{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-api-response-of-contra-force-incident-schema.json",
  "title": "ApiResponseOfContraForceIncident",
  "description": "Standard v2 API response envelope for single-item responses.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-incidents-api-openapi.yml#/components/schemas/ApiResponseOfContraForceIncident",
  "type": "object",
  "properties": {
    "data": {
      "description": "Object that represents all the data from an incident that could come from any source",
      "$ref": "#/$defs/ContraForceIncident"
    },
    "meta": {
      "$ref": "#/$defs/ResponseMeta"
    }
  },
  "$defs": {
    "Classification": {
      "enum": [
        "BenignPositive",
        "FalsePositive",
        "TruePositive",
        "Undetermined",
        null
      ]
    },
    "ClassificationReason": {
      "enum": [
        "InaccurateData",
        "IncorrectAlertLogic",
        "SuspiciousActivity",
        "SuspiciousButExpected",
        "Unknown",
        "Apt",
        "Malware",
        "SecurityPersonnel",
        "SecurityTesting",
        "UnwantedSoftware",
        "Other",
        "MultistagedAttack",
        "CompromisedUser",
        "Phishing",
        "MaliciousUserActivity",
        "NotMalicious",
        "NoEnoughDataToValidate",
        "ConfirmedUserActivity",
        "LineOfBusinessApplication",
        null
      ]
    },
    "ContraForceIncident": {
      "type": "object",
      "properties": {
        "source": {
          "description": "Property to retrieve the source of the incident (DefenderXDR, Sentinel, etc)",
          "$ref": "#/$defs/IncidentSource"
        },
        "incident": {
          "description": "Object to retrieve the base information of the incident",
          "$ref": "#/$defs/Incident"
        },
        "investigationDetails": {
          "description": "Object to retrieve the entities and alerts related to the incident",
          "$ref": "#/$defs/IncidentInvestigationDetailsDto"
        },
        "evidence": {
          "description": "Object to retrieve the evidence related to the incident",
          "$ref": "#/$defs/GeneralTableDto"
        },
        "gamebookCatalog": {
          "description": "(Nullable) Represents the recommended gamebook by ContraForce or the last run gamebook for the incident",
          "$ref": "#/$defs/IncidentGamebooksCatalogDto"
        }
      },
      "description": "Object that represents all the data from an incident that could come from any source"
    },
    "DefenderIncidentIdentifiers": {
      "type": "object",
      "properties": {
        "incidentId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Defender XDR incident id."
        },
        "tenantId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Entra tenant the Defender incident belongs to, when the vendor reported it."
        },
        "portalUrl": {
          "type": [
            "null",
            "string"
          ],
          "description": "Direct link to the incident in the Microsoft Defender portal."
        }
      },
      "description": "Microsoft Defender XDR's identifiers for an incident."
    },
    "EntityType": {
      "enum": [
        "User",
        "IP",
        "File",
        "Process",
        "Device",
        "Malware",
        "CloudApplication",
        "DomainName",
        "AzureResource",
        "FileHash",
        "RegistryKey",
        "RegistryValue",
        "SecurityGroup",
        "URL",
        "IoTDevice",
        "Mailbox",
        "MailCluster",
        "MailMessage",
        "Submission",
        "SentinelEntities",
        "DnsResolution",
        "Registry",
        "OAuthApplication",
        "AmazonResource",
        "BlobContainer",
        "Blob",
        "Container",
        "ContainerRegistry",
        "ContainerImage",
        "GoogleCloudResource",
        "KubernetesCluster",
        "KubernetesController",
        "KubernetesNamespace",
        "KubernetesPod",
        "KubernetesService",
        "KubernetesSecret",
        "KubernetesServiceAccount",
        "AnalyzedMessage",
        "DNS",
        "Unknown"
      ]
    },
    "GamebookDto": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "tracingId": {
          "type": [
            "null",
            "string"
          ]
        },
        "incidentId": {
          "type": [
            "null",
            "string"
          ]
        },
        "source": {
          "description": "Source of the system that owns the incident Sentinel, Defender ATP, etc.",
          "$ref": "#/$defs/IncidentSource"
        },
        "incidentTitle": {
          "type": [
            "null",
            "string"
          ]
        },
        "incidentNumber": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "integer",
            "string"
          ],
          "format": "int32"
        },
        "isOcr": {
          "type": "boolean"
        },
        "isRecover": {
          "type": "boolean"
        },
        "triggedByUserId": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "modificationDate": {
          "type": "string",
          "format": "date-time"
        },
        "creationDate": {
