{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://artifacts.apis.io/microsoft-intune/json-schema/microsoft-intune-microsoft-graph-windows-protection-state-schema.json", "title": "microsoft.graph.windowsProtectionState", "x-generated": "2026-11-04", "x-method": "derived", "x-generator": "derive-json-schema.py", "x-source": "openapi/microsoft-intune-openapi.yml#/components/schemas/microsoft.graph.windowsProtectionState", "allOf": [ { "$ref": "#/$defs/microsoft.graph.entity" }, { "title": "windowsProtectionState", "required": [ "@odata.type" ], "type": "object", "properties": { "antiMalwareVersion": { "type": [ "string", "null" ], "description": "Current anti malware version" }, "controlledConfigurationEnabled": { "type": [ "boolean", "null" ], "description": "When TRUE indicates the Windows Defender controlled configuration feature is enabled, when FALSE indicates the Windows Defender controlled configuration feature is not enabled. Defaults to setting on client device." }, "deviceState": { "anyOf": [ { "$ref": "#/$defs/microsoft.graph.windowsDeviceHealthState" }, { "type": [ "object", "null" ] } ], "description": "Indicates device's health state. The possible values are: clean, fullScanPending, rebootPending, manualStepsPending, offlineScanPending, critical. The possible values are: clean, fullScanPending, rebootPending, manualStepsPending, offlineScanPending, critical." }, "engineVersion": { "type": [ "string", "null" ], "description": "Current endpoint protection engine's version" }, "fullScanOverdue": { "type": [ "boolean", "null" ], "description": "When TRUE indicates full scan is overdue, when FALSE indicates full scan is not overdue. Defaults to setting on client device." }, "fullScanRequired": { "type": [ "boolean", "null" ], "description": "When TRUE indicates full scan is required, when FALSE indicates full scan is not required. Defaults to setting on client device." }, "isVirtualMachine": { "type": [ "boolean", "null" ], "description": "When TRUE indicates the device is a virtual machine, when FALSE indicates the device is not a virtual machine. Defaults to setting on client device." }, "lastFullScanDateTime": { "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$", "type": [ "string", "null" ], "description": "Last quick scan datetime", "format": "date-time" }, "lastFullScanSignatureVersion": { "type": [ "string", "null" ], "description": "Last full scan signature version" }, "lastQuickScanDateTime": { "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$", "type": [ "string", "null" ], "description": "Last quick scan datetime", "format": "date-time" }, "lastQuickScanSignatureVersion": { "type": [ "string", "null" ], "description": "Last quick scan signature version" }, "lastReportedDateTime": { "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$", "type": [ "string", "null" ], "description": "Last device health status reported time", "format": "date-time" }, "malwareProtectionEnabled": { "type": [ "boolean", "null" ], "description": "When TRUE indicates anti malware is enabled when FALSE indicates anti malware is not enabled." }, "networkInspectionSystemEnabled": { "type": [ "boolean", "null" ], "description": "When TRUE indicates network inspection system enabled, when FALSE indicates network inspection system is not enabled. Defaults to setting on client device." }, "productStatus": { "anyOf": [ { "$ref": "#/$defs/microsoft.graph.windowsDefenderProductStatus" }, { "type": [ "object", "null" ] } ], "description": "Product Status of Windows Defender Antivirus. The possible values are: noStatus, serviceNotRunning, serviceStartedWithoutMalwareProtection, pendingFullScanDueToThreatAction, pendingRebootDueToThreatAction, pendingManualStepsDueToThreatAction, avSignaturesOutOfDate, asSignaturesOutOfDate, noQuickScanHappenedForSpecifiedPeriod, noFullScanHappenedForSpecifiedPeriod, systemInitiatedScanInProgress, systemInitiatedCleanInProgress, samplesPendingSubmission, productRunningInEvaluationMode, productRunningInNonGenuineMode, productExpired, offlineScanRequired, serviceShutdownAsPartOfSystemShutdown, threatRemediationFailedCritically, threatRemediationFailedNonCritically, noStatusFlagsSet, platformOutOfDate, platformUpdateInProgress, platformAboutToBeOutdated, signatureOrPlatformEndOfLifeIsPastOrIsImpending, windowsSModeSignaturesInUseOnNonWin10SInstall. The