{ "swagger": "2.0", "schemes": [ "https" ], "host": "management.azure.com", "info": { "title": "PolicyEventsClient", "version": "2017-08-09-preview", "x-apisguru-categories": [ "cloud" ], "x-logo": { "url": "https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png" }, "x-origin": [ { "format": "swagger", "url": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/policyinsights/resource-manager/Microsoft.PolicyInsights/preview/2017-08-09-preview/policyEvents.json", "version": "2.0" } ], "x-preferred": false, "x-providerName": "azure.com", "x-serviceName": "policyinsights-policyEvents", "x-tags": [ "Azure", "Microsoft" ] }, "produces": [ "application/json" ], "securityDefinitions": { "azure_auth": { "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize", "description": "Azure Active Directory OAuth2 Flow", "flow": "implicit", "scopes": { "user_impersonation": "impersonate your user account" }, "type": "oauth2" } }, "security": [ { "azure_auth": [ "user_impersonation" ] } ], "parameters": { "apiVersionParameter": { "description": "API version to use with the client requests.", "in": "query", "name": "api-version", "required": true, "type": "string", "x-ms-parameter-location": "client" }, "applyParameter": { "description": "OData apply expression for aggregations.", "in": "query", "name": "$apply", "required": false, "type": "string", "x-ms-client-name": "Apply", "x-ms-parameter-grouping": { "name": "QueryOptions" }, "x-ms-parameter-location": "method" }, "filterParameter": { "description": "OData filter expression.", "in": "query", "name": "$filter", "required": false, "type": "string", "x-ms-client-name": "Filter", "x-ms-parameter-grouping": { "name": "QueryOptions" }, "x-ms-parameter-location": "method" }, "fromParameter": { "description": "ISO 8601 formatted timestamp specifying the start time of the interval to query. When not specified, the service uses ($to - 1-day).", "format": "date-time", "in": "query", "name": "$from", "required": false, "type": "string", "x-ms-client-name": "From", "x-ms-parameter-grouping": { "name": "QueryOptions" }, "x-ms-parameter-location": "method" }, "managementGroupNameParameter": { "description": "Management group name.", "in": "path", "name": "managementGroupName", "required": true, "type": "string", "x-ms-parameter-location": "method" }, "managementGroupsNamespaceParameter": { "description": "The namespace for Microsoft Management resource provider; only \"Microsoft.Management\" is allowed.", "enum": [ "Microsoft.Management" ], "in": "path", "name": "managementGroupsNamespace", "required": true, "type": "string", "x-ms-parameter-location": "method" }, "orderByParameter": { "description": "Ordering expression using OData notation. One or more comma-separated column names with an optional \"desc\" (the default) or \"asc\", e.g. \"$orderby=PolicyAssignmentId, ResourceId asc\".", "in": "query", "name": "$orderby", "required": false, "type": "string", "x-ms-client-name": "OrderBy", "x-ms-parameter-grouping": { "name": "QueryOptions" }, "x-ms-parameter-location": "method" }, "policyEventsResourceParameter": { "description": "The name of the virtual resource under PolicyEvents resource type; only \"default\" is allowed.", "enum": [ "default" ], "in": "path", "name": "policyEventsResource", "required": true, "type": "string", "x-ms-parameter-location": "method" }, "resourceGroupNameParameter": { "description": "Resource group name.", "in": "path", "name": "resourceGroupName", "required": true, "type": "string", "x-ms-parameter-location": "method" }, "resourceIdParameter": { "description": "Resource ID.", "in": "path", "name": "resourceId", "required": true, "type": "string", "x-ms-parameter-location": "method", "x-ms-skip-url-encoding": true }, "selectParameter": { "description": "Select expression using OData notation. Limits the columns on each record to just those