Microsoft Azure
Microsoft Azure Common Entity Types

Microsoft Azure Common Entity Types is a tool that helps users easily access and manage different types of entities within the Azure environment. By categorizing entities based on common characteristics, such as virtual machines, databases, storage accounts, and networks, users can efficiently organize and navigate their resources. This tool allows users to quickly identify and interact with specific entities, streamlining the management and operation of their Azure deployments.
Documentation GitHub OpenAPI
Documentation

📖
Documentation
https://learn.microsoft.com/en-us/azure/sentinel/entities-reference
Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/microsoft-azure/refs/heads/main/openapi/common-entity-types-openapi-original.yml
OpenAPI Specification

swagger: '2.0'
info:
  version: 2024-01-01-preview
  title: Microsoft Azure Common Entity types
paths: {}
definitions:
  AccountEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents an account entity.
    properties:
      properties:
        $ref: '#/definitions/AccountEntityProperties'
        description: Account entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Account
  AccountEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Account entity property bag.
    properties:
      aadTenantId:
        description: The Azure Active Directory tenant id.
        readOnly: true
        type: string
      aadUserId:
        description: The Azure Active Directory user id.
        readOnly: true
        type: string
      accountName:
        description: >-
          The name of the account. This field should hold only the name without
          any domain added to it, i.e. administrator.
        readOnly: true
        type: string
      displayName:
        description: The display name of the account.
        readOnly: true
        type: string
      hostEntityId:
        description: >-
          The Host entity id that contains the account in case it is a local
          account (not domain joined)
        readOnly: true
        type: string
      isDomainJoined:
        description: Determines whether this is a domain account.
        readOnly: true
        type: boolean
      ntDomain:
        description: >-
          The NetBIOS domain name as it appears in the alert format
          domain/username. Examples: NT AUTHORITY.
        readOnly: true
        type: string
      objectGuid:
        description: >-
          The objectGUID attribute is a single-value attribute that is the
          unique identifier for the object, assigned by active directory.
        format: uuid
        readOnly: true
        type: string
      puid:
        description: The Azure Active Directory Passport User ID.
        readOnly: true
        type: string
      sid:
        description: The account security identifier, e.g. S-1-5-18.
        readOnly: true
        type: string
      upnSuffix:
        description: >-
          The user principal name suffix for the account, in some cases it is
          also the domain name. Examples: contoso.com.
        readOnly: true
        type: string
      dnsDomain:
        description: The fully qualified domain DNS name.
        readOnly: true
        type: string
    type: object
  AzureResourceEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents an azure resource entity.
    properties:
      properties:
        $ref: '#/definitions/AzureResourceEntityProperties'
        description: AzureResource entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: AzureResource
  AzureResourceEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: AzureResource entity property bag.
    properties:
      resourceId:
        description: The azure resource id of the resource
        readOnly: true
        type: string
      subscriptionId:
        description: The subscription id of the resource
        readOnly: true
        type: string
    type: object
  CloudApplicationEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a cloud application entity.
    properties:
      properties:
        $ref: '#/definitions/CloudApplicationEntityProperties'
        description: CloudApplication entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: CloudApplication
  CloudApplicationEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: CloudApplication entity property bag.
    properties:
      appId:
        description: The technical identifier of the application.
        readOnly: true
        type: integer
        format: int32
      appName:
        description: The name of the related cloud application.
        readOnly: true
        type: string
      instanceName:
        description: >-
          The user defined instance name of the cloud application. It is often
          used to distinguish between several applications of the same type that
          a customer has.
        readOnly: true
        type: string
    type: object
  DnsEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a dns entity.
    properties:
      properties:
        $ref: '#/definitions/DnsEntityProperties'
        description: Dns entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: DnsResolution
  DnsEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Dns entity property bag.