          "type": "string",
          "format": "date-time"
        },
        "status": {
          "$ref": "#/$defs/GamebookRunningStatus"
        },
        "title": {
          "type": [
            "null",
            "string"
          ]
        },
        "isAdminRequired": {
          "type": "boolean"
        },
        "workspaceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "workspaceName": {
          "type": [
            "null",
            "string"
          ]
        },
        "tenantId": {
          "type": [
            "null",
            "string"
          ]
        },
        "isAutoRun": {
          "type": "boolean"
        },
        "originalGamebookId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Used if the gamebook is retry gamebook and refers to the id of the gamebook id that has been retried"
        },
        "originalGamebookTitle": {
          "type": [
            "null",
            "string"
          ],
          "description": "Used if the gamebook is retry gamebook and refers to the id of the gamebook title that has been retried"
        },
        "isRetryGamebook": {
          "type": "boolean",
          "description": "Indicator if the gamebook is a retry to failed gamebook"
        },
        "isQueued": {
          "type": "boolean",
          "description": "Indicator if the gamebook is queued by a service provider and it is not started yet"
        },
        "playbooks": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "$ref": "#/$defs/PlaybookGameplanDto"
          }
        },
        "summary": {
          "type": [
            "null",
            "string"
          ]
        }
      }
    },
    "GamebookRunningStatus": {
      "enum": [
        "Pending",
        "Running",
        "Finished",
        "Failed",
        "Queued",
        "Denied",
        "Cancelled"
      ]
    },
    "GeneralTableDto": {
      "type": "object",
      "properties": {
        "columns": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          }
        },
        "rows": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "array"
          }
        }
      }
    },
    "Incident": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "name": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Optional human-readable identifier shown in the table and\npage heading instead of the long opaque string Incident.Id.\nPopulated for sources whose IDs are unwieldy (e.g. CrowdStrike\ncases use a 165-char base64 ID but expose a friendly\n\"`6F1-24`\"-style `reference_id`). When null, callers\nfall back to the existing short-form derivation of\nstring Incident.Id."
        },
        "title": {
          "type": [
            "null",
            "string"
          ]
        },
        "description": {
          "type": [
            "null",
            "string"
          ]
        },
        "number": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "integer",
            "string"
          ],
          "format": "int32"
        },
        "type": {
          "type": [
            "null",
            "string"
          ]
        },
        "source": {
          "$ref": "#/$defs/IncidentSource"
        },
        "sourceDisplayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "lastModificationTime": {
          "type": [
            "null",
            "string"
          ],
          "description": "Date/Time represents the user's local time",
          "format": "date-time"
        },
        "creationTime": {
          "type": "string",
          "description": "Date/Time represents the user's local time",
          "format": "date-time"
        },
        "lastActivityTime": {
          "type": [
            "null",
            "string"
          ],
          "description": "Date/Time represents the user's local time",
          "format": "date-time"
        },
        "severity": {
          "$ref": "#/$defs/Severity"
        },
        "classification": {
          "oneOf": [
            {
              "type": "null"
            },
            {
              "$ref": "#/$defs/Classification"
            }
          ]
        },
        "comment": {
          "type": [
            "null",
            "string"
          ]
        },
        "classificationReason": {
          "oneOf": [
            {
              "type": "null"
            },
            {
              "$ref": "#/$defs/ClassificationReason"
            }
          ]
        },
        "classificationComment": {
          "type": [
            "null",
            "string"
          ]
        },
        "tactics": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          }
        },
        "ruleIds": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          },
          "description": "Represents the Ids of the related rules of this incidents"
        },
        "providerName": {
          "type": [
            "null",
            "string"
          ],
          "description": "The vendor that generated this incident, as the vendor reports it. Sentinel returns\n\"Azure Sentinel\", \"Microsoft 365 Defender\" or \"Microsoft XDR\"; other sources leave it null."