possible values are: noStatus, serviceNotRunning, serviceStartedWithoutMalwareProtection, pendingFullScanDueToThreatAction, pendingRebootDueToThreatAction, pendingManualStepsDueToThreatAction, avSignaturesOutOfDate, asSignaturesOutOfDate, noQuickScanHappenedForSpecifiedPeriod, noFullScanHappenedForSpecifiedPeriod, systemInitiatedScanInProgress, systemInitiatedCleanInProgress, samplesPendingSubmission, productRunningInEvaluationMode, productRunningInNonGenuineMode, productExpired, offlineScanRequired, serviceShutdownAsPartOfSystemShutdown, threatRemediationFailedCritically, threatRemediationFailedNonCritically, noStatusFlagsSet, platformOutOfDate, platformUpdateInProgress, platformAboutToBeOutdated, signatureOrPlatformEndOfLifeIsPastOrIsImpending, windowsSModeSignaturesInUseOnNonWin10SInstall." }, "quickScanOverdue": { "type": [ "boolean", "null" ], "description": "When TRUE indicates quick scan is overdue, when FALSE indicates quick scan is not overdue. Defaults to setting on client device." }, "realTimeProtectionEnabled": { "type": [ "boolean", "null" ], "description": "When TRUE indicates real time protection is enabled, when FALSE indicates real time protection is not enabled. Defaults to setting on client device." }, "rebootRequired": { "type": [ "boolean", "null" ], "description": "When TRUE indicates reboot is required, when FALSE indicates when TRUE indicates reboot is not required. Defaults to setting on client device." }, "signatureUpdateOverdue": { "type": [ "boolean", "null" ], "description": "When TRUE indicates signature is out of date, when FALSE indicates signature is not out of date. Defaults to setting on client device." }, "signatureVersion": { "type": [ "string", "null" ], "description": "Current malware definitions version" }, "tamperProtectionEnabled": { "type": [ "boolean", "null" ], "description": "When TRUE indicates the Windows Defender tamper protection feature is enabled, when FALSE indicates the Windows Defender tamper protection feature is not enabled. Defaults to setting on client device." }, "detectedMalwareState": { "type": "array", "items": { "$ref": "#/$defs/microsoft.graph.windowsDeviceMalwareState" }, "description": "Device malware list", "x-ms-navigationProperty": true }, "@odata.type": { "type": "string" } }, "description": "Device protection status entity." } ], "x-ms-discriminator-value": "#microsoft.graph.windowsProtectionState", "$defs": { "microsoft.graph.entity": { "title": "entity", "required": [ "@odata.type" ], "type": "object", "properties": { "id": { "type": "string", "description": "The unique identifier for an entity. Read-only." }, "@odata.type": { "type": "string" } } }, "microsoft.graph.windowsDefenderProductStatus": { "title": "windowsDefenderProductStatus", "enum": [ "noStatus", "serviceNotRunning", "serviceStartedWithoutMalwareProtection", "pendingFullScanDueToThreatAction", "pendingRebootDueToThreatAction", "pendingManualStepsDueToThreatAction", "avSignaturesOutOfDate", "asSignaturesOutOfDate", "noQuickScanHappenedForSpecifiedPeriod", "noFullScanHappenedForSpecifiedPeriod", "systemInitiatedScanInProgress", "systemInitiatedCleanInProgress", "samplesPendingSubmission", "productRunningInEvaluationMode", "productRunningInNonGenuineMode", "productExpired", "offlineScanRequired", "serviceShutdownAsPartOfSystemShutdown", "threatRemediationFailedCritically", "threatRemediationFailedNonCritically", "noStatusFlagsSet", "platformOutOfDate", "platformUpdateInProgress", "platformAboutToBeOutdated", "signatureOrPlatformEndOfLifeIsPastOrIsImpending", "windowsSModeSignaturesInUseOnNonWin10SInstall" ], "type": "string", "description": "Product Status of Windows Defender", "x-ms-enum-flags": { "isFlags": true }, "x-ms-enum": { "name": "windowsDefenderProductStatus", "modelAsString": false, "values": [ { "value": "noStatus", "description": "No status", "name": "noStatus" }, { "value": "serviceNotRunning", "description": "Service not running", "name": "serviceNotRunning" }, { "value": "serviceStartedWithoutMalwareProtection", "description": "Service started without any malware protection engine", "name": "serviceStartedWithoutMalwareProtection" }, { "value": "pendingFullScanDueToThreatAction", "description": "Pending