    properties:
      dnsServerIpEntityId:
        description: An ip entity id for the dns server resolving the request
        readOnly: true
        type: string
      domainName:
        description: The name of the dns record associated with the alert
        readOnly: true
        type: string
      hostIpAddressEntityId:
        description: An ip entity id for the dns request client
        readOnly: true
        type: string
      ipAddressEntityIds:
        description: Ip entity identifiers for the resolved ip address.
        items:
          description: Ip entity id
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
    type: object
  Entity:
    allOf:
      - $ref: >-
          ../../../../../../common-types/resource-management/v3/types.json#/definitions/Resource
    properties:
      kind:
        $ref: '#/definitions/EntityInnerKind'
        description: The kind of the entity.
    description: Specific entity.
    discriminator: kind
    type: object
    required:
      - kind
  EntityCommonProperties:
    description: Entity common property bag.
    properties:
      additionalData:
        additionalProperties: true
        description: >-
          A bag of custom fields that should be part of the entity and will be
          presented to the user.
        readOnly: true
        type: object
      friendlyName:
        description: >-
          The graph item display name which is a short humanly readable
          description of the graph item instance. This property is optional and
          might be system generated.
        readOnly: true
        type: string
    type: object
  EntityInnerKind:
    description: The kind of the entity
    enum:
      - Account
      - Host
      - File
      - AzureResource
      - CloudApplication
      - DnsResolution
      - FileHash
      - Ip
      - Malware
      - Process
      - RegistryKey
      - RegistryValue
      - SecurityGroup
      - Url
      - IoTDevice
      - SecurityAlert
      - Bookmark
      - Mailbox
      - MailCluster
      - MailMessage
      - SubmissionMail
      - Nic
    type: string
    x-ms-enum:
      modelAsString: true
      name: EntityKindEnum
      values:
        - description: Entity represents account in the system.
          value: Account
        - description: Entity represents host in the system.
          value: Host
        - description: Entity represents file in the system.
          value: File
        - description: Entity represents azure resource in the system.
          value: AzureResource
        - description: Entity represents cloud application in the system.
          value: CloudApplication
        - description: Entity represents dns resolution in the system.
          value: DnsResolution
        - description: Entity represents file hash in the system.
          value: FileHash
        - description: Entity represents ip in the system.
          value: Ip
        - description: Entity represents malware in the system.
          value: Malware
        - description: Entity represents process in the system.
          value: Process
        - description: Entity represents registry key in the system.
          value: RegistryKey
        - description: Entity represents registry value in the system.
          value: RegistryValue
        - description: Entity represents security group in the system.
          value: SecurityGroup
        - description: Entity represents url in the system.
          value: Url
        - description: Entity represents IoT device in the system.
          value: IoTDevice
        - description: Entity represents security alert in the system.
          value: SecurityAlert
        - description: Entity represents bookmark in the system.
          value: Bookmark
        - description: Entity represents mail cluster in the system.
          value: MailCluster
        - description: Entity represents mail message in the system.
          value: MailMessage
        - description: Entity represents mailbox in the system.
          value: Mailbox
        - description: Entity represents submission mail in the system.
          value: SubmissionMail
        - description: Entity represents network interface in the system.
          value: Nic
  EntityInnerType:
    description: The type of the entity
    enum:
      - Account
      - Host
      - File
      - AzureResource
      - CloudApplication
      - DNS
      - FileHash
      - IP
      - Malware
      - Process
      - RegistryKey
      - RegistryValue
      - SecurityGroup
      - URL
      - IoTDevice
      - SecurityAlert
      - HuntingBookmark
      - MailCluster
      - MailMessage
      - Mailbox
      - SubmissionMail
      - Nic
    type: string
    x-ms-enum:
      modelAsString: true
      name: EntityType
      values:
        - description: Entity represents account in the system.
          value: Account
        - description: Entity represents host in the system.
          value: Host
        - description: Entity represents file in the system.
          value: File
        - description: Entity represents azure resource in the system.