        },
        "isForwardedMirror": {
          "type": "boolean",
          "description": "True when this incident is the mirror of one that originated in the other Microsoft system, so\nshowing it would put the same real-world incident in the inbox twice."
        },
        "vendorIdentifiers": {
          "description": "The identifiers of every vendor system that holds a record of this incident, for consumers that\nneed to resolve it back to the source vendor.",
          "$ref": "#/$defs/IncidentVendorIdentifiers"
        },
        "alertProductNames": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          }
        },
        "user": {
          "description": "Represents the user assigned to work on this incident",
          "$ref": "#/$defs/UserSummary"
        },
        "isAssigned": {
          "type": "boolean"
        },
        "productId": {
          "type": [
            "null",
            "string"
          ]
        },
        "status": {
          "$ref": "#/$defs/Status"
        },
        "closedUpstreamDuringPause": {
          "type": "boolean",
          "description": "Set by `IncidentsManager.GetByIdAsync` reconciliation when the CF incident is in a\nCF-native pause status (Status.OnHold / Status.WaitingOnCustomer)\nbut the upstream source has reached terminal Closed. The UI uses this to render the\n\"Closed upstream while paused\" badge on the detail header. Not persisted."
        },
        "sourceRecordExpired": {
          "type": "boolean",
          "description": "True when the source no longer holds this incident's record, so only what ContraForce recorded\n(status, classification, owner, comments) can be shown."
        },
        "sourceLinks": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "A labeled link to an incident's record in its source console.",
            "$ref": "#/$defs/IncidentSourceLink"
          },
          "description": "Links to this incident in the source's own console, when the source provides them (for\nexample the Sumo Logic monitor and the search behind the alert). Always absolute HTTPS URLs."
        },
        "alertsCount": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "integer",
            "string"
          ],
          "format": "int32"
        },
        "entities": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "This class is used to unify the Entities from different sources into a ContraForce Entity",
            "$ref": "#/$defs/IncidentEntity"
          }
        },
        "workspaceName": {
          "type": [
            "null",
            "string"
          ],
          "description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode"
        },
        "workspaceId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode"
        },
        "isDefenderXDRSourced": {
          "type": "boolean",
          "description": "Determines whether the incident is originally sourced from Microsoft Defender XDR"
        }
      },
      "description": "This incident object built on top of the Microsoft Azure Sentinel Incident and it's open to extend to any new provider"
    },
    "IncidentCommentDto": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "message": {
          "type": [
            "null",
            "string"
          ]
        },
        "createdTime": {
          "type": [
            "null",
            "string"
          ],
          "format": "date-time"
        },
        "authorEmail": {
          "type": [
            "null",
            "string"
          ]
        },
        "authorName": {
          "type": [
            "null",
            "string"
          ]
        },
        "isActivityComment": {
          "type": "boolean",
          "description": "Indicates if the comment doesn't represent a written note, instead if just a system activity like status changed, priority changed, user assigned, etc."
        },
        "isAgentComment": {
          "type": "boolean",
          "description": "Indicates if the comment was authored by an AI agent rather than a human analyst."
        },
        "agentName": {
          "type": [
            "null",
            "string"
          ],
          "description": "Name of the agent that authored the comment."
        },
        "isClosingComment": {
          "type": "boolean",
          "description": "Indicates if the comment is the closing comment added when the incident was resolved or closed."
        },
        "ticketNoteId": {
          "type": [
            "null",
            "string"
          ],
          "description": "ID of the ticket note in the service ticketing system if the comment is related to a ticket note.\n(Nullable) only available if the tenant written this comment has a ticketing system enabled in their configuration."