full scan due to threat action", "name": "pendingFullScanDueToThreatAction" }, { "value": "pendingRebootDueToThreatAction", "description": "Pending reboot due to threat action", "name": "pendingRebootDueToThreatAction" }, { "value": "pendingManualStepsDueToThreatAction", "description": "Pending manual steps due to threat action", "name": "pendingManualStepsDueToThreatAction" }, { "value": "avSignaturesOutOfDate", "description": "Antivirus (AV) signatures out of date", "name": "avSignaturesOutOfDate" }, { "value": "asSignaturesOutOfDate", "description": "Antisypware (AS) signatures out of date", "name": "asSignaturesOutOfDate" }, { "value": "noQuickScanHappenedForSpecifiedPeriod", "description": "No quick scan has happened for a specified period", "name": "noQuickScanHappenedForSpecifiedPeriod" }, { "value": "noFullScanHappenedForSpecifiedPeriod", "description": "No full scan has happened for a specified period", "name": "noFullScanHappenedForSpecifiedPeriod" }, { "value": "systemInitiatedScanInProgress", "description": "System initiated scan in progress", "name": "systemInitiatedScanInProgress" }, { "value": "systemInitiatedCleanInProgress", "description": "System initiated clean in progress", "name": "systemInitiatedCleanInProgress" }, { "value": "samplesPendingSubmission", "description": "There are samples pending submission", "name": "samplesPendingSubmission" }, { "value": "productRunningInEvaluationMode", "description": "Product running in evaluation mode", "name": "productRunningInEvaluationMode" }, { "value": "productRunningInNonGenuineMode", "description": "Product running in non-genuine Windows mode", "name": "productRunningInNonGenuineMode" }, { "value": "productExpired", "description": "Product expired", "name": "productExpired" }, { "value": "offlineScanRequired", "description": "Off-line scan required", "name": "offlineScanRequired" }, { "value": "serviceShutdownAsPartOfSystemShutdown", "description": "Service is shutting down as part of system shutdown", "name": "serviceShutdownAsPartOfSystemShutdown" }, { "value": "threatRemediationFailedCritically", "description": "Threat remediation failed critically", "name": "threatRemediationFailedCritically" }, { "value": "threatRemediationFailedNonCritically", "description": "Threat remediation failed non-critically", "name": "threatRemediationFailedNonCritically" }, { "value": "noStatusFlagsSet", "description": "No status flags set (well initialized state)", "name": "noStatusFlagsSet" }, { "value": "platformOutOfDate", "description": "Platform is out of date", "name": "platformOutOfDate" }, { "value": "platformUpdateInProgress", "description": "Platform update is in progress", "name": "platformUpdateInProgress" }, { "value": "platformAboutToBeOutdated", "description": "Platform is about to be outdated", "name": "platformAboutToBeOutdated" }, { "value": "signatureOrPlatformEndOfLifeIsPastOrIsImpending", "description": "Signature or platform end of life is past or is impending", "name": "signatureOrPlatformEndOfLifeIsPastOrIsImpending" }, { "value": "windowsSModeSignaturesInUseOnNonWin10SInstall", "description": "Windows SMode signatures still in use on non-Win10S install", "name": "windowsSModeSignaturesInUseOnNonWin10SInstall" } ] } }, "microsoft.graph.windowsDeviceHealthState": { "title": "windowsDeviceHealthState", "enum": [ "clean", "fullScanPending", "rebootPending", "manualStepsPending", "offlineScanPending", "critical" ], "type": "string", "description": "Computer endpoint protection state", "x-ms-enum-flags": { "isFlags": true }, "x-ms-enum": { "name": "windowsDeviceHealthState", "modelAsString": false, "values": [ { "value": "clean", "description": "Computer is clean and no action is required", "name": "clean" }, { "value": "fullScanPending", "description": "Computer is in pending full scan state", "name": "fullScanPending" }, { "value": "rebootPending", "description": "Computer is in pending reboot state", "name": "rebootPending" }, { "value": "manualStepsPending", "description": "Computer is in pending manual steps state", "name": "manualStepsPending" }, { "value": "offlineScanPending", "description": "Computer is in pending offline scan state", "name": "offlineScanPending" }, { "value": "critical", "description": "Computer