|null */ public function getAlerts(): ?array { $val = $this->getBackingStore()->get('alerts'); if (is_array($val) || is_null($val)) { TypeUtils::validateCollectionValues($val, Alert::class); /** @var array|null $val */ return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'alerts'"); } /** * Gets the assignedTo property value. Owner of the incident, or null if no owner is assigned. Free editable text. * @return string|null */ public function getAssignedTo(): ?string { $val = $this->getBackingStore()->get('assignedTo'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'assignedTo'"); } /** * Gets the classification property value. The specification for the incident. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue. * @return AlertClassification|null */ public function getClassification(): ?AlertClassification { $val = $this->getBackingStore()->get('classification'); if (is_null($val) || $val instanceof AlertClassification) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'classification'"); } /** * Gets the comments property value. Array of comments created by the Security Operations (SecOps) team when the incident is managed. * @return array|null */ public function getComments(): ?array { $val = $this->getBackingStore()->get('comments'); if (is_array($val) || is_null($val)) { TypeUtils::validateCollectionValues($val, AlertComment::class); /** @var array|null $val */ return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'comments'"); } /** * Gets the createdDateTime property value. Time when the incident was first created. * @return DateTime|null */ public function getCreatedDateTime(): ?DateTime { $val = $this->getBackingStore()->get('createdDateTime'); if (is_null($val) || $val instanceof DateTime) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'createdDateTime'"); } /** * Gets the customTags property value. Array of custom tags associated with an incident. * @return array|null */ public function getCustomTags(): ?array { $val = $this->getBackingStore()->get('customTags'); if (is_array($val) || is_null($val)) { TypeUtils::validateCollectionValues($val, 'string'); /** @var array|null $val */ return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'customTags'"); } /** * Gets the description property value. Description of the incident. * @return string|null */ public function getDescription(): ?string { $val = $this->getBackingStore()->get('description'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'description'"); } /** * Gets the determination property value. Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue. * @return AlertDetermination|null */ public function getDetermination(): ?AlertDetermination { $val = $this->getBackingStore()->get('determination'); if (is_null($val) || $val instanceof AlertDetermination) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'determination'"); } /** * Gets the displayName property value. The incident name. * @return string|null */ public function getDisplayName(): ?string { $val = $this->getBackingStore()->get('displayName'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'displayName'"); } /** * The deserialization information for the current model * @return array */ public function getFieldDeserializers(): array { $o = $this; return array_merge(parent::getFieldDeserializers(), [ 'alerts' => fn(ParseNode $n) => $o->setAlerts($n->getCollectionOfObjectValues([Alert::class, 'createFromDiscriminatorValue'])), 'assignedTo' => fn(ParseNode $n) => $o->setAssignedTo($n->getStringValue()), 'classification' => fn(ParseNode $n) => $o->setClassification($n->getEnumValue(AlertClassification::class)), 'comments' => fn(ParseNode $n) => $o->setComments($n->getCollectionOfObjectValues([AlertComment::class, 'createFromDiscriminatorValue'])), 'createdDateTime' => fn(ParseNode $n) => $o->setCreatedDateTime($n->getDateTimeValue()), 'customTags' => function (ParseNode $n) { $val = $n->getCollectionOfPrimitiveValues(); if (is_array($val)) { TypeUtils::validateCollectionValues($val, 'string'); } /** @var array|null $val */ $this->setCustomTags($val); }, 'description' => fn(ParseNode $n) => $o->setDescription($n->getStringValue()), 'determination' => fn(ParseNode $n) => $o->setDetermination($n->getEnumValue(AlertDetermination::class)), 'displayName' => fn(ParseNode $n) => $o->setDisplayName($n->getStringValue()), 'incidentWebUrl' => fn(ParseNode $n) => $o->setIncidentWebUrl($n->getStringValue()), 'lastModifiedBy' => fn(ParseNode $n) => $o->setLastModifiedBy($n->getStringValue()), 'lastUpdateDateTime' => fn(ParseNode $n) => $o->setLastUpdateDateTime($n->getDateTimeValue()), 'priorityScore' => fn(ParseNode $n) => $o->setPriorityScore($n->getIntegerValue()), 'redirectIncidentId' => fn(ParseNode $n) => $o->setRedirectIncidentId($n->getStringValue()), 'resolvingComment' => fn(ParseNode $n) => $o->setResolvingComment($n->getStringValue()), 'severity' => fn(ParseNode $n) => $o->setSeverity($n->getEnumValue(AlertSeverity::class)), 'status' => fn(ParseNode $n) => $o->setStatus($n->getEnumValue(IncidentStatus::class)), 'summary' => fn(ParseNode $n) => $o->setSummary($n->getStringValue()), 'systemTags' => function (ParseNode $n) { $val = $n->getCollectionOfPrimitiveValues(); if (is_array($val)) { TypeUtils::validateCollectionValues($val, 'string'); } /** @var array|null $val */ $this->setSystemTags($val); }, 'tenantId' => fn(ParseNode $n) => $o->setTenantId($n->getStringValue()), ]); } /** * Gets the incidentWebUrl property value. The URL for the incident page in the Microsoft 365 Defender portal. * @return string|null */ public function getIncidentWebUrl(): ?string { $val = $this->getBackingStore()->get('incidentWebUrl'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'incidentWebUrl'"); } /** * Gets the lastModifiedBy property value. The identity that last modified the incident. * @return