none
Office 365 Advanced Threat Protection and Threat Investigation and Response schema: reference to values. RRS feed

  • Question

  • Hello

    When I was looking through the logs we are polling from the API I came upon something I cannot find in the documentation. The logs in question are from "Office 365 Advanced Threat Protection and Threat Investigation and Response schema".

    This is an example that I cannot find any reference to in det doc (https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#policy-type-and-action-type).
    ---
    DetectionMethod: ATP safe attachments    
    ...
    Policy: 10    
    PolicyAction: 8    
    ---
    The policy goes from 1-7 and PolicyAction 0-7. Where can I find what the number in question are referencing to? I guess it might be a custom policy but how do I actually find this out?

    //Victor
    • Edited by Victor_5011 Wednesday, October 16, 2019 4:11 PM Better references
    Wednesday, October 16, 2019 4:10 PM