risk_detections

Creates, updates, deletes, gets or lists a risk_detections resource.

Overview

Name	risk_detections
Type	Resource
Id	entra_id.identity_protection.risk_detections

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activity		Indicates the activity type the detected risk is linked to.
activityDateTime	string (date-time)	Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
additionalInfo	string	Additional information associated with the risk detection in JSON format. For example, '[{/'Key/':/'userAgent/',/'Value/':/'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36/'}]'. Possible keys in the additionalInfo JSON string are: userAgent, alertUrl, relatedEventTimeInUtc, relatedUserAgent, deviceInformation, relatedLocation, requestId, correlationId, lastActivityTimeInUtc, malwareName, clientLocation, clientIp, riskReasons. For more information about riskReasons and possible values, see riskReasons values.
correlationId	string	Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
detectedDateTime	string (date-time)	Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like this: 2014-01-01T00:00:00Z (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
detectionTimingType		Timing of the detected risk (real-time/offline). The possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.
ipAddress	string	Provides the IP address of the client from where the risk occurred.
lastUpdatedDateTime	string (date-time)	Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
location		Location of the sign-in.
requestId	string	Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
riskDetail		Details of the detected risk.
riskEventType	string	The type of risk event detected. The possible values are adminConfirmedUserCompromised, anomalousToken, anomalousUserActivity, anonymizedIPAddress, generic, impossibleTravel, investigationsThreatIntelligence, suspiciousSendingPatterns, leakedCredentials, maliciousIPAddress,malwareInfectedIPAddress, mcasSuspiciousInboxManipulationRules, newCountry, passwordSpray,riskyIPAddress, suspiciousAPITraffic, suspiciousBrowser,suspiciousInboxForwarding, suspiciousIPAddress, tokenIssuerAnomaly, unfamiliarFeatures, unlikelyTravel. If the risk detection is a premium detection, will show generic. For more information about each value, see Risk types and detection.
riskLevel		Level of the detected risk. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState		The state of a detected risky user or sign-in. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
source	string	Source of the risk detection. For example, activeDirectory.
tokenIssuerType		Indicates the type of token issuer for the detected sign-in risk. The possible values are: AzureAD, ADFederationServices, UnknownFutureValue.
userDisplayName	string	The user principal name (UPN) of the user.
userId	string	Unique ID of the user.
userPrincipalName	string	The user principal name (UPN) of the user.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activity		Indicates the activity type the detected risk is linked to.
activityDateTime	string (date-time)	Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
additionalInfo	string	Additional information associated with the risk detection in JSON format. For example, '[{/'Key/':/'userAgent/',/'Value/':/'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36/'}]'. Possible keys in the additionalInfo JSON string are: userAgent, alertUrl, relatedEventTimeInUtc, relatedUserAgent, deviceInformation, relatedLocation, requestId, correlationId, lastActivityTimeInUtc, malwareName, clientLocation, clientIp, riskReasons. For more information about riskReasons and possible values, see riskReasons values.
correlationId	string	Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
detectedDateTime	string (date-time)	Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like this: 2014-01-01T00:00:00Z (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
detectionTimingType		Timing of the detected risk (real-time/offline). The possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.
ipAddress	string	Provides the IP address of the client from where the risk occurred.
lastUpdatedDateTime	string (date-time)	Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
location		Location of the sign-in.
requestId	string	Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
riskDetail		Details of the detected risk.
riskEventType	string	The type of risk event detected. The possible values are adminConfirmedUserCompromised, anomalousToken, anomalousUserActivity, anonymizedIPAddress, generic, impossibleTravel, investigationsThreatIntelligence, suspiciousSendingPatterns, leakedCredentials, maliciousIPAddress,malwareInfectedIPAddress, mcasSuspiciousInboxManipulationRules, newCountry, passwordSpray,riskyIPAddress, suspiciousAPITraffic, suspiciousBrowser,suspiciousInboxForwarding, suspiciousIPAddress, tokenIssuerAnomaly, unfamiliarFeatures, unlikelyTravel. If the risk detection is a premium detection, will show generic. For more information about each value, see Risk types and detection.
riskLevel		Level of the detected risk. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState		The state of a detected risky user or sign-in. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
source	string	Source of the risk detection. For example, activeDirectory.
tokenIssuerType		Indicates the type of token issuer for the detected sign-in risk. The possible values are: AzureAD, ADFederationServices, UnknownFutureValue.
userDisplayName	string	The user principal name (UPN) of the user.
userId	string	Unique ID of the user.
userPrincipalName	string	The user principal name (UPN) of the user.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	risk_detection_id		Read the properties and relationships of a riskDetection object.
list	select			Get a list of the riskDetection objects and their properties.
insert	insert
update	update	risk_detection_id
delete	delete	risk_detection_id	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
risk_detection_id	string	The unique identifier of riskDetection
If-Match	string	ETag