          value: AzureResource
        - description: Entity represents cloud application in the system.
          value: CloudApplication
        - description: Entity represents dns in the system.
          value: DNS
        - description: Entity represents file hash in the system.
          value: FileHash
        - description: Entity represents ip in the system.
          value: IP
        - description: Entity represents malware in the system.
          value: Malware
        - description: Entity represents process in the system.
          value: Process
        - description: Entity represents registry key in the system.
          value: RegistryKey
        - description: Entity represents registry value in the system.
          value: RegistryValue
        - description: Entity represents security group in the system.
          value: SecurityGroup
        - description: Entity represents url in the system.
          value: URL
        - description: Entity represents IoT device in the system.
          value: IoTDevice
        - description: Entity represents security alert in the system.
          value: SecurityAlert
        - description: Entity represents HuntingBookmark in the system.
          value: HuntingBookmark
        - description: Entity represents mail cluster in the system.
          value: MailCluster
        - description: Entity represents mail message in the system.
          value: MailMessage
        - description: Entity represents mailbox in the system.
          value: Mailbox
        - description: Entity represents submission mail in the system.
          value: SubmissionMail
        - description: Entity represents network interface in the system.
          value: Nic
  EntityQueryKind:
    description: The kind of the entity query
    enum:
      - Expansion
      - Insight
      - Activity
    type: string
    x-ms-enum:
      modelAsString: true
      name: EntityQueryKind
      values:
        - value: Expansion
        - value: Insight
        - value: Activity
  ExpansionResultAggregation:
    description: Information of a specific aggregation in the expansion result.
    properties:
      aggregationType:
        description: The common type of the aggregation. (for e.g. entity field name)
        type: string
      count:
        description: >-
          Total number of aggregations of the given kind (and aggregationType if
          given) in the expansion result.
        type: integer
        format: int32
      displayName:
        description: The display name of the aggregation by type.
        type: string
      entityKind:
        $ref: '#/definitions/EntityInnerKind'
        description: The kind of the aggregated entity.
    required:
      - entityKind
      - count
    type: object
  ExpansionResultsMetadata:
    description: Expansion result metadata.
    properties:
      aggregations:
        description: Information of the aggregated nodes in the expansion result.
        items:
          $ref: '#/definitions/ExpansionResultAggregation'
        type: array
        x-ms-identifiers: []
    type: object
  FileEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a file entity.
    properties:
      properties:
        $ref: '#/definitions/FileEntityProperties'
        description: File entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: File
  FileEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: File entity property bag.
    properties:
      directory:
        description: The full path to the file.
        readOnly: true
        type: string
      fileHashEntityIds:
        description: The file hash entity identifiers associated with this file
        items:
          description: file hash id
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      fileName:
        description: The file name without path (some alerts might not include path).
        readOnly: true
        type: string
      hostEntityId:
        description: The Host entity id which the file belongs to
        readOnly: true
        type: string
    type: object
  FileHashEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a file hash entity.
    properties:
      properties:
        $ref: '#/definitions/FileHashEntityProperties'
        description: FileHash entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: FileHash
  FileHashEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: FileHash entity property bag.
    properties:
      algorithm:
        description: The hash algorithm type.
        enum:
          - Unknown
          - MD5
          - SHA1
          - SHA256
          - SHA256AC
        readOnly: true
        type: string
        x-ms-enum:
          modelAsString: true
          name: FileHashAlgorithm
          values:
            - description: Unknown hash algorithm
              value: Unknown
            - description: MD5 hash type
              value: MD5
            - description: SHA1 hash type
              value: SHA1
            - description: SHA256 hash type
              value: SHA256
            - description: SHA256 Authenticode hash type
              value: SHA256AC
      hashValue:
        description: The file hash value.
        readOnly: true
        type: string
    type: object
  HostEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a host entity.
