      "dismissed", "unknownFutureValue".     :type status: str or ~security.models.MicrosoftGraphAlertStatus     :param updated_date_time:     :type updated_date_time: ~datetime.datetime     :param user:     :type user: str alertTrigger.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param name: Name of the property serving as a detection trigger.     :type name: str     :param type: Type of the property in the key:value pair for interpretation. For example,      String, Boolean, etc.     :type type: str     :param value: Value of the property serving as a detection trigger.     :type value: str averageComparativeScore.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param average_score: Average score within specified basis.     :type average_score: float     :param basis: Scope type. The possible values are: AllTenants, TotalSeats, IndustryTypes.     :type basis: str certificationControl.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param name: Certification control name.     :type name: str     :param url: URL for the Microsoft Service Trust Portal.     :type url: str cloudAppSecurityState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param destination_service_ip: Destination IP Address of the connection to the cloud      application/service.     :type destination_service_ip: str     :param destination_service_name: Cloud application/service name (for example 'Salesforce',      'DropBox', etc.).     :type destination_service_name: str     :param risk_score: Provider-generated/calculated risk score of the Cloud Application/Service.      Recommended value range of 0-1, which equates to a percentage.     :type risk_score: str complianceInformation.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param certification_controls: Collection of the certification controls associated with      certification.     :type certification_controls: list[~security.models.MicrosoftGraphCertificationControl]     :param certification_name: Compliance certification name (for example, ISO 27018:2014, GDPR,      FedRAMP, NIST 800-171).     :type certification_name: str controlScore.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param control_category: Control action category (Identity, Data, Device, Apps,      Infrastructure).     :type control_category: str     :param control_name: Control unique name.     :type control_name: str     :param description: Description of the control.     :type description: str     :param score: Tenant achieved score for the control (it varies day by day depending on tenant      operations on the control).     :type score: float fileHash.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param hash_type:  Possible values include: "unknown", "sha1", "sha256", "md5",      "authenticodeHash256", "lsHash", "ctph", "unknownFutureValue".     :type hash_type: str or ~security.models.MicrosoftGraphFileHashType     :param hash_value: Value of the file hash.     :type hash_value: str fileSecurityState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param file_hash: fileHash.     :type file_hash: ~security.models.MicrosoftGraphFileHash     :param name: File name (without path).     :type name: str     :param path: Full file path of the file/imageFile.     :type path: str     :param risk_score: Provider generated/calculated risk score of the alert file. Recommended      value range of 0-1, which equates to a percentage.     :type risk_score: str hostSecurityState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param fqdn: Host FQDN (Fully Qualified Domain Name) (for example, machine.company.com).     :type fqdn: str     :param is_azure_ad_joined:     :type is_azure_ad_joined: bool     :param is_azure_ad_registered:     :type is_azure_ad_registered: bool     :param is_hybrid_azure_domain_joined: True if the host is domain joined to an on-premises      Active Directory domain.     :type is_hybrid_azure_domain_joined: bool     :param net_bios_name: The local host name, without the DNS domain name.     :type net_bios_name: str     :param os: Host Operating System. (For example, Windows10, MacOS, RHEL, etc.).     :type os: str     :param private_ip_address: Private (not routable) IPv4 or IPv6 address (see RFC 1918) at the      time of the alert.     :type private_ip_address: str     :param public_ip_address: Publicly routable IPv4 or IPv6 address (see RFC 1918) at time of the      alert.     :type public_ip_address: str     :param risk_score: Provider-generated/calculated risk score of the host.  Recommended value      range of 0-1, which equates to a percentage.     :type risk_score: str malwareState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param category: Provider-generated malware category (for example, trojan, ransomware, etc.).     :type category: str     :param family: Provider-generated malware family (for example, 'wannacry', 'notpetya', etc.).     :type family: str     :param name: Provider-generated malware variant name (for example, Trojan:Win32/Powessere.H).     :type name: str     :param severity: Provider-determined severity of this malware.     :type severity: str     :param was_running: Indicates whether the detected file (malware/vulnerability) was running at      the time of detection or was detected at rest on the disk.     :type was_running: bool networkConnection.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param application_name: Name of the application managing the network connection (for example,      Facebook or SMTP).     :type application_name: str     :param destination_address: Destination IP address (of the network connection).     :type destination_address: str     :param destination_domain: Destination domain portion of the destination URL. (for example      'www.contoso.com').     :type destination_domain: str     :param destination_location: Location (by IP address mapping) associated with the destination      of a network connection.     :type destination_location: str     :param destination_port: Destination port (of the network connection).     :type destination_port: str     :param destination_url: Network connection URL/URI string - excluding parameters. (for example      'www.contoso.com/products/default.html').     :type destination_url: str     :param direction:  Possible values include: "unknown", "inbound", "outbound",      "unknownFutureValue".     :type direction: str or ~security.models.MicrosoftGraphConnectionDirection     :param domain_registered_date_time: Date when the destination domain was registered. The      Timestamp type represents date and time information using ISO 8601 format and is always in UTC      time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.     :type domain_registered_date_time: ~datetime.datetime     :param local_dns_name: The local DNS name resolution as it appears in the host's local DNS      cache (for example, in case the 'hosts' file was tampered with).     :type local_dns_name: str     :param nat_destination_address: Network Address Translation destination IP address.     :type nat_destination_address: str     :param nat_destination_port: Network Address Translation destination port.     :type nat_destination_port: str     :param nat_source_address: Network Address Translation source IP address.     :type nat_source_address: str     :param nat_source_port: Network Address Translation source port.     :type nat_source_port: str     :param protocol:  Possible values include: "ip", "icmp", "unknown", "igmp", "ggp", "ipv4",      "tcp", "pup", "udp", "idp", "ipv6", "ipv6RoutingHeader", "ipv6FragmentHeader",      "ipSecEncapsulatingSecurityPayload", "ipSecAuthenticationHeader", "icmpV6", "ipv6NoNextHeader",      "ipv6DestinationOptions", "nd", "raw", "ipx", "spx", "spxII", "unknownFutureValue".     :type protocol: str or ~security.models.MicrosoftGraphSecurityNetworkProtocol     :param risk_score: Provider generated/calculated risk score of the network connection.      Recommended value range of 0-1, which equates to a percentage.     :type risk_score: str     :param source_address: Source (i.e. origin) IP address (of the network connection).     :type source_address: str     :param source_location: Location (by IP address mapping) associated with the source of a      network connection.     :type source_location: str     :param source_port: Source (i.e. origin) IP port (of the network connection).     :type source_port: str     :param status:  Possible values include: "unknown", "attempted", "succeeded", "blocked",      "failed", "unknownFutureValue".     :type status: str or ~security.models.MicrosoftGraphConnectionStatus     :param url_parameters: Parameters (suffix) of the destination URL.     :type url_parameters: str process.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param account_name: User account identifier (user account context the process ran under) for      example, AccountName, SID, and so on.     :type account_name: str     :param command_line: The full process invocation commandline including all parameters.     :type command_line: str     :param created_date_time: Time at which the process was started. The Timestamp type represents      date and time information using ISO 8601 format and is always in UTC time. For example,      midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.     :type created_date_time: ~datetime.datetime     :param file_hash: fileHash.     :type file_hash: ~security.models.MicrosoftGraphFileHash     :param integrity_level:  Possible values include: "unknown", "untrusted", "low", "medium",      "high", "system", "unknownFutureValue".     :type integrity_level: str or ~security.models.MicrosoftGraphProcessIntegrityLevel     :param is_elevated: True if the process is elevated.     :type is_elevated: bool     :param name: The name of the process' Image file.     :type name: str     :param parent_process_created_date_time: DateTime at which the parent process was started. The      Timestamp type represents date and time information using ISO 8601 format and is always in UTC      time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.     :type parent_process_created_date_time: ~datetime.datetime     :param parent_process_id: The Process ID (PID) of the parent process.     :type parent_process_id: int     :param parent_process_name: The name of the image file of the parent process.     :type parent_process_name: str     :param path: Full path, including filename.     :type path: str     :param process_id: The Process ID (PID) of the process.     :type process_id: int registryKeyState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param hive:  Possible values include: "unknown", "currentConfig", "currentUser",      "localMachineSam", "localMachineSecurity", "localMachineSoftware", "localMachineSystem",      "usersDefault", "unknownFutureValue".     :type hive: str or ~security.models.MicrosoftGraphRegistryHive     :param key: Current (i.e. changed) registry key (excludes HIVE).     :type key: str     :param old_key: Previous (i.e. before changed) registry key (excludes HIVE).     :type old_key: str     :param old_value_data: Previous (i.e. before changed) registry key value data (contents).     :type old_value_data: str     :param old_value_name: Previous (i.e. before changed) registry key value name.     :type old_value_name: str     :param operation:  Possible values include: "unknown", "create", "modify", "delete",      "unknownFutureValue".     :type operation: str or ~security.models.MicrosoftGraphRegistryOperation     :param process_id: Process ID (PID) of the process that modified the registry key (process      details will appear in the alert 'processes' collection).     :type process_id: int     :param value_data: Current (i.e. changed) registry key value data (contents).     :type value_data: str     :param value_name: Current (i.e. changed) registry key value name.     :type value_name: str     :param value_type:  Possible values include: "unknown", "binary", "dword", "dwordLittleEndian",      "dwordBigEndian", "expandSz", "link", "multiSz", "none", "qword", "qwordlittleEndian", "sz",      "unknownFutureValue".     :type value_type: str or ~security.models.MicrosoftGraphRegistryValueType secureScore.      :param id: Read-only.     :type id: str     :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param active_user_count: Active user count of the given tenant.     :type active_user_count: int     :param average_comparative_scores: Average score by different scopes (for example, average by      industry, average by seating) and control category (Identity, Data, Device, Apps,      Infrastructure) within the scope.     :type average_comparative_scores: list[~security.models.MicrosoftGraphAverageComparativeScore]     :param azure_tenant_id: GUID string for tenant ID.     :type azure_tenant_id: str     :param control_scores: Contains tenant scores for a set of controls.     :type control_scores: list[~security.models.MicrosoftGraphControlScore]     :param created_date_time: The date when the entity is created.     :type created_date_time: ~datetime.datetime     :param current_score: Tenant current attained score on specified date.     :type current_score: float     :param enabled_services: Microsoft-provided services for the tenant (for example, Exchange      online, Skype, Sharepoint).     :type enabled_services: list[str]     :param licensed_user_count: Licensed user count of the given tenant.     :type licensed_user_count: int     :param max_score: Tenant maximum possible score on specified date.     :type max_score: float     :param vendor_information: securityVendorInformation.     :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation secureScoreControlProfile.      :param id: Read-only.     :type id: str     :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param action_type: Control action type (Config, Review, Behavior).     :type action_type: str     :param action_url: URL to where the control can be actioned.     :type action_url: str     :param azure_tenant_id: GUID string for tenant ID.     :type azure_tenant_id: str     :param compliance_information:     :type compliance_information: list[~security.models.MicrosoftGraphComplianceInformation]     :param control_category: Control action category (Identity, Data, Device, Apps,      Infrastructure).     :type control_category: str     :param control_state_updates:     :type control_state_updates: list[~security.models.MicrosoftGraphSecureScoreControlStateUpdate]     :param deprecated: Flag to indicate if a control is depreciated.     :type deprecated: bool     :param implementation_cost: Resource cost of implemmentating control (low, moderate, high).     :type implementation_cost: str     :param last_modified_date_time: Time at which the control profile entity was last modified. The      Timestamp type represents date and time.     :type last_modified_date_time: ~datetime.datetime     :param max_score: max attainable score for the control.     :type max_score: float     :param rank: Microsoft's stack ranking of control.     :type rank: int     :param remediation: Description of what the control will help remediate.     :type remediation: str     :param remediation_impact: Description of the impact on users of the remediation.     :type remediation_impact: str     :param service: Service that owns the control (Exchange, Sharepoint, Azure AD).     :type service: str     :param threats: List of threats the control mitigates      (accountBreach,dataDeletion,dataExfiltration,dataSpillage,.     :type threats: list[str]     :param tier:     :type tier: str     :param title: Title of the control.     :type title: str     :param user_impact:     :type user_impact: str     :param vendor_information: securityVendorInformation.     :type vendor_information: ~security.models.MicrosoftGraphSecurityVendorInformation secureScoreControlStateUpdate.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param assigned_to: Assigns the control to the user who will take the action.     :type assigned_to: str     :param comment: Provides optional comment about the control.     :type comment: str     :param state: State of the control, which can be modified via a PATCH command (for example,      ignored, thirdParty).     :type state: str     :param updated_by: ID of the user who updated tenant state.     :type updated_by: str     :param updated_date_time: Time at which the control state was updated.     :type updated_date_time: ~datetime.datetime security.      :param id: Read-only.     :type id: str     :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param alerts: Read-only. Nullable.     :type alerts: list[~security.models.MicrosoftGraphAlert]     :param secure_score_control_profiles:     :type secure_score_control_profiles:      list[~security.models.MicrosoftGraphSecureScoreControlProfile]     :param secure_scores:     :type secure_scores: list[~security.models.MicrosoftGraphSecureScore] securityResource.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param resource: Name of the resource that is related to current alert. Required.     :type resource: str     :param resource_type:  Possible values include: "unknown", "attacked", "related",      "unknownFutureValue".     :type resource_type: str or ~security.models.MicrosoftGraphSecurityResourceType securityVendorInformation.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param provider: Specific provider (product/service - not vendor company); for example,      WindowsDefenderATP.     :type provider: str     :param provider_version: Version of the provider or subprovider, if it exists, that generated      the alert. Required.     :type provider_version: str     :param sub_provider: Specific subprovider (under aggregating provider); for example,      WindowsDefenderATP.SmartScreen.     :type sub_provider: str     :param vendor: Name of the alert vendor (for example, Microsoft, Dell, FireEye). Required.     :type vendor: str userSecurityState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param aad_user_id: AAD User object identifier (GUID) - represents the physical/multi-account      user entity.     :type aad_user_id: str     :param account_name: Account name of user account (without Active Directory domain or DNS      domain) - (also called mailNickName).     :type account_name: str     :param domain_name: NetBIOS/Active Directory domain of user account (that is, domain/account      format).     :type domain_name: str     :param email_role:  Possible values include: "unknown", "sender", "recipient",      "unknownFutureValue".     :type email_role: str or ~security.models.MicrosoftGraphEmailRole     :param is_vpn: Indicates whether the user logged on through a VPN.     :type is_vpn: bool     :param logon_date_time: Time at which the sign-in occurred. The Timestamp type represents date      and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC      on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'.     :type logon_date_time: ~datetime.datetime     :param logon_id: User sign-in ID.     :type logon_id: str     :param logon_ip: IP Address the sign-in request originated from.     :type logon_ip: str     :param logon_location: Location (by IP address mapping) associated with a user sign-in event by      this user.     :type logon_location: str     :param logon_type:  Possible values include: "unknown", "interactive", "remoteInteractive",      "network", "batch", "service", "unknownFutureValue".     :type logon_type: str or ~security.models.MicrosoftGraphLogonType     :param on_premises_security_identifier: Active Directory (on-premises) Security Identifier      (SID) of the user.     :type on_premises_security_identifier: str     :param risk_score: Provider-generated/calculated risk score of the user account. Recommended      value range of 0-1, which equates to a percentage.     :type risk_score: str     :param user_account_type:  Possible values include: "unknown", "standard", "power",      "administrator", "unknownFutureValue".     :type user_account_type: str or ~security.models.MicrosoftGraphUserAccountSecurityType     :param user_principal_name: User sign-in name - internet format: (user account name)@(user      account DNS domain name).     :type user_principal_name: str vulnerabilityState.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param cve: Common Vulnerabilities and Exposures (CVE) for the vulnerability.     :type cve: str     :param severity: Base Common Vulnerability Scoring System (CVSS) severity score for this      vulnerability.     :type severity: str     :param was_running: Indicates whether the detected vulnerability (file) was running at the time      of detection or was the file detected at rest on the disk.     :type was_running: bool OdataError.      All required parameters must be populated in order to send to Azure.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param error: Required.     :type error: ~security.models.OdataErrorMain OdataErrorDetail.      All required parameters must be populated in order to send to Azure.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param code: Required.     :type code: str     :param message: Required.     :type message: str     :param target:     :type target: str OdataErrorMain.      All required parameters must be populated in order to send to Azure.      :param additional_properties: Unmatched properties from the message are deserialized to this      collection.     :type additional_properties: dict[str, object]     :param code: Required.     :type code: str     :param message: Required.     :type message: str     :param target:     :type target: str     :param details:     :type details: list[~security.models.OdataErrorDetail]     :param innererror: The structure of this object is service-specific.     :type innererror: dict[str, object]