Microsoft Graph OData Service for namespace microsoft.graph — security.threatIntelligence

naftiko: 1.0.0-alpha2
info:
  label: Microsoft Graph OData Service for namespace microsoft.graph — security.threatIntelligence
  description: 'Microsoft Graph OData Service for namespace microsoft.graph — security.threatIntelligence. 179 operations.
    Lead operation: Microsoft Graph Get threatIntelligence from security. Self-contained Naftiko capability covering one Microsoft
    Graph business surface.'
  tags:
  - Microsoft Graph
  - security.threatIntelligence
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    MICROSOFT_GRAPH_API_KEY: MICROSOFT_GRAPH_API_KEY
capability:
  consumes:
  - type: http
    namespace: microsoft-graph-security-threatintelligence
    baseUri: https://graph.microsoft.com/v1.0
    description: Microsoft Graph OData Service for namespace microsoft.graph — security.threatIntelligence business capability.
      Self-contained, no shared references.
    resources:
    - name: security-threatIntelligence
      path: /security/threatIntelligence
      operations:
      - name: securitygetthreatintelligence
        method: GET
        description: Microsoft Graph Get threatIntelligence from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securityupdatethreatintelligence
        method: PATCH
        description: Microsoft Graph Update the navigation property threatIntelligence in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitydeletethreatintelligence
        method: DELETE
        description: Microsoft Graph Delete navigation property threatIntelligence for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-articleIndicators
      path: /security/threatIntelligence/articleIndicators
      operations:
      - name: securitythreatintelligencelistarticleindicators
        method: GET
        description: Microsoft Graph Get articleIndicator
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligencecreatearticleindicators
        method: POST
        description: Microsoft Graph Create new navigation property to articleIndicators for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-threatIntelligence-articleIndicators-$count
      path: /security/threatIntelligence/articleIndicators/$count
      operations:
      - name: securitythreatintelligencearticleindicatorsgetcountc9c7
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-articleIndicators-articleIndicator-id
      path: /security/threatIntelligence/articleIndicators/{articleIndicator-id}
      operations:
      - name: securitythreatintelligencegetarticleindicators
        method: GET
        description: Microsoft Graph Get articleIndicator
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligenceupdatearticleindicators
        method: PATCH
        description: Microsoft Graph Update the navigation property articleIndicators in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitythreatintelligencedeletearticleindicators
        method: DELETE
        description: Microsoft Graph Delete navigation property articleIndicators for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-articleIndicators-articleIndicator-id-artifact
      path: /security/threatIntelligence/articleIndicators/{articleIndicator-id}/artifact
      operations:
      - name: securitythreatintelligencearticleindicatorsgetartifact
        method: GET
        description: Microsoft Graph Get artifact from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-articles
      path: /security/threatIntelligence/articles
      operations:
      - name: securitythreatintelligencelistarticles
        method: GET
        description: Microsoft Graph List articles
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligencecreatearticles
        method: POST
        description: Microsoft Graph Create new navigation property to articles for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-threatIntelligence-articles-$count
      path: /security/threatIntelligence/articles/$count
      operations:
      - name: securitythreatintelligencearticlesgetcount3702
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-articles-article-id
      path: /security/threatIntelligence/articles/{article-id}
      operations:
      - name: securitythreatintelligencegetarticles
        method: GET
        description: Microsoft Graph Get article
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligenceupdatearticles
        method: PATCH
        description: Microsoft Graph Update the navigation property articles in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitythreatintelligencedeletearticles
        method: DELETE
        description: Microsoft Graph Delete navigation property articles for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-articles-article-id-indicators
      path: /security/threatIntelligence/articles/{article-id}/indicators
      operations:
      - name: securitythreatintelligencearticleslistindicators
        method: GET
        description: Microsoft Graph List indicators
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-articles-article-id-indicators-$count