is in critical failure state", "name": "critical" } ] } }, "microsoft.graph.windowsDeviceMalwareState": { "allOf": [ { "$ref": "#/$defs/microsoft.graph.entity" }, { "title": "windowsDeviceMalwareState", "required": [ "@odata.type" ], "type": "object", "properties": { "additionalInformationUrl": { "type": [ "string", "null" ], "description": "Information URL to learn more about the malware" }, "category": { "anyOf": [ { "$ref": "#/$defs/microsoft.graph.windowsMalwareCategory" }, { "type": [ "object", "null" ] } ], "description": "Category of the malware. The possible values are: invalid, adware, spyware, passwordStealer, trojanDownloader, worm, backdoor, remoteAccessTrojan, trojan, emailFlooder, keylogger, dialer, monitoringSoftware, browserModifier, cookie, browserPlugin, aolExploit, nuker, securityDisabler, jokeProgram, hostileActiveXControl, softwareBundler, stealthNotifier, settingsModifier, toolBar, remoteControlSoftware, trojanFtp, potentialUnwantedSoftware, icqExploit, trojanTelnet, exploit, filesharingProgram, malwareCreationTool, remoteControlSoftware, tool, trojanDenialOfService, trojanDropper, trojanMassMailer, trojanMonitoringSoftware, trojanProxyServer, virus, known, unknown, spp, behavior, vulnerability, policy, enterpriseUnwantedSoftware, ransom, hipsRule." }, "detectionCount": { "maximum": 2147483647, "minimum": -2147483648, "type": [ "number", "null" ], "description": "Number of times the malware is detected", "format": "int32" }, "displayName": { "type": [ "string", "null" ], "description": "Malware name" }, "executionState": { "anyOf": [ { "$ref": "#/$defs/microsoft.graph.windowsMalwareExecutionState" }, { "type": [ "object", "null" ] } ], "description": "Execution status of the malware like blocked/executing etc. The possible values are: unknown, blocked, allowed, running, notRunning." }, "initialDetectionDateTime": { "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$", "type": [ "string", "null" ], "description": "Initial detection datetime of the malware", "format": "date-time" }, "lastStateChangeDateTime": { "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$", "type": [ "string", "null" ], "description": "The last time this particular threat was changed", "format": "date-time" }, "severity": { "anyOf": [ { "$ref": "#/$defs/microsoft.graph.windowsMalwareSeverity" }, { "type": [ "object", "null" ] } ], "description": "Severity of the malware. The possible values are: unknown, low, moderate, high, severe." }, "state": { "anyOf": [ { "$ref": "#/$defs/microsoft.graph.windowsMalwareState" }, { "type": [ "object", "null" ] } ], "description": "Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: unknown, detected, cleaned, quarantined, removed, allowed, blocked, cleanFailed, quarantineFailed, removeFailed, allowFailed, abandoned, blockFailed." }, "threatState": { "anyOf": [ { "$ref": "#/$defs/microsoft.graph.windowsMalwareThreatState" }, { "type": [ "object", "null" ] } ], "description": "Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: active, actionFailed, manualStepsRequired, fullScanRequired, rebootRequired, remediatedWithNonCriticalFailures, quarantined, removed, cleaned, allowed, noStatusCleared." }, "@odata.type": { "type": "string" } }, "description": "Malware detection entity." } ], "x-ms-discriminator-value": "#microsoft.graph.windowsDeviceMalwareState" }, "microsoft.graph.windowsMalwareCategory": { "title": "windowsMalwareCategory", "enum": [ "invalid", "adware", "spyware", "passwordStealer", "trojanDownloader", "worm", "backdoor", "remoteAccessTrojan", "trojan", "emailFlooder", "keylogger", "dialer", "monitoringSoftware", "browserModifier", "cookie", "browserPlugin", "aolExploit", "nuker", "securityDisabler", "jokeProgram", "hostileActiveXControl", "softwareBundler", "stealthNotifier", "settingsModifier", "toolBar", "remoteControlSoftware", "trojanFtp", "potentialUnwantedSoftware", "icqExploit", "trojanTelnet", "exploit", "filesharingProgram", "malwareCreationTool", "remote_Control_Software", "tool", "trojanDenialOfService", "trojanDropper", "trojanMassMailer", "trojanMonitoringSoftware", "trojanProxyServer", "virus", "known", "unknown", "spp", "behavior", "vulnerability", "policy", "enterpriseUnwantedSoftware", "ransom", "hipsRule" ], "type": "string", "description": "Malware