diff --git a/openapi/v1.0/default.yaml b/openapi/v1.0/default.yaml
index d5080adb..377b0076 100644
--- a/openapi/v1.0/default.yaml
+++ b/openapi/v1.0/default.yaml
@@ -934066,7 +934066,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             evidence:
               type: array
               items:
@@ -935963,7 +935963,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             displayName:
               type: string
               description: The incident name.
diff --git a/openapi/v1.0/graphexplorer.yaml b/openapi/v1.0/graphexplorer.yaml
index 52dc91df..24f6436f 100644
--- a/openapi/v1.0/graphexplorer.yaml
+++ b/openapi/v1.0/graphexplorer.yaml
@@ -1132767,7 +1132767,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             evidence:
               type: array
               items:
@@ -1134664,7 +1134664,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             displayName:
               type: string
               description: The incident name.
diff --git a/openapi/v1.0/openapi.yaml b/openapi/v1.0/openapi.yaml
index 89852f94..8c9e746a 100644
--- a/openapi/v1.0/openapi.yaml
+++ b/openapi/v1.0/openapi.yaml
@@ -921831,7 +921831,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             evidence:
               type: array
               items:
@@ -924074,7 +924074,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             displayName:
               type: string
               description: The incident name.
diff --git a/openapi/v1.0/powershell_v2.yaml b/openapi/v1.0/powershell_v2.yaml
index 977ddce0..63750189 100644
--- a/openapi/v1.0/powershell_v2.yaml
+++ b/openapi/v1.0/powershell_v2.yaml
@@ -944959,7 +944959,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             evidence:
               type: array
               items:
@@ -946856,7 +946856,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.alertDetermination'
                 - type: object
                   nullable: true
-              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.'
+              description: 'Specifies the determination of the incident. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.'
             displayName:
               type: string
               description: The incident name.