AttackSimulation.Read.All

Allows the app to read attack simulation and training data for an organization for the signed-in user.

Graph Methods

Type: A = Application Permission, D = Delegate Permission

Ver	Type	Method
V1	A,D	GET /reports/getAttackSimulationRepeatOffenders
V1	A,D	GET /reports/getAttackSimulationSimulationUserCoverage
V1	A,D	GET /reports/getAttackSimulationTrainingUserCoverage
V1	A,D	GET /reports/security/getAttackSimulationRepeatOffenders
V1	A,D	GET /reports/security/getAttackSimulationSimulationUserCoverage
V1	A,D	GET /reports/security/getAttackSimulationTrainingUserCoverage
V1	A,D	GET /security/attackSimulation/operations/{operationsId}
V1	A,D	GET /security/attackSimulation/payloads?$filter=source eq 'Tenant'
V1	A,D	GET /security/attackSimulation/payloads/{payloadId}
V1	A,D	GET /security/attackSimulation/payloads/{payloadId}/detail
V1	A,D	GET /security/attackSimulation/simulationAutomations
V1	A,D	GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}
V1	A,D	GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}/runs
V1	A,D	GET /security/attackSimulation/simulations
V1	A,D	GET /security/attackSimulation/simulations/{simulationId}
V1	A,D	GET /security/attackSimulation/simulations/{simulationId}/excludedAccountTarget
V1	A,D	GET /security/attackSimulation/simulations/{simulationId}/includedAccountTarget
V1	A,D	GET /security/attackSimulation/simulations/{simulationId}/report/overview
V1	A,D	GET /security/attackSimulation/simulations/{simulationId}/report/simulationUsers

Delegate Permission

Id	104a7a4b-ca76-4677-b7e7-2f4bc482f381
Consent Type	Admin
Display String	Read attack simulation data of an organization
Description	Allows the app to read attack simulation and training data for an organization for the signed-in user.

Application Permission

Id	93283d0a-6322-4fa8-966b-8c121624760d
Display String	Read attack simulation data of an organization
Description	Allows the app to read attack simulation and training data for an organization without a signed-in user.

Resources

accountTargetContent

Property	Type	Description
type	accountTargetContentType	The type of account target content. Possible values are: unknown,includeAll, addressBook, unknownFutureValue.

attackSimulationOperation

Property	Type	Description
createdDateTime	DateTimeOffset	Operation created date time. Inherited from longRunningOperation.
id	String	The unique identifier for the operation. Inherited from entity.
lastActionDateTime	DateTimeOffset	The time of the last action in the operation. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from longRunningOperation.
percentageCompleted	Int32	Percentage of completion of the respective operation.
resourceLocation	String	URI of the resource location. Inherited from longRunningOperation.
status	longRunningOperationStatus	Operation status. The possible values are: notStarted, running, succeeded, failed, unknownFutureValue. Inherited from longRunningOperation.
statusDetail	String	Status detail of the operation. Inherited from longRunningOperation.
tenantId	String	Tenant identifier.
type	attackSimulationOperationType	The attack simulation operation type. Possible values are: createSimulation, updateSimulation, unknownFutureValue.

attackSimulationRepeatOffender

Property	Type	Description
attackSimulationUser	attackSimulationUser	The user in an attack simulation and training campaign.
repeatOffenceCount	Int32	Number of repeat offences of the user in attack simulation and training campaigns.

attackSimulationSimulationUserCoverage

Property	Type	Description
attackSimulationUser	attackSimulationUser	User in an attack simulation and training campaign.
clickCount	Int32	Number of link clicks in the received payloads by the user in attack simulation and training campaigns.
compromisedCount	Int32	Number of compromising actions by the user in attack simulation and training campaigns.
latestSimulationDateTime	DateTimeOffset	Date and time of the latest attack simulation and training campaign that the user was included in.
simulationCount	Int32	Number of attack simulation and training campaigns that the user was included in.

attackSimulationTrainingUserCoverage

Property	Type	Description
attackSimulationUser	attackSimulationUser	User in an attack simulation and training campaign.
userTrainings	userTrainingStatusInfo collection	List of assigned trainings and their statuses for the user.