    properties:
      properties:
        $ref: '#/definitions/HostEntityProperties'
        description: Host entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Host
  HostEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Host entity property bag.
    properties:
      azureID:
        description: The azure resource id of the VM.
        readOnly: true
        type: string
      dnsDomain:
        description: >-
          The DNS domain that this host belongs to. Should contain the compete
          DNS suffix for the domain
        readOnly: true
        type: string
      hostName:
        description: The hostname without the domain suffix.
        readOnly: true
        type: string
      isDomainJoined:
        description: Determines whether this host belongs to a domain.
        readOnly: true
        type: boolean
      netBiosName:
        description: The host name (pre-windows2000).
        readOnly: true
        type: string
      ntDomain:
        description: The NT domain that this host belongs to.
        readOnly: true
        type: string
      omsAgentID:
        description: The OMS agent id, if the host has OMS agent installed.
        readOnly: true
        type: string
      osFamily:
        description: The operating system type.
        enum:
          - Linux
          - Windows
          - Android
          - IOS
          - Unknown
        type: string
        x-ms-enum:
          modelAsString: false
          name: OSFamily
          values:
            - description: Host with Linux operating system.
              value: Linux
            - description: Host with Windows operating system.
              value: Windows
            - description: Host with Android operating system.
              value: Android
            - description: Host with IOS operating system.
              value: IOS
            - description: Host with Unknown operating system.
              value: Unknown
      osVersion:
        description: >-
          A free text representation of the operating system. This field is
          meant to hold specific versions the are more fine grained than
          OSFamily or future values not supported by OSFamily enumeration
        readOnly: true
        type: string
    type: object
  HuntingBookmark:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a Hunting bookmark entity.
    properties:
      properties:
        $ref: '#/definitions/HuntingBookmarkProperties'
        description: HuntingBookmark entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Bookmark
  HuntingBookmarkProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Describes bookmark properties
    properties:
      created:
        description: The time the bookmark was created
        format: date-time
        type: string
      createdBy:
        $ref: ../../../../common/2.0/types.json#/definitions/UserInfo
        description: Describes a user that created the bookmark
        type: object
      displayName:
        description: The display name of the bookmark
        type: string
      eventTime:
        description: The time of the event
        format: date-time
        type: string
      labels:
        description: List of labels relevant to this bookmark
        items:
          $ref: ../../../../common/2.0/types.json#/definitions/Label
        type: array
        x-ms-identifiers: []
      notes:
        description: The notes of the bookmark
        type: string
      query:
        description: The query of the bookmark.
        type: string
      queryResult:
        description: The query result of the bookmark.
        type: string
      updated:
        description: The last time the bookmark was updated
        format: date-time
        type: string
      updatedBy:
        $ref: ../../../../common/2.0/types.json#/definitions/UserInfo
        description: Describes a user that updated the bookmark
        type: object
      incidentInfo:
        $ref: IncidentTypes.json#/definitions/IncidentInfo
        description: Describes an incident that relates to bookmark
        type: object
    required:
      - displayName
      - query
    type: object
  IoTDeviceEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents an IoT device entity.
    properties:
      properties:
        $ref: '#/definitions/IoTDeviceEntityProperties'
        description: IoTDevice entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: IoTDevice
  IoTDeviceEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: IoTDevice entity property bag.