category id", "x-ms-enum": { "name": "windowsMalwareCategory", "modelAsString": false, "values": [ { "value": "invalid", "description": "Invalid", "name": "invalid" }, { "value": "adware", "description": "Adware", "name": "adware" }, { "value": "spyware", "description": "Spyware", "name": "spyware" }, { "value": "passwordStealer", "description": "Password stealer", "name": "passwordStealer" }, { "value": "trojanDownloader", "description": "Trojan downloader", "name": "trojanDownloader" }, { "value": "worm", "description": "Worm", "name": "worm" }, { "value": "backdoor", "description": "Backdoor", "name": "backdoor" }, { "value": "remoteAccessTrojan", "description": "Remote access Trojan", "name": "remoteAccessTrojan" }, { "value": "trojan", "description": "Trojan", "name": "trojan" }, { "value": "emailFlooder", "description": "Email flooder", "name": "emailFlooder" }, { "value": "keylogger", "description": "Keylogger", "name": "keylogger" }, { "value": "dialer", "description": "Dialer", "name": "dialer" }, { "value": "monitoringSoftware", "description": "Monitoring software", "name": "monitoringSoftware" }, { "value": "browserModifier", "description": "Browser modifier", "name": "browserModifier" }, { "value": "cookie", "description": "Cookie", "name": "cookie" }, { "value": "browserPlugin", "description": "Browser plugin", "name": "browserPlugin" }, { "value": "aolExploit", "description": "AOL exploit", "name": "aolExploit" }, { "value": "nuker", "description": "Nuker", "name": "nuker" }, { "value": "securityDisabler", "description": "Security disabler", "name": "securityDisabler" }, { "value": "jokeProgram", "description": "Joke program", "name": "jokeProgram" }, { "value": "hostileActiveXControl", "description": "Hostile ActiveX control", "name": "hostileActiveXControl" }, { "value": "softwareBundler", "description": "Software bundler", "name": "softwareBundler" }, { "value": "stealthNotifier", "description": "Stealth modifier", "name": "stealthNotifier" }, { "value": "settingsModifier", "description": "Settings modifier", "name": "settingsModifier" }, { "value": "toolBar", "description": "Toolbar", "name": "toolBar" }, { "value": "remoteControlSoftware", "description": "Remote control software", "name": "remoteControlSoftware" }, { "value": "trojanFtp", "description": "Trojan FTP", "name": "trojanFtp" }, { "value": "potentialUnwantedSoftware", "description": "Potential unwanted software", "name": "potentialUnwantedSoftware" }, { "value": "icqExploit", "description": "ICQ exploit", "name": "icqExploit" }, { "value": "trojanTelnet", "description": "Trojan telnet", "name": "trojanTelnet" }, { "value": "exploit", "description": "Exploit", "name": "exploit" }, { "value": "filesharingProgram", "description": "File sharing program", "name": "filesharingProgram" }, { "value": "malwareCreationTool", "description": "Malware creation tool", "name": "malwareCreationTool" }, { "value": "remote_Control_Software", "description": "Remote control software", "name": "remote_Control_Software" }, { "value": "tool", "description": "Tool", "name": "tool" }, { "value": "trojanDenialOfService", "description": "Trojan denial of service", "name": "trojanDenialOfService" }, { "value": "trojanDropper", "description": "Trojan dropper", "name": "trojanDropper" }, { "value": "trojanMassMailer", "description": "Trojan mass mailer", "name": "trojanMassMailer" }, { "value": "trojanMonitoringSoftware", "description": "Trojan monitoring software", "name": "trojanMonitoringSoftware" }, { "value": "trojanProxyServer", "description": "Trojan proxy server", "name": "trojanProxyServer" }, { "value": "virus", "description": "Virus", "name": "virus" }, { "value": "known", "description": "Known", "name": "known" }, { "value": "unknown", "description": "Unknown", "name": "unknown" }, { "value": "spp", "description": "SPP", "name": "spp" }, { "value": "behavior", "description": "Behavior", "name": "behavior" }, { "value": "vulnerability", "description": "Vulnerability", "name": "vulnerability" }, { "value": "policy", "description": "Policy", "name": "policy" }, { "value": "enterpriseUnwantedSoftware", "description": "Enterprise Unwanted