      path: /security/threatIntelligence/articles/{article-id}/indicators/$count
      operations:
      - name: securitythreatintelligencearticlesindicatorsgetcount1d6c
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-articles-article-id-indicators-articleIndicator-id
      path: /security/threatIntelligence/articles/{article-id}/indicators/{articleIndicator-id}
      operations:
      - name: securitythreatintelligencearticlesgetindicators
        method: GET
        description: Microsoft Graph Get indicators from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostComponents
      path: /security/threatIntelligence/hostComponents
      operations:
      - name: securitythreatintelligencelisthostcomponents
        method: GET
        description: Microsoft Graph Get hostComponent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligencecreatehostcomponents
        method: POST
        description: Microsoft Graph Create new navigation property to hostComponents for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-threatIntelligence-hostComponents-$count
      path: /security/threatIntelligence/hostComponents/$count
      operations:
      - name: securitythreatintelligencehostcomponentsgetcount3ca4
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-hostComponents-hostComponent-id
      path: /security/threatIntelligence/hostComponents/{hostComponent-id}
      operations:
      - name: securitythreatintelligencegethostcomponents
        method: GET
        description: Microsoft Graph Get hostComponent
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligenceupdatehostcomponents
        method: PATCH
        description: Microsoft Graph Update the navigation property hostComponents in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitythreatintelligencedeletehostcomponents
        method: DELETE
        description: Microsoft Graph Delete navigation property hostComponents for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-hostComponents-hostComponent-id-host
      path: /security/threatIntelligence/hostComponents/{hostComponent-id}/host
      operations:
      - name: securitythreatintelligencehostcomponentsgethost
        method: GET
        description: Microsoft Graph Get host from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostCookies
      path: /security/threatIntelligence/hostCookies
      operations:
      - name: securitythreatintelligencelisthostcookies
        method: GET
        description: Microsoft Graph Get hostCookie
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligencecreatehostcookies
        method: POST
        description: Microsoft Graph Create new navigation property to hostCookies for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-threatIntelligence-hostCookies-$count
      path: /security/threatIntelligence/hostCookies/$count
      operations:
      - name: securitythreatintelligencehostcookiesgetcountca74
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-hostCookies-hostCookie-id
      path: /security/threatIntelligence/hostCookies/{hostCookie-id}
      operations:
      - name: securitythreatintelligencegethostcookies
        method: GET
        description: Microsoft Graph Get hostCookie
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligenceupdatehostcookies
        method: PATCH
        description: Microsoft Graph Update the navigation property hostCookies in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitythreatintelligencedeletehostcookies
        method: DELETE
        description: Microsoft Graph Delete navigation property hostCookies for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-hostCookies-hostCookie-id-host
      path: /security/threatIntelligence/hostCookies/{hostCookie-id}/host
      operations:
      - name: securitythreatintelligencehostcookiesgethost
        method: GET
        description: Microsoft Graph Get host from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostPairs
      path: /security/threatIntelligence/hostPairs
      operations:
      - name: securitythreatintelligencelisthostpairs
        method: GET
        description: Microsoft Graph Get hostPair
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligencecreatehostpairs
        method: POST
        description: Microsoft Graph Create new navigation property to hostPairs for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-threatIntelligence-hostPairs-$count
      path: /security/threatIntelligence/hostPairs/$count
      operations:
      - name: securitythreatintelligencehostpairsgetcount6e30
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-hostPairs-hostPair-id
      path: /security/threatIntelligence/hostPairs/{hostPair-id}
      operations:
      - name: securitythreatintelligencegethostpairs
        method: GET
        description: Microsoft Graph Get hostPair
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligenceupdatehostpairs
        method: PATCH
        description: Microsoft Graph Update the navigation property hostPairs in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitythreatintelligencedeletehostpairs
        method: DELETE