string|null */ public function getLastModifiedBy(): ?string { $val = $this->getBackingStore()->get('lastModifiedBy'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'lastModifiedBy'"); } /** * Gets the lastUpdateDateTime property value. Time when the incident was last updated. * @return DateTime|null */ public function getLastUpdateDateTime(): ?DateTime { $val = $this->getBackingStore()->get('lastUpdateDateTime'); if (is_null($val) || $val instanceof DateTime) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'lastUpdateDateTime'"); } /** * Gets the priorityScore property value. A priority score for the incident from 0 to 100, with > 85 being the top priority, 15 - 85 medium priority, and < 15 low priority. This score is generated using machine learning and is based on multiple factors, including severity, disruption impact, threat intelligence, alert types, asset criticality, threat analytics, incident rarity, and additional priority signals. The value can also be null which indicates the feature is not open for the tenant or the value of the score is pending calculation. * @return int|null */ public function getPriorityScore(): ?int { $val = $this->getBackingStore()->get('priorityScore'); if (is_null($val) || is_int($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'priorityScore'"); } /** * Gets the redirectIncidentId property value. Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected. * @return string|null */ public function getRedirectIncidentId(): ?string { $val = $this->getBackingStore()->get('redirectIncidentId'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'redirectIncidentId'"); } /** * Gets the resolvingComment property value. User input that explains the resolution of the incident and the classification choice. This property contains free editable text. * @return string|null */ public function getResolvingComment(): ?string { $val = $this->getBackingStore()->get('resolvingComment'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'resolvingComment'"); } /** * Gets the severity property value. The severity property * @return AlertSeverity|null */ public function getSeverity(): ?AlertSeverity { $val = $this->getBackingStore()->get('severity'); if (is_null($val) || $val instanceof AlertSeverity) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'severity'"); } /** * Gets the status property value. The status property * @return IncidentStatus|null */ public function getStatus(): ?IncidentStatus { $val = $this->getBackingStore()->get('status'); if (is_null($val) || $val instanceof IncidentStatus) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'status'"); } /** * Gets the summary property value. The overview of an attack. When applicable, the summary contains details of what occurred, impacted assets, and the type of attack. * @return string|null */ public function getSummary(): ?string { $val = $this->getBackingStore()->get('summary'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'summary'"); } /** * Gets the systemTags property value. The system tags associated with the incident. * @return array|null */ public function getSystemTags(): ?array { $val = $this->getBackingStore()->get('systemTags'); if (is_array($val) || is_null($val)) { TypeUtils::validateCollectionValues($val, 'string'); /** @var array|null $val */ return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'systemTags'"); } /** * Gets the tenantId property value. The Microsoft Entra tenant in which the alert was created. * @return string|null */ public function getTenantId(): ?string { $val = $this->getBackingStore()->get('tenantId'); if (is_null($val) || is_string($val)) { return $val; } throw new \UnexpectedValueException("Invalid type found in backing store for 'tenantId'"); } /** * Serializes information the current object * @param SerializationWriter $writer Serialization writer to use to serialize this model */ public function serialize(SerializationWriter $writer): void { parent::serialize($writer); $writer->writeCollectionOfObjectValues('alerts', $this->getAlerts()); $writer->writeStringValue('assignedTo', $this->getAssignedTo()); $writer->writeEnumValue('classification', $this->getClassification()); $writer->writeCollectionOfObjectValues('comments', $this->getComments()); $writer->writeDateTimeValue('createdDateTime', $this->getCreatedDateTime()); $writer->writeCollectionOfPrimitiveValues('customTags', $this->getCustomTags()); $writer->writeStringValue('description', $this->getDescription()); $writer->writeEnumValue('determination', $this->getDetermination()); $writer->writeStringValue('displayName', $this->getDisplayName()); $writer->writeStringValue('incidentWebUrl', $this->getIncidentWebUrl()); $writer->writeStringValue('lastModifiedBy', $this->getLastModifiedBy()); $writer->writeDateTimeValue('lastUpdateDateTime', $this->getLastUpdateDateTime()); $writer->writeIntegerValue('priorityScore', $this->getPriorityScore()); $writer->writeStringValue('redirectIncidentId', $this->getRedirectIncidentId()); $writer->writeStringValue('resolvingComment', $this->getResolvingComment()); $writer->writeEnumValue('severity', $this->getSeverity()); $writer->writeEnumValue('status', $this->getStatus()); $writer->writeStringValue('summary', $this->getSummary()); $writer->writeCollectionOfPrimitiveValues('systemTags', $this->getSystemTags()); $writer->writeStringValue('tenantId', $this->getTenantId()); } /** * Sets the alerts property value. The list of related alerts. Supports $expand. * @param array|null $value Value to set for the alerts property. */ public function setAlerts(?array $value): void { $this->getBackingStore()->set('alerts', $value); } /** * Sets the assignedTo property value. Owner of the incident, or null if no owner is assigned. Free editable text. * @param string|null $value Value to set for the assignedTo property. */ public function setAssignedTo(?string $value): void { $this->getBackingStore()->set('assignedTo', $value); } /** * Sets the classification property value. The specification for the incident. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue. * @param AlertClassification|null $value Value to set for the classification property. */ public function setClassification(?AlertClassification $value): void { $this->getBackingStore()->set('classification', $value); } /** * Sets the comments property value. Array of comments created by the Security Operations (SecOps) team when the incident is managed. * @param array|null $value Value to set for the comments property. */ public function setComments(?array $value): void { $this->getBackingStore()->set('comments', $value); } /** * Sets the createdDateTime property value. Time when the incident was first created. * @param DateTime|null $value Value to set for the createdDateTime property. */ public function setCreatedDateTime(?DateTime $value): void { $this->getBackingStore()->set('createdDateTime', $value); } /** * Sets the customTags property value. Array of custom tags associated with an incident. * @param array|null $value Value to set for the customTags property. */ public function setCustomTags(?array $value): void { $this->getBackingStore()->set('customTags', $value); } /** * Sets the description property value. Description of the incident. * @param string|null $value Value to set for the description property. */ public function setDescription(?string $value): void { $this->getBackingStore()->set('description', $value); } /** * Sets the determination property value. Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue. * @param AlertDetermination|null $value Value to set for the determination property. */ public function setDetermination(?AlertDetermination $value): void { $this->getBackingStore()->set('determination', $value); } /** * Sets the displayName property value. The incident name. * @param string|null $value Value to set for the displayName property. */ public function setDisplayName(?string $value): void { $this->getBackingStore()->set('displayName', $value); } /** * Sets the incidentWebUrl property value. The URL for the incident page in the Microsoft 365 Defender portal. * @param string|null $value Value to set for the incidentWebUrl property. */ public function setIncidentWebUrl(?string $value): void { $this->getBackingStore()->set('incidentWebUrl', $value); } /** * Sets the lastModifiedBy property value. The identity that last modified the incident. * @param string|null $value Value to set for the lastModifiedBy property. */ public function setLastModifiedBy(?string $value): void { $this->getBackingStore()->set('lastModifiedBy', $value); } /** * Sets the lastUpdateDateTime property value. Time when the incident was last updated. * @param DateTime|null $value Value to set for the lastUpdateDateTime property. */ public function setLastUpdateDateTime(?DateTime $value): void { $this->getBackingStore()->set('lastUpdateDateTime', $value); } /** * Sets the priorityScore property value. A priority score for the incident from 0 to 100, with > 85 being the top priority, 15 - 85 medium priority, and < 15 low priority. This score is generated using machine learning and is based on multiple factors, including severity, disruption impact, threat intelligence, alert types, asset criticality, threat analytics, incident rarity, and additional priority signals. The value can also be null which indicates the feature is not open for the tenant or the value of the score is pending calculation. * @param int|null $value Value to set for the priorityScore property. */ public function setPriorityScore(?int $value): void { $this->getBackingStore()->set('priorityScore', $value); } /** * Sets the redirectIncidentId property value. Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected. * @param string|null $value Value to set for the redirectIncidentId property. */ public function setRedirectIncidentId(?string $value): void { $this->getBackingStore()->set('redirectIncidentId', $value); } /** * Sets the resolvingComment property value. User input that explains the resolution of the incident and the classification choice. This property contains free editable text. * @param string|null $value Value to set for the resolvingComment property. */ public function setResolvingComment(?string $value): void { $this->getBackingStore()->set('resolvingComment', $value); } /** * Sets the severity property value. The severity property * @param AlertSeverity|null $value Value to set for the severity property. */ public function setSeverity(?AlertSeverity $value): void { $this->getBackingStore()->set('severity', $value); } /** * Sets the status property value. The status property * @param IncidentStatus|null $value Value to set for the status property. */ public function setStatus(?IncidentStatus $value): void { $this->getBackingStore()->set('status', $value); } /** * Sets the summary property value. The overview of an attack. When applicable, the summary contains details of what occurred, impacted assets, and the type of attack. * @param string|null $value Value to set for the summary property. */ public function setSummary(?string $value): void { $this->getBackingStore()->set('summary', $value); } /** * Sets the systemTags property value. The system tags associated with the incident. * @param array|null $value Value to set for the systemTags property. */ public function setSystemTags(?array $value): void { $this->getBackingStore()->set('systemTags', $value); } /** * Sets the tenantId property value. The Microsoft Entra tenant in which the alert was created. * @param string|null $value Value to set for the tenantId property. */ public function setTenantId(?string $value): void { $this->getBackingStore()->set('tenantId', $value); } }