    properties:
      deviceId:
        description: The ID of the IoT Device in the IoT Hub
        readOnly: true
        type: string
      deviceName:
        description: The friendly name of the device
        readOnly: true
        type: string
      source:
        description: The source of the device
        readOnly: true
        type: string
      iotSecurityAgentId:
        description: The ID of the security agent running on the device
        format: uuid
        readOnly: true
        type: string
      deviceType:
        description: The type of the device
        readOnly: true
        type: string
      vendor:
        description: The vendor of the device
        readOnly: true
        type: string
      edgeId:
        description: The ID of the edge device
        readOnly: true
        type: string
      macAddress:
        description: The MAC address of the device
        readOnly: true
        type: string
      model:
        description: The model of the device
        readOnly: true
        type: string
      serialNumber:
        description: The serial number of the device
        readOnly: true
        type: string
      firmwareVersion:
        description: The firmware version of the device
        readOnly: true
        type: string
      operatingSystem:
        description: The operating system of the device
        readOnly: true
        type: string
      iotHubEntityId:
        description: The AzureResource entity id of the IoT Hub
        readOnly: true
        type: string
      hostEntityId:
        description: The Host entity id of this device
        readOnly: true
        type: string
      ipAddressEntityId:
        description: The IP entity if of this device
        readOnly: true
        type: string
      threatIntelligence:
        description: A list of TI contexts attached to the IoTDevice entity.
        items:
          $ref: ThreatIntelligenceTypes.json#/definitions/ThreatIntelligence
        readOnly: true
        type: array
        x-ms-identifiers: []
      protocols:
        description: A list of protocols of the IoTDevice entity.
        items:
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      owners:
        description: A list of owners of the IoTDevice entity.
        items:
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      nicEntityIds:
        description: A list of Nic entity ids of the IoTDevice entity.
        items:
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      site:
        description: The site of the device
        readOnly: true
        type: string
      zone:
        description: The zone location of the device within a site
        readOnly: true
        type: string
      sensor:
        description: The sensor the device is monitored by
        readOnly: true
        type: string
      deviceSubType:
        description: The subType of the device ('PLC', 'HMI', 'EWS', etc.)
        readOnly: true
        type: string
      importance:
        description: >-
          Device importance, determines if the device classified as 'crown
          jewel'
        enum:
          - Unknown
          - Low
          - Normal
          - High
        type: string
        x-ms-enum:
          modelAsString: true
          name: DeviceImportance
          values:
            - description: Unknown - Default value
              value: Unknown
            - description: Low
              value: Low
            - description: Normal
              value: Normal
            - description: High
              value: High
      purdueLayer:
        description: The Purdue Layer of the device
        readOnly: true
        type: string
      isAuthorized:
        description: Determines whether the device classified as authorized device
        readOnly: true
        type: boolean
      isProgramming:
        description: Determines whether the device classified as programming device
        readOnly: true
        type: boolean
      isScanner:
        description: Is the device classified as a scanner device
        readOnly: true
        type: boolean
    type: object
  IpEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents an ip entity.
    properties:
      properties:
        $ref: '#/definitions/IpEntityProperties'
        description: Ip entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Ip
  IpEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Ip entity property bag.
    properties:
      address:
        description: The IP address as string, e.g. 127.0.0.1 (either in Ipv4 or Ipv6)
        readOnly: true
        type: string
      location:
        $ref: '#/definitions/GeoLocation'
        description: The geo-location context attached to the ip entity
      threatIntelligence:
        description: A list of TI contexts attached to the ip entity.
        items:
          $ref: ThreatIntelligenceTypes.json#/definitions/ThreatIntelligence
        readOnly: true
        type: array
        x-ms-identifiers: []
    type: object
  GeoLocation:
    description: The geo-location context attached to the ip entity
    properties:
      asn:
        description: Autonomous System Number
        readOnly: true
        type: integer
        format: int32
      city:
        description: City name
        readOnly: true
        type: string
      countryCode:
        description: The country code according to ISO 3166 format
        readOnly: true
        type: string
      countryName:
        description: >-
          Country name according to ISO 3166 Alpha 2: the lowercase of the
          English Short Name
        readOnly: true
        type: string
      latitude:
        description: >-
          The latitude of the identified location, expressed as a floating point
          number with range of - 90 to 90. Latitude and longitude are derived
          from the city or postal code.
        format: double
        readOnly: true
        type: number
      longitude:
        description: >-
          The longitude of the identified location, expressed as a floating
          point number with range of -180 to 180. Latitude and longitude are
          derived from the city or postal code.
