Skip to content

security-airinvestigationdata.md

Latest commit

 

History

History
41 lines (31 loc) · 1.24 KB

security-airinvestigationdata.md

File metadata and controls

41 lines (31 loc) · 1.24 KB
title airInvestigationData resource type
description Represents an audit record for Automated Investigation and Response (AIR) investigation events.
author diksha27
ms.subservice compliance
ms.localizationpriority medium
doc_type resourcePageType
ms.date 03/05/2026
toc.title AIR investigation data

airInvestigationData resource type

Namespace: microsoft.graph.security

[!INCLUDE beta-disclaimer]

Represents an audit record for Automated Investigation and Response (AIR) investigation events. This resource captures information about automated threat investigations initiated by Microsoft Defender, including investigation triggers, findings, and outcomes.

Inherits from microsoft.graph.security.auditData. The audit data for this record type is returned as the auditData property in an auditLogRecord.

Properties

None.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.airInvestigationData"
}