Software", "name": "enterpriseUnwantedSoftware" }, { "value": "ransom", "description": "Ransom", "name": "ransom" }, { "value": "hipsRule", "description": "HIPS Rule", "name": "hipsRule" } ] } }, "microsoft.graph.windowsMalwareExecutionState": { "title": "windowsMalwareExecutionState", "enum": [ "unknown", "blocked", "allowed", "running", "notRunning" ], "type": "string", "description": "Malware execution status", "x-ms-enum": { "name": "windowsMalwareExecutionState", "modelAsString": false, "values": [ { "value": "unknown", "description": "Unknown", "name": "unknown" }, { "value": "blocked", "description": "Blocked", "name": "blocked" }, { "value": "allowed", "description": "Allowed", "name": "allowed" }, { "value": "running", "description": "Running", "name": "running" }, { "value": "notRunning", "description": "Not running", "name": "notRunning" } ] } }, "microsoft.graph.windowsMalwareSeverity": { "title": "windowsMalwareSeverity", "enum": [ "unknown", "low", "moderate", "high", "severe" ], "type": "string", "description": "Malware severity", "x-ms-enum": { "name": "windowsMalwareSeverity", "modelAsString": false, "values": [ { "value": "unknown", "description": "Unknown", "name": "unknown" }, { "value": "low", "description": "Low", "name": "low" }, { "value": "moderate", "description": "Moderate", "name": "moderate" }, { "value": "high", "description": "High", "name": "high" }, { "value": "severe", "description": "Severe", "name": "severe" } ] } }, "microsoft.graph.windowsMalwareState": { "title": "windowsMalwareState", "enum": [ "unknown", "detected", "cleaned", "quarantined", "removed", "allowed", "blocked", "cleanFailed", "quarantineFailed", "removeFailed", "allowFailed", "abandoned", "blockFailed" ], "type": "string", "description": "Malware current status", "x-ms-enum": { "name": "windowsMalwareState", "modelAsString": false, "values": [ { "value": "unknown", "description": "Unknown", "name": "unknown" }, { "value": "detected", "description": "Detected", "name": "detected" }, { "value": "cleaned", "description": "Cleaned", "name": "cleaned" }, { "value": "quarantined", "description": "Quarantined", "name": "quarantined" }, { "value": "removed", "description": "Removed", "name": "removed" }, { "value": "allowed", "description": "Allowed", "name": "allowed" }, { "value": "blocked", "description": "Blocked", "name": "blocked" }, { "value": "cleanFailed", "description": "Clean failed", "name": "cleanFailed" }, { "value": "quarantineFailed", "description": "Quarantine failed", "name": "quarantineFailed" }, { "value": "removeFailed", "description": "Remove failed", "name": "removeFailed" }, { "value": "allowFailed", "description": "Allow failed", "name": "allowFailed" }, { "value": "abandoned", "description": "Abandoned", "name": "abandoned" }, { "value": "blockFailed", "description": "Block failed", "name": "blockFailed" } ] } }, "microsoft.graph.windowsMalwareThreatState": { "title": "windowsMalwareThreatState", "enum": [ "active", "actionFailed", "manualStepsRequired", "fullScanRequired", "rebootRequired", "remediatedWithNonCriticalFailures", "quarantined", "removed", "cleaned", "allowed", "noStatusCleared" ], "type": "string", "description": "Malware threat status", "x-ms-enum": { "name": "windowsMalwareThreatState", "modelAsString": false, "values": [ { "value": "active", "description": "Active", "name": "active" }, { "value": "actionFailed", "description": "Action failed", "name": "actionFailed" }, { "value": "manualStepsRequired", "description": "Manual steps required", "name": "manualStepsRequired" }, { "value": "fullScanRequired", "description": "Full scan required", "name": "fullScanRequired" }, { "value": "rebootRequired", "description": "Reboot required", "name": "rebootRequired" }, { "value": "remediatedWithNonCriticalFailures", "description": "Remediated with non critical failures ", "name": "remediatedWithNonCriticalFailures" }, { "value": "quarantined", "description": "Quarantined", "name": "quarantined" }, { "value": "removed", "description": "Removed", "name": "removed" }, { "value": "cleaned", "description": "Cleaned", "name": "cleaned" }, { "value": "allowed", "description": "Allowed", "name": "allowed" }, { "value": "noStatusCleared", "description": "No status cleared", "name": "noStatusCleared" } ] } } } }