Execute a remediation

Execute a remediation action of the given kind against a target.
Supported kinds: resolve-dlp-alert — resolve (close) a DLP alert
after triage, recording the classification and propagating the
resolution to the source provider (e.g. Microsoft Purview) when a
provider integration is connected; its target_id is the Anzenna
detection id of the alert (see query_key_finding_detections) and
classification is required.

revoke-encrypted-email — withdraw recipient access to a Microsoft
Purview encrypted message. Identify it with target_id, the outbound
email id from query_outbound_email_events; for mail Exchange knows
about before ingestion has listed it, send the RFC 5322 header in
message_id and in target_id. Revocation is per message,
not per recipient, so it settles every row sharing that Message-ID.
Only mail delivered through the encryption portal can be withdrawn —
a message that opened inline in a Microsoft 365 or Outlook.com
recipient's client has no link to revoke. The outcome is asynchronous:
the response reports the remediation was accepted, and the result
lands on that email's remediation lifecycle.

curl --location '/remediations/' \ --header 'Content-Type: application/json' \ --data-raw '{ "classification": "false_positive", "comment": "string", "message_id": "<DS7PR11MB7906@DS7PR11MB7906.namprd11.prod.outlook.com>", "target_id": "8CA67511-744C-4D74-B26E-7281CF88712F" }'

Request

Responses