Microsoft Graph API Get Incident接口JSON输出中附件呈现形式问询

当Get Incident接口返回的事件关联了带附件的邮件时，附件数据不会直接在incident的顶层返回，而是需要通过关联的alert对象中的evidence数组（类型为mailEvidence的条目）来获取，具体结构和说明如下：

典型返回结构示例 #

{
  "id": "incident-xxxxxx",
  "attachmentsCount": 2,
  "alerts": [
    {
      "id": "alert-xxxxxx",
      "evidence": [
        {
          "odataType": "#microsoft.graph.mailEvidence",
          "id": "mail-evidence-xxxxxx",
          "subject": "可疑测试邮件",
          "attachments": [
            {
              "name": "test_sample.pdf",
              "size": 14520,
              "sha256": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
              "sha1": "c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0",
              "md5": "e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6",
              "url": "https://graph.microsoft.com/v1.0/security/incidents/incident-xxxxxx/alerts/alert-xxxxxx/evidence/mail-evidence-xxxxxx/attachments/test_sample.pdf"
            },
            {
              "name": "data_report.xlsx",
              "size": 89760,
              "sha256": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
              "sha1": "d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1",
              "md5": "f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7",
              "url": "https://graph.microsoft.com/v1.0/security/incidents/incident-xxxxxx/alerts/alert-xxxxxx/evidence/mail-evidence-xxxxxx/attachments/data_report.xlsx"
            }
          ]
        }
      ]
    }
  ]
}

关键字段说明 #

• attachmentsCount：incident顶层的该字段仅统计关联邮件附件的总数量，不包含附件详情。
• alerts[].evidence[]：需筛选odataType为#microsoft.graph.mailEvidence的条目，这类条目对应事件关联的邮件证据。
• attachments数组：每个元素对应单个附件，核心字段包括：
  • name：附件文件名
  • size：附件的字节大小
  • sha256/sha1/md5：附件文件的哈希校验值
  • url：用于获取附件内容的Graph API路径（需具备SecurityEvents.Read.All或SecurityEvents.ReadWrite.All权限才能调用）

额外提示 #

• 若attachmentsCount为0，说明当前事件关联的所有邮件均无附件，无需进一步解析。
• 若需获取附件的实际内容，可通过url字段对应的端点发起GET请求，返回的是附件的二进制数据。

内容的提问来源于stack exchange，提问作者Xav MX