SELECT examples

get

Read the properties and relationships of a riskDetection object.

SELECT
id,
activity,
activityDateTime,
additionalInfo,
correlationId,
detectedDateTime,
detectionTimingType,
ipAddress,
lastUpdatedDateTime,
location,
requestId,
riskDetail,
riskEventType,
riskLevel,
riskState,
source,
tokenIssuerType,
userDisplayName,
userId,
userPrincipalName
FROM entra_id.identity_protection.risk_detections
WHERE risk_detection_id = '{{ risk_detection_id }}' -- required
;

list

Get a list of the riskDetection objects and their properties.

SELECT
id,
activity,
activityDateTime,
additionalInfo,
correlationId,
detectedDateTime,
detectionTimingType,
ipAddress,
lastUpdatedDateTime,
location,
requestId,
riskDetail,
riskEventType,
riskLevel,
riskState,
source,
tokenIssuerType,
userDisplayName,
userId,
userPrincipalName
FROM entra_id.identity_protection.risk_detections
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.identity_protection.risk_detections (
id,
activity,
activityDateTime,
additionalInfo,
correlationId,
detectedDateTime,
detectionTimingType,
ipAddress,
lastUpdatedDateTime,
location,
requestId,
riskDetail,
riskEventType,
riskLevel,
riskState,
source,
tokenIssuerType,
userDisplayName,
userId,
userPrincipalName
)
SELECT 
'{{ id }}',
'{{ activity }}',
'{{ activityDateTime }}',
'{{ additionalInfo }}',
'{{ correlationId }}',
'{{ detectedDateTime }}',
'{{ detectionTimingType }}',
'{{ ipAddress }}',
'{{ lastUpdatedDateTime }}',
'{{ location }}',
'{{ requestId }}',
'{{ riskDetail }}',
'{{ riskEventType }}',
'{{ riskLevel }}',
'{{ riskState }}',
'{{ source }}',
'{{ tokenIssuerType }}',
'{{ userDisplayName }}',
'{{ userId }}',
'{{ userPrincipalName }}'
RETURNING
id,
activity,
activityDateTime,
additionalInfo,
correlationId,
detectedDateTime,
detectionTimingType,
ipAddress,
lastUpdatedDateTime,
location,
requestId,
riskDetail,
riskEventType,
riskLevel,
riskState,
source,
tokenIssuerType,
userDisplayName,
userId,
userPrincipalName
;