payload

Property	Type	Description
brand	payloadBrand	The branch of a payload. Possible values are: unknown, other, americanExpress, capitalOne, dhl, docuSign, dropbox, facebook, firstAmerican, microsoft, netflix, scotiabank, stewartTitle, tesco, wellsFargo, syrinxCloud, adobe, teams, zoom, unknownFutureValue.
complexity	payloadComplexity	The complexity of a payload.Possible values are: unknown, low, medium, high, unknownFutureValue
createdBy	emailIdentity	Identity of the user who created the attack simulation and training campaign payload.
createdDateTime	DateTimeOffset	Date and time when the attack simulation and training campaign payload.
description	String	Description of the attack simulation and training campaign payload.
detail	payloadDetail	Additional details about the payload.
displayName	String	Display name of the attack simulation and training campaign payload. Supports $filter and $orderby.
id	String	Unique identifier for the attack simulation and training campaign payload. Inherited from entity.
industry	payloadIndustry	Industry of a payload. Possible values are: unknown, other, banking, businessServices, consumerServices, education, energy, construction, consulting, financialServices, government, hospitality, insurance, legal, courierServices, IT, healthcare, manufacturing, retail, telecom, realEstate, unknownFutureValue.
isAutomated	Boolean	Indicates whether the attack simulation and training campaign payload was created from an automation flow. Supports $filter and $orderby.
isControversial	Boolean	Indicates whether the payload is controversial.
isCurrentEvent	Boolean	Indicates whether the payload is from any recent event.
language	String	Payload language.
lastModifiedBy	emailIdentity	Identity of the user who most recently modified the attack simulation and training campaign payload.
lastModifiedDateTime	DateTimeOffset	Date and time when the attack simulation and training campaign payload was last modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
payloadTags	String collection	Free text tags for a payload.
platform	payloadDeliveryPlatform	The payload delivery platform for a simulation. Possible values are: unknown, sms, email, teams, unknownFutureValue.
predictedCompromiseRate	Double	Predicted probability for a payload to phish a targeted user.
simulationAttackType	simulationAttackType	Attack type of the attack simulation and training campaign. Supports $filter and $orderby. Possible values are: unknown, social, cloud, endpoint, unknownFutureValue.
source	simulationContentSource	Simulation content source. Supports $filter and $orderby. Possible values are: unknown, tenant, global, unknownFutureValue. Inherited from simulation.
status	simulationContentStatus	Simulation content status. Supports $filter and $orderby. Possible values are: unknown, draft, ready, archive, delete, unknownFutureValue. Inherited from simulation.
technique	simulationAttackTechnique	The social engineering technique used in the attack simulation and training campaign. Supports $filter and $orderby. Possible values are: unknown, credentialHarvesting, attachmentMalware, driveByUrl, linkInAttachment, linkToMalwareFile, unknownFutureValue. For more information on the types of social engineering attack techniques, see simulations.
theme	payloadTheme	The theme of a payload. Possible values are: unknown, other, accountActivation, accountVerification, billing, cleanUpMail, controversial, documentReceived, expense, incomingMessages, invoice, itemReceived, loginAlert, mailReceived, password, payment, payroll, personalizedOffer, quarantine, remoteWork, reviewMessage, securityUpdate, serviceSuspended, signatureRequired, upgradeMailboxStorage, verifyMailbox, voicemail, advertisement, employeeEngagement, unknownFutureValue.

payloadDetail

Property	Type	Description
coachmarks	payloadCoachmark collection	Payload coachmark details.
content	String	Payload content details.
phishingUrl	String	The phishing URL used to target a user.