        format: double
        readOnly: true
        type: number
      state:
        description: State name
        readOnly: true
        type: string
    readOnly: true
    type: object
  MailboxEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a mailbox entity.
    properties:
      properties:
        $ref: '#/definitions/MailboxEntityProperties'
        description: Mailbox entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Mailbox
  MailboxEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Mailbox entity property bag.
    properties:
      mailboxPrimaryAddress:
        description: The mailbox's primary address
        readOnly: true
        type: string
      displayName:
        description: The mailbox's display name
        readOnly: true
        type: string
      upn:
        description: The mailbox's UPN
        readOnly: true
        type: string
      externalDirectoryObjectId:
        description: >-
          The AzureAD identifier of mailbox. Similar to AadUserId in account
          entity but this property is specific to mailbox object on office side
        format: uuid
        readOnly: true
        type: string
    type: object
  MailClusterEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a mail cluster entity.
    properties:
      properties:
        $ref: '#/definitions/MailClusterEntityProperties'
        description: Mail cluster entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: MailCluster
  MailClusterEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Mail cluster entity property bag.
    properties:
      networkMessageIds:
        description: The mail message IDs that are part of the mail cluster
        items:
          description: A mail message ID
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      countByDeliveryStatus:
        description: Count of mail messages by DeliveryStatus string representation
        readOnly: true
        type: object
      countByThreatType:
        description: Count of mail messages by ThreatType string representation
        readOnly: true
        type: object
      countByProtectionStatus:
        description: Count of mail messages by ProtectionStatus string representation
        readOnly: true
        type: object
      threats:
        description: The threats of mail messages that are part of the mail cluster
        items:
          description: A threat
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      query:
        description: The query that was used to identify the messages of the mail cluster
        readOnly: true
        type: string
      queryTime:
        description: The query time
        format: date-time
        readOnly: true
        type: string
      mailCount:
        description: The number of mail messages that are part of the mail cluster
        readOnly: true
        type: integer
        format: int32
      isVolumeAnomaly:
        description: Is this a volume anomaly mail cluster
        readOnly: true
        type: boolean
      source:
        description: The source of the mail cluster (default is 'O365 ATP')
        readOnly: true
        type: string
      clusterSourceIdentifier:
        description: The id of the cluster source
        readOnly: true
        type: string
      clusterSourceType:
        description: The type of the cluster source
        readOnly: true
        type: string
      clusterQueryStartTime:
        description: The cluster query start time
        format: date-time
        readOnly: true
        type: string
      clusterQueryEndTime:
        description: The cluster query end time
        format: date-time
        readOnly: true
        type: string
      clusterGroup:
        description: The cluster group
        readOnly: true
        type: string
    type: object
  MailMessageEntity:
    allOf:
      - $ref: '#/definitions/Entity'
    description: Represents a mail message entity.
    properties:
      properties:
        $ref: '#/definitions/MailMessageEntityProperties'
        description: Mail message entity properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: MailMessage
  MailMessageEntityProperties:
    allOf:
      - $ref: '#/definitions/EntityCommonProperties'
    description: Mail message entity property bag.
    properties:
      fileEntityIds:
        description: The File entity ids of this mail message's attachments
        items:
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      recipient:
        description: >-
          The recipient of this mail message. Note that in case of multiple
          recipients the mail message is forked and each copy has one recipient
        readOnly: true
        type: string
      urls:
        description: The Urls contained in this mail message
        items:
          description: A Url contained in this mail message
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      threats:
        description: The threats of this mail message
        items:
          description: A threat of the mail message
          type: string
        readOnly: true
        type: array
        x-ms-identifiers: []
      p1Sender:
        description: The p1 sender's email address
        readOnly: true
        typ

# --- truncated at 32 KB (61 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-azure/refs/heads/main/openapi/common-entity-types-openapi-original.yml