Manifest

# Description fields are for documentation purposes
- name: risk_detections
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: activity
    value: "{{ activity }}"
    description: |
      Indicates the activity type the detected risk is linked to.
  - name: activityDateTime
    value: "{{ activityDateTime }}"
    description: |
      Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
  - name: additionalInfo
    value: "{{ additionalInfo }}"
    description: |
      Additional information associated with the risk detection in JSON format. For example, '[{/'Key/':/'userAgent/',/'Value/':/'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36/'}]'. Possible keys in the additionalInfo JSON string are: userAgent, alertUrl, relatedEventTimeInUtc, relatedUserAgent, deviceInformation, relatedLocation, requestId, correlationId, lastActivityTimeInUtc, malwareName, clientLocation, clientIp, riskReasons. For more information about riskReasons and possible values, see riskReasons values.
  - name: correlationId
    value: "{{ correlationId }}"
    description: |
      Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
  - name: detectedDateTime
    value: "{{ detectedDateTime }}"
    description: |
      Date and time that the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like this: 2014-01-01T00:00:00Z
  - name: detectionTimingType
    value: "{{ detectionTimingType }}"
    description: |
      Timing of the detected risk (real-time/offline). The possible values are: notDefined, realtime, nearRealtime, offline, unknownFutureValue.
  - name: ipAddress
    value: "{{ ipAddress }}"
    description: |
      Provides the IP address of the client from where the risk occurred.
  - name: lastUpdatedDateTime
    value: "{{ lastUpdatedDateTime }}"
    description: |
      Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is look like this: 2014-01-01T00:00:00Z
  - name: location
    value: "{{ location }}"
    description: |
      Location of the sign-in.
  - name: requestId
    value: "{{ requestId }}"
    description: |
      Request ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
  - name: riskDetail
    value: "{{ riskDetail }}"
    description: |
      Details of the detected risk.
  - name: riskEventType
    value: "{{ riskEventType }}"
    description: |
      The type of risk event detected. The possible values are adminConfirmedUserCompromised, anomalousToken, anomalousUserActivity, anonymizedIPAddress, generic, impossibleTravel, investigationsThreatIntelligence, suspiciousSendingPatterns, leakedCredentials, maliciousIPAddress,malwareInfectedIPAddress, mcasSuspiciousInboxManipulationRules, newCountry, passwordSpray,riskyIPAddress, suspiciousAPITraffic, suspiciousBrowser,suspiciousInboxForwarding, suspiciousIPAddress, tokenIssuerAnomaly, unfamiliarFeatures, unlikelyTravel. If the risk detection is a premium detection, will show generic. For more information about each value, see Risk types and detection.
  - name: riskLevel
    value: "{{ riskLevel }}"
    description: |
      Level of the detected risk. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
  - name: riskState
    value: "{{ riskState }}"
    description: |
      The state of a detected risky user or sign-in. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
  - name: source
    value: "{{ source }}"
    description: |
      Source of the risk detection. For example, activeDirectory.
  - name: tokenIssuerType
    value: "{{ tokenIssuerType }}"
    description: |
      Indicates the type of token issuer for the detected sign-in risk. The possible values are: AzureAD, ADFederationServices, UnknownFutureValue.
  - name: userDisplayName
    value: "{{ userDisplayName }}"
    description: |
      The user principal name (UPN) of the user.
  - name: userId
    value: "{{ userId }}"
    description: |
      Unique ID of the user.
  - name: userPrincipalName
    value: "{{ userPrincipalName }}"
    description: |
      The user principal name (UPN) of the user.

UPDATE examples

update

No description available.

UPDATE entra_id.identity_protection.risk_detections
SET 
id = '{{ id }}',
activity = '{{ activity }}',
activityDateTime = '{{ activityDateTime }}',
additionalInfo = '{{ additionalInfo }}',
correlationId = '{{ correlationId }}',
detectedDateTime = '{{ detectedDateTime }}',
detectionTimingType = '{{ detectionTimingType }}',
ipAddress = '{{ ipAddress }}',
lastUpdatedDateTime = '{{ lastUpdatedDateTime }}',
location = '{{ location }}',
requestId = '{{ requestId }}',
riskDetail = '{{ riskDetail }}',
riskEventType = '{{ riskEventType }}',
riskLevel = '{{ riskLevel }}',
riskState = '{{ riskState }}',
source = '{{ source }}',
tokenIssuerType = '{{ tokenIssuerType }}',
userDisplayName = '{{ userDisplayName }}',
userId = '{{ userId }}',
userPrincipalName = '{{ userPrincipalName }}'
WHERE 
risk_detection_id = '{{ risk_detection_id }}' --required
RETURNING
id,
activity,
activityDateTime,
additionalInfo,
correlationId,
detectedDateTime,
detectionTimingType,
ipAddress,
lastUpdatedDateTime,
location,
requestId,
riskDetail,
riskEventType,
riskLevel,
riskState,
source,
tokenIssuerType,
userDisplayName,
userId,
userPrincipalName;

DELETE examples

delete

No description available.

DELETE FROM entra_id.identity_protection.risk_detections
WHERE risk_detection_id = '{{ risk_detection_id }}' --required
AND If-Match = '{{ If-Match }}'
;