        description: Microsoft Graph Delete navigation property hostPairs for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-hostPairs-hostPair-id-childHost
      path: /security/threatIntelligence/hostPairs/{hostPair-id}/childHost
      operations:
      - name: securitythreatintelligencehostpairsgetchildhost
        method: GET
        description: Microsoft Graph Get childHost from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostPairs-hostPair-id-parentHost
      path: /security/threatIntelligence/hostPairs/{hostPair-id}/parentHost
      operations:
      - name: securitythreatintelligencehostpairsgetparenthost
        method: GET
        description: Microsoft Graph Get parentHost from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostPorts
      path: /security/threatIntelligence/hostPorts
      operations:
      - name: securitythreatintelligencelisthostports
        method: GET
        description: Microsoft Graph Get hostPort
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligencecreatehostports
        method: POST
        description: Microsoft Graph Create new navigation property to hostPorts for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-threatIntelligence-hostPorts-$count
      path: /security/threatIntelligence/hostPorts/$count
      operations:
      - name: securitythreatintelligencehostportsgetcount5189
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-hostPorts-hostPort-id
      path: /security/threatIntelligence/hostPorts/{hostPort-id}
      operations:
      - name: securitythreatintelligencegethostports
        method: GET
        description: Microsoft Graph Get hostPort
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligenceupdatehostports
        method: PATCH
        description: Microsoft Graph Update the navigation property hostPorts in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitythreatintelligencedeletehostports
        method: DELETE
        description: Microsoft Graph Delete navigation property hostPorts for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-hostPorts-hostPort-id-host
      path: /security/threatIntelligence/hostPorts/{hostPort-id}/host
      operations:
      - name: securitythreatintelligencehostportsgethost
        method: GET
        description: Microsoft Graph Get host from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostPorts-hostPort-id-mostRecentSslCertificate
      path: /security/threatIntelligence/hostPorts/{hostPort-id}/mostRecentSslCertificate
      operations:
      - name: securitythreatintelligencehostportsgetmostrecentsslcertificate
        method: GET
        description: Microsoft Graph Get mostRecentSslCertificate from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostSslCertificates
      path: /security/threatIntelligence/hostSslCertificates
      operations:
      - name: securitythreatintelligencelisthostsslcertificates
        method: GET
        description: Microsoft Graph Get hostSslCertificate
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligencecreatehostsslcertificates
        method: POST
        description: Microsoft Graph Create new navigation property to hostSslCertificates for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-threatIntelligence-hostSslCertificates-$count
      path: /security/threatIntelligence/hostSslCertificates/$count
      operations:
      - name: securitythreatintelligencehostsslcertificatesgetcounta40b
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-threatIntelligence-hostSslCertificates-hostSslCertificate-id
      path: /security/threatIntelligence/hostSslCertificates/{hostSslCertificate-id}
      operations:
      - name: securitythreatintelligencegethostsslcertificates
        method: GET
        description: Microsoft Graph Get hostSslCertificate
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitythreatintelligenceupdatehostsslcertificates
        method: PATCH
        description: Microsoft Graph Update the navigation property hostSslCertificates in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitythreatintelligencedeletehostsslcertificates
        method: DELETE
        description: Microsoft Graph Delete navigation property hostSslCertificates for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-threatIntelligence-hostSslCertificates-hostSslCertificate-id-host
      path: /security/threatIntelligence/hostSslCertificates/{hostSslCertificate-id}/host
      operations:
      - name: securitythreatintelligencehostsslcertificatesgethost
        method: GET
        description: Microsoft Graph Get host from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-threatIntelligence-hostSslCertificates-hostSslCertificate-id-sslCertifi
      path: /security/threatIntelligence/hostSslCertificates/{hostSslCertificate-id}/sslCertificate
      operations:
      - name: securitythreatintelligencehostsslcertificatesgetsslcertificate
        method: GET
        description: Microsoft Graph Get sslCertificate from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
     

# --- truncated at 32 KB (279 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/capabilities/microsoft-graph-security-threatintelligence.yaml