        },
        "ticketId": {
          "type": [
            "null",
            "string"
          ],
          "description": "ID of the ticket in the service ticketing system if the comment is related to a ticket note.\n(Nullable) only available if the tenant written this comment has a ticketing system enabled in their configuration."
        }
      }
    },
    "IncidentEntity": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "type": {
          "$ref": "#/$defs/EntityType"
        },
        "kind": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "friendlyName": {
          "type": [
            "null",
            "string"
          ]
        },
        "fileName": {
          "type": [
            "null",
            "string"
          ]
        },
        "hostName": {
          "type": [
            "null",
            "string"
          ]
        },
        "accountEntityId": {
          "type": [
            "null",
            "string"
          ]
        },
        "deviceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "deviceAzureId": {
          "type": [
            "null",
            "string"
          ]
        },
        "defenderAtpDeviceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "defenderEndpointDeviceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "networkMessageId": {
          "type": [
            "null",
            "string"
          ]
        },
        "hashAlgorithm": {
          "type": [
            "null",
            "string"
          ]
        },
        "aadUserId": {
          "type": [
            "null",
            "string"
          ]
        },
        "emailAddress": {
          "type": [
            "null",
            "string"
          ]
        },
        "userPrincipalName": {
          "type": [
            "null",
            "string"
          ]
        },
        "ipAddress": {
          "type": [
            "null",
            "string"
          ]
        },
        "fileHash": {
          "type": [
            "null",
            "string"
          ]
        },
        "emailId": {
          "type": [
            "null",
            "string"
          ]
        },
        "emailSubject": {
          "type": [
            "null",
            "string"
          ]
        }
      },
      "description": "This class is used to unify the Entities from different sources into a ContraForce Entity"
    },
    "IncidentGamebooksCatalogDto": {
      "type": "object",
      "properties": {
        "recommended": {
          "$ref": "#/$defs/RecommendedGamebookDto"
        },
        "lastGamebook": {
          "$ref": "#/$defs/GamebookDto"
        },
        "isPreviousRunAvailable": {
          "type": "boolean",
          "description": "Indicates if the last Gamebook Run is available"
        },
        "isRecommendedAvailable": {
          "type": "boolean",
          "description": "Indicates if the recommended Gamebook is available"
        },
        "aiRecommendedAvailable": {
          "type": "boolean",
          "description": "Indicator if there is a recommended Gamebook by ContraForce"
        },
        "serviceProviderRecommendedAvailable": {
          "type": "boolean",
          "description": "Indicator if there is a recommended Gamebook by the Service Provider"
        }
      },
      "description": "Contains the recommended gamebooks by ContraForce or the Service Provider, in addition to the last Gamebook Run associated with an Incident"
    },
    "IncidentInvestigationDetailsDto": {
      "type": "object",
      "properties": {
        "entities": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "DTO that is being used for the investigation graph while retrieving the related entity of an node",
            "$ref": "#/$defs/InvestigationEntityDto"
          }
        },
        "alerts": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "description": "DTO that is being used for the investigation graph while retrieving the related Alerts of an entity",
            "$ref": "#/$defs/InvestigationAlertDto"
          }
        },
        "incident": {
          "description": "This incident object built on top of the Microsoft Azure Sentinel Incident and it's open to extend to any new provider",
          "$ref": "#/$defs/Incident"
        },
        "incidentComment": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "$ref": "#/$defs/IncidentCommentDto"
          }
        }
      }
    },
    "IncidentSource": {
      "enum": [
        "Sentinel",
        "DefenderXDR",
        "QRadar",
        "Splunk",
        "CrowdStrike",
        "SentinelOne",
        "SumoLogic"
      ]
    },
    "IncidentSourceLink": {
      "type": "object",
      "properties": {
        "label": {
          "type": [
            "null",
            "string"
          ],
          "description": "What the link opens, for example \"Monitor\" or \"Search\"."
        },
        "url": {
          "type": [
            "null",
            "string"
          ],
          "description": "Absolute HTTPS URL; producers validate it before setting it."
        }
      },
      "description": "A labeled link to an incident's record in its source console."