simulation

Property	Type	Description
attackTechnique	simulationAttackTechnique	The social engineering technique used in the attack simulation and training campaign. Supports $filter and $orderby. Possible values are: unknown, credentialHarvesting, attachmentMalware, driveByUrl, linkInAttachment, linkToMalwareFile, unknownFutureValue. For more information on the types of social engineering attack techniques, see simulations.
attackType	simulationAttackType	Attack type of the attack simulation and training campaign. Supports $filter and $orderby. Possible values are: unknown, social, cloud, endpoint, unknownFutureValue.
automationId	String	Unique identifier for the attack simulation automation.
completionDateTime	DateTimeOffset	Date and time of completion of the attack simulation and training campaign. Supports $filter and $orderby.
createdBy	emailIdentity	Identity of the user who created the attack simulation and training campaign.
createdDateTime	DateTimeOffset	Date and time of creation of the attack simulation and training campaign.
description	String	Description of the attack simulation and training campaign.
displayName	String	Display name of the attack simulation and training campaign. Supports $filter and $orderby.
id	String	Unique identifier for the attack simulation and training campaign. Inherited from entity.
isAutomated	Boolean	Flag that represents if the attack simulation and training campaign was created from a simulation automation flow. Supports $filter and $orderby.
lastModifiedBy	emailIdentity	Identity of the user who most recently modified the attack simulation and training campaign.
lastModifiedDateTime	DateTimeOffset	Date and time of the most recent modification of the attack simulation and training campaign.
launchDateTime	DateTimeOffset	Date and time of the launch/start of the attack simulation and training campaign. Supports $filter and $orderby.
payloadDeliveryPlatform	payloadDeliveryPlatform	Method of delivery of the phishing payload used in the attack simulation and training campaign. Possible values are: unknown, sms, email, teams, unknownFutureValue.
report	simulationReport	Report of the attack simulation and training campaign.
status	simulationStatus	Status of the attack simulation and training campaign. Supports $filter and $orderby. Possible values are: unknown, draft, running, scheduled, succeeded, failed, cancelled, excluded, unknownFutureValue.

simulationAutomation

Property	Type	Description
createdBy	emailIdentity	Identity of the user who created the attack simulation automation.
createdDateTime	DateTimeOffset	Date and time when the attack simulation automation was created.
description	String	Description of the attack simulation automation.
displayName	String	Display name of the attack simulation automation. Supports $filter and $orderby.
id	String	Unique identifier for the attack simulation automation. Inherited from entity.
lastModifiedBy	emailIdentity	Identity of the user who most recently modified the attack simulation automation.
lastModifiedDateTime	DateTimeOffset	Date and time when the attack simulation automation was most recently modified.
lastRunDateTime	DateTimeOffset	Date and time of the latest run of the attack simulation automation.
nextRunDateTime	DateTimeOffset	Date and time of the upcoming run of the attack simulation automation.
status	simulationAutomationStatus	Status of the attack simulation automation. Supports $filter and $orderby. The possible values are: unknown, draft, notRunning, running, completed, unknownFutureValue.

simulationAutomationRun

Property	Type	Description
endDateTime	DateTimeOffset	Date and time when the run ends in an attack simulation automation.
id	String	Unique identifier for the run of an attack simulation automation. Inherited from entity.
simulationId	String	Unique identifier for the attack simulation campaign initiated in the attack simulation automation run.
startDateTime	DateTimeOffset	Date and time when the run starts in an attack simulation automation.
status	simulationAutomationRunStatus	Status of the attack simulation automation run. The possible values are: unknown, running, succeeded, failed, skipped, unknownFutureValue.

simulationReportOverview

Property	Type	Description
recommendedActions	recommendedAction collection	List of recommended actions for a tenant to improve its security posture based on the attack simulation and training campaign attack type.
resolvedTargetsCount	Int32	Number of valid users in the attack simulation and training campaign.
simulationEventsContent	simulationEventsContent	Summary of simulation events in the attack simulation and training campaign.
trainingEventsContent	trainingEventsContent	Summary of assigned trainings in the attack simulation and training campaign.

userSimulationDetails

Property	Type	Description
assignedTrainingsCount	Int32	Number of trainings assigned to a user in an attack simulation and training campaign.
completedTrainingsCount	Int32	Number of trainings completed by a user in an attack simulation and training campaign.
compromisedDateTime	DateTimeOffset	Date and time of the compromising online action by a user in an attack simulation and training campaign.
inProgressTrainingsCount	Int32	Number of trainings in progress by a user in an attack simulation and training campaign.
isCompromised	Boolean	Indicates whether a user was compromised in an attack simulation and training campaign.
reportedPhishDateTime	DateTimeOffset	Date and time when a user reported the delivered payload as phishing in the attack simulation and training campaign.
simulationEvents	userSimulationEventInfo collection	List of simulation events of a user in the attack simulation and training campaign.
simulationUser	attackSimulationUser	User in an attack simulation and training campaign.
trainingEvents	userTrainingEventInfo collection	List of training events of a user in the attack simulation and training campaign.