High severity.

Informational severity.

Low severity.

Medium severity.

Modify an object's properties.

Run a playbook on an object.

Evaluate an object property value.

Evaluates if the property contains at least one of the condition values.

Evaluates if the property ends with any of the condition values.

Evaluates if the property equals at least one of the condition values.

Evaluates if the property does not contain any of the condition values.

Evaluates if the property does not end with any of the condition values.

Evaluates if the property does not equal any of the condition values.

Evaluates if the property does not start with any of the condition values.

Evaluates if the property starts with any of the condition values.

The account Azure Active Directory tenant id.

The account Azure Active Directory user id.

The account name.

The account NetBIOS domain name.

The account unique identifier.

The account Azure Active Directory Passport User ID.

The account security identifier.

The account user principal name suffix.

The Azure resource id.

The Azure resource subscription id.

The cloud application identifier.

The cloud application name.

The dns record domain name.

The file directory full path.

The file hash value.

The file name without path.

The host Azure resource id.

The host name without domain.

The host NetBIOS name.

The host NT domain.

The host operating system.

The description of the incident.

The provider name of the incident.

The related Analytic rule ids of the incident.

The severity of the incident.

The status of the incident.

The tactics of the incident.

The title of the incident.

The IoT device id.

The IoT device model.

The IoT device name.

The IoT device operating system.

The IoT device type.

The IoT device vendor.

The IP address.

The mailbox display name.

The mailbox primary address.

The mailbox user principal name.

The mail message delivery action.

The mail message delivery location.

The mail message P1 sender.

The mail message P2 sender.

The mail message recipient.

The mail message sender IP address.

The mail message subject.

The malware category.

The malware name.

The process execution command line.

The process id.

The registry key path.

The registry key value in string formatted representation.

The url.

activity.

bookmarks.

security alerts.

Entity represents account in the system.

Entity represents azure resource in the system.

Entity represents cloud application in the system.

Entity represents dns in the system.

Entity represents file in the system.

Entity represents file hash in the system.

Entity represents host in the system.

Entity represents HuntingBookmark in the system.

Entity represents IoT device in the system.

Entity represents ip in the system.

Entity represents mailbox in the system.

Entity represents mail cluster in the system.

Entity represents mail message in the system.

Entity represents malware in the system.

Entity represents process in the system.

Entity represents registry key in the system.

Entity represents registry value in the system.

Entity represents security alert in the system.

Entity represents security group in the system.

Entity represents submission mail in the system.

Entity represents url in the system.

Incident was benign positive.

Incident was false positive.

Classification reason was inaccurate data.

Classification reason was incorrect alert logic.

Classification reason was suspicious activity.

Classification reason was suspicious but expected.

Incident was true positive.

Incident classification was undetermined.

High severity.

Informational severity.

Low severity.

Medium severity.

An active incident which is being handled.

A non-active incident.

An active incident which isn't being handled currently.

Anomaly settings status in Flighting mode.

Anomaly settings status in Production mode.

Entity represents threat intelligence indicator in the system.

Trigger on Incidents.

Trigger on created objects.