    },
    "IncidentVendorIdentifiers": {
      "type": "object",
      "properties": {
        "sentinel": {
          "description": "Sentinel's identifiers for this incident, when it exists in Sentinel.",
          "$ref": "#/$defs/SentinelIncidentIdentifiers"
        },
        "defender": {
          "description": "Defender XDR's identifiers for this incident, when it exists in Defender XDR.",
          "$ref": "#/$defs/DefenderIncidentIdentifiers"
        }
      },
      "description": "The identifiers of every vendor system that holds a record of one incident, carried together so an\nexternal consumer can resolve the incident back to whichever system it standardizes on."
    },
    "InvestigationAlertDto": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "kind": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "alertName": {
          "type": [
            "null",
            "string"
          ]
        },
        "vendorName": {
          "type": [
            "null",
            "string"
          ]
        },
        "type": {
          "type": [
            "null",
            "string"
          ]
        },
        "description": {
          "type": [
            "null",
            "string"
          ]
        },
        "timeGenerated": {
          "type": [
            "null",
            "string"
          ],
          "format": "date-time"
        },
        "tactics": {
          "type": [
            "null",
            "array"
          ],
          "items": {
            "type": "string"
          }
        },
        "severity": {
          "type": [
            "null",
            "string"
          ]
        },
        "productName": {
          "type": [
            "null",
            "string"
          ]
        },
        "deviceId": {
          "type": [
            "null",
            "string"
          ]
        }
      },
      "description": "DTO that is being used for the investigation graph while retrieving the related Alerts of an entity"
    },
    "InvestigationEntityDto": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "fileName": {
          "type": [
            "null",
            "string"
          ]
        },
        "fileHash": {
          "type": [
            "null",
            "string"
          ]
        },
        "type": {
          "$ref": "#/$defs/EntityType"
        },
        "friendlyName": {
          "type": [
            "null",
            "string"
          ]
        },
        "hostName": {
          "type": [
            "null",
            "string"
          ]
        },
        "kind": {
          "type": [
            "null",
            "string"
          ]
        },
        "accountEntityId": {
          "type": [
            "null",
            "string"
          ]
        },
        "networkMessageId": {
          "type": [
            "null",
            "string"
          ]
        },
        "commandLine": {
          "type": [
            "null",
            "string"
          ]
        },
        "userUpn": {
          "type": [
            "null",
            "string"
          ]
        },
        "deviceId": {
          "type": [
            "null",
            "string"
          ]
        },
        "aadUserId": {
          "type": [
            "null",
            "string"
          ]
        },
        "internetMessageId": {
          "type": [
            "null",
            "string"
          ]
        },
        "entityType": {
          "$ref": "#/$defs/PlaybookEntityType"
        },
        "isValidEntraIdUser": {
          "type": "boolean",
          "description": "True if the user is a Microsoft Entra ID user (AAD), false indicates that the user is a local user"
        },
        "isValidEntraIdDevice": {
          "type": "boolean",
          "description": "True if the device is a Microsoft Entra ID joined-device (AAD), false indicates that the device is a local device"
        }
      },
      "description": "DTO that is being used for the investigation graph while retrieving the related entity of an node"
    },
    "PlaybookEntityType": {
      "enum": [
        "User",
        "Endpoint",
        "General",
        "Network",
        "Email"
      ]
    },
    "PlaybookGameplanDto": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "referenceId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Stable identity of a plan item — the playbook id combined with the target it acts on.\nUsed for the gamebook plan's de-duplication, equality, and the V2 list `@key`."
        },
        "entityId": {
          "type": [
            "null",
            "string"
          ]
        },
        "name": {
          "type": [
            "null",
            "string"
          ]
        },
        "userObjectId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Azure AD object id (GUID) of the user/mailbox a playbook should act on, supplied\ndirectly by the caller instead of being resolved from the incident's entities."
        },
        "userPrincipalName": {
          "type": [
            "null",
            "string"
          ],
          "description": "User principal name (UPN) of the user/mailbox a playbook should act on, supplied\ndirectly by the caller instead of being resolved from the incident's entities."
        },
        "internetMessageId": {
          "type": [
            "null",
            "string"
          ],
          "description": "RFC 2822 internet message id of the email an email playbook should act on, supplied\ndirectly by the caller instead of being read from the incident's email entity."
        },
        "description": {
          "type": [
            "null",
            "string"
          ]
        },
        "entityType": {
          "$ref": "#/$defs/PlaybookEntityType"
        },
        "affectedEntity": {
          "type": [
            "null",
            "string"
          ]
        },
        "isRecommended": {
          "type": "boolean"
        },
        "status": {
          "$ref": "#/$defs/PlaybookRunningStatus"
        },
        "errorMessage": {
          "type": [
            "null",
            "string"
          ]
        },
        "sequence": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "integer",
            "string"
          ],
          "format": "int32"
        },
        "modificationDate": {
          "type": "string",
          "format": "date-time"
        },
        "startingDate": {
          "type": [
            "null",
            "string"
          ],
          "format": "date-time"
        },
        "finishingDate": {
          "type": [
            "null",
            "string"
          ],
          "format": "date-time"
        },
        "executionTime": {
          "type": [
            "null",
            "string"
          ],
          "description": "Total execution time taken to execute the playbook, the value is null until the DateTime? PlaybookGameplanDto.FinishingDate property is populated"
        },
        "tracingId": {
          "type": [
            "null",
            "string"
          ]
        },
        "parameters": {
          "type": [
            "null",
            "object"
          ],
          "description": "Represents the parameters of the playbooks to be sent in the message\nThe value will be populated only if the playbook is configurable (Block IP)"
        },
        "isAdminRequired": {
          "type": "boolean"
        }
      }
    },
    "PlaybookRunningStatus": {
      "enum": [
        "Pending",
        "Running",
        "Finished",
        "Failed",
        "Terminated"
      ]
    },
    "RecommendedGamebookDto": {
      "type": "object",
      "properties": {
        "aiGamebook": {
          "$ref": "#/$defs/GamebookDto"
        },
        "serviceProviderGamebook": {
          "$ref": "#/$defs/GamebookDto"
        }
      }
    },
    "ResponseMeta": {
      "type": "object",
      "properties": {
        "requestId": {
          "type": [
            "null",
            "string"
          ]
        },
        "timestamp": {
          "type": [
            "null",
            "string"
          ]
        }
      }
    },
    "SentinelIncidentIdentifiers": {
      "type": "object",
      "properties": {
        "armId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The full ARM resource id, e.g.\n`/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{ws}/providers/Microsoft.SecurityInsights/incidents/{guid}`."
        },
        "incidentId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The incident GUID, the last segment of string SentinelIncidentIdentifiers.ArmId."
        },
        "subscriptionId": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Azure subscription holding the Log Analytics workspace."
        },
        "resourceGroupName": {
          "type": [
            "null",
            "string"
          ],
          "description": "The resource group holding the Log Analytics workspace."
        },
        "workspaceName": {
          "type": [
            "null",
            "string"
          ],
          "description": "The Log Analytics workspace name."
        },
        "incidentNumber": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "null",
            "integer",
            "string"
          ],
          "description": "The incident's number within the Sentinel workspace, when known.",
          "format": "int32"
        },
        "portalUrl": {
          "type": [
            "null",
            "string"
          ],
          "description": "Direct link to the incident in the Microsoft Sentinel portal."
        }
      },
      "description": "Microsoft Sentinel's identifiers for an incident."
    },
    "Severity": {
      "enum": [
        "Informational",
        "Low",
        "Medium",
        "High"
      ]
    },
    "Status": {
      "enum": [
        "Active",
        "New",
        "Closed",
        "OnHold",
        "WaitingOnCustomer"
      ]
    },
    "UserSummary": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "email": {
          "type": [
            "null",
            "string"
          ]
        }
      },
      "description": "Represents a light version of the user object, that is used to add reference to a specific user in a foreign entities"
    }
  }
}