requested, e.g. \"$select=PolicyAssignmentId, ResourceId\".", "in": "query", "name": "$select", "required": false, "type": "string", "x-ms-client-name": "Select", "x-ms-parameter-grouping": { "name": "QueryOptions" }, "x-ms-parameter-location": "method" }, "subscriptionIdParameter": { "description": "Microsoft Azure subscription ID.", "in": "path", "name": "subscriptionId", "required": true, "type": "string", "x-ms-parameter-location": "method" }, "toParameter": { "description": "ISO 8601 formatted timestamp specifying the end time of the interval to query. When not specified, the service uses request time.", "format": "date-time", "in": "query", "name": "$to", "required": false, "type": "string", "x-ms-client-name": "To", "x-ms-parameter-grouping": { "name": "QueryOptions" }, "x-ms-parameter-location": "method" }, "topParameter": { "description": "Maximum number of records to return.", "format": "int32", "in": "query", "minimum": 0, "name": "$top", "required": false, "type": "integer", "x-ms-client-name": "Top", "x-ms-parameter-grouping": { "name": "QueryOptions" }, "x-ms-parameter-location": "method" } }, "paths": { "/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults": { "post": { "description": "Queries policy events for the resources under the management group.", "operationId": "PolicyEvents_ListQueryResultsForManagementGroup", "parameters": [ { "$ref": "#/parameters/policyEventsResourceParameter" }, { "$ref": "#/parameters/managementGroupsNamespaceParameter" }, { "$ref": "#/parameters/managementGroupNameParameter" }, { "$ref": "#/parameters/apiVersionParameter" }, { "$ref": "#/parameters/topParameter" }, { "$ref": "#/parameters/orderByParameter" }, { "$ref": "#/parameters/selectParameter" }, { "$ref": "#/parameters/fromParameter" }, { "$ref": "#/parameters/toParameter" }, { "$ref": "#/parameters/filterParameter" }, { "$ref": "#/parameters/applyParameter" } ], "responses": { "200": { "description": "Query results.", "schema": { "$ref": "#/definitions/PolicyEventsQueryResults" } }, "default": { "description": "Error response describing why the operation failed.", "schema": { "$ref": "#/definitions/QueryFailure" } } }, "x-ms-examples": { "Query at management group scope": { "parameters": { "api-version": "2017-08-09-preview", "managementGroupName": "myManagementGroup", "managementGroupsNamespace": "Microsoft.Management", "policyEventsResource": "default" }, "responses": { "200": { "body": { "value": [ { "columns": { "EffectiveParameters": { "dataType": "String", "name": "EffectiveParameters", "ordinal": 5 }, "IsCompliant": { "dataType": "Boolean", "name": "IsCompliant", "ordinal": 6 }, "ManagementGroupIds": { "dataType": "String", "name": "ManagementGroupIds", "ordinal": 24 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 3 }, "PolicyAssignmentName": { "dataType": "String", "name": "PolicyAssignmentName", "ordinal": 12 }, "PolicyAssignmentOwner": { "dataType": "String", "name": "PolicyAssignmentOwner", "ordinal": 13 }, "PolicyAssignmentParameters": { "dataType": "String", "name": "PolicyAssignmentParameters", "ordinal": 14 }, "PolicyAssignmentScope": { "dataType": "String", "name": "PolicyAssignmentScope", "ordinal": 15 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 17 }, "PolicyDefinitionCategory": { "dataType": "String", "name": "PolicyDefinitionCategory", "ordinal": 18 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 4 }, "PolicyDefinitionName": { "dataType": "String", "name": "PolicyDefinitionName", "ordinal": 16 }, "PolicyDefinitionReferenceId": { "dataType": "String", "name": "PolicyDefinitionReferenceId", "ordinal": 25 }, "PolicySetDefinitionCategory": { "dataType": "String", "name": "PolicySetDefinitionCategory", "ordinal": 22 }, "PolicySetDefinitionId": { "dataType": "String", "name": "PolicySetDefinitionId", "ordinal": 19 }, "PolicySetDefinitionName": { "dataType": "String", "name": "PolicySetDefinitionName", "ordinal": 20 }, "PolicySetDefinitionOwner": { "dataType": "String", "name": "PolicySetDefinitionOwner", "ordinal": 21 }, "PolicySetDefinitionParameters": { "dataType": "String", "name": "PolicySetDefinitionParameters", "ordinal": 23 }, "PrincipalOid": { "dataType": "String", "name": "PrincipalOid", "ordinal": 27 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 10 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 2 }, "ResourceLocation": { "dataType": "String", "name": "ResourceLocation", "ordinal": 9 }, "ResourceTags": { "dataType": "String", "name": "ResourceTags", "ordinal": 11 }, "ResourceType": { "dataType": "String", "name": "ResourceType", "ordinal": 8 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 7 }, "TenantId": { "dataType": "String", "name": "TenantId", "ordinal": 26 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T22:54:39.8128521Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff5d536aec743a0aa801c1a", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d", null, false, "fffedd8f-ffff-fffd-fffd-fffed2f84852", "/Microsoft.OperationalInsights/workspaces", "canadacentral", "myResourceGroup", "tbd", "fff5d536aec743a0aa801c1a", "tbd", "{}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fffd9357-fff0-fff7-fff4-fff30ce4c32d", "audit", "tbd", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/fffcefd2-fff6-ffff-fff4-fffa170eb1d5", "fffcefd2-fff6-ffff-fff4-fffa170eb1d5", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "fff21232277412542086", "fff988bf-fff1-ffff-fffb-fffcd011db47", "ffffb743-fff5-fff7-fffe-fffc2444f333" ], [ "2018-02-05T22:54:39.8128521Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff16fce53454b15a7ed803d", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fff0414b-fff4-fffd-fff5-fff79a89232c", null, false, "fffedd8f-ffff-fffd-fffd-fffed2f84852", "/Microsoft.OperationalInsights/workspaces", "canadacentral", "myResourceGroup", "tbd", "fff16fce53454b15a7ed803d", "tbd", "{\"allowedLocations\":{\"value\":[\"eastus\"]}}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fff0414b-fff4-fffd-fff5-fff79a89232c", "audit", "tbd", "", "", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "", "fff988bf-fff1-ffff-fffb-fffcd011db47", "ffffb743-fff5-fff7-fffe-fffc2444f333" ] ] } ] } } } } } } }, "/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults": { "post": { "description": "Queries policy events for the resources under the subscription.", "operationId": "PolicyEvents_ListQueryResultsForSubscription", "parameters": [ { "$ref": "#/parameters/policyEventsResourceParameter" }, { "$ref": "#/parameters/subscriptionIdParameter" }, { "$ref": "#/parameters/apiVersionParameter" }, { "$ref": "#/parameters/topParameter" }, { "$ref": "#/parameters/orderByParameter" }, { "$ref": "#/parameters/selectParameter" }, { "$ref": "#/parameters/fromParameter" }, { "$ref": "#/parameters/toParameter" }, { "$ref": "#/parameters/filterParameter" }, { "$ref": "#/parameters/applyParameter" } ], "responses": { "200": { "description": "Query results.", "schema": { "$ref": "#/definitions/PolicyEventsQueryResults" } }, "default": { "description": "Error response describing why the operation failed.", "schema": { "$ref": "#/definitions/QueryFailure" } } }, "x-ms-examples": { "Filter and aggregate only": { "parameters": { "$apply": "aggregate($count as NumDenyEvents)", "$filter": "PolicyDefinitionAction eq 'deny'", "$from": "2018-02-05T18:00:00Z", "api-version": "2017-08-09-preview", "policyEventsResource": "default", "subscriptionId": "fffedd8f-ffff-fffd-fffd-fffed2f84852" }, "responses": { "200": { "body": { "value": [ { "columns": { "NumDenyEvents": { "dataType": "Numeric", "name": "NumDenyEvents", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ 40 ] ] } ] } } } }, "Filter and group with aggregate": { "parameters": { "$apply": "groupby((PolicyAssignmentId, PolicyDefinitionId, PolicyDefinitionAction, ResourceId), aggregate($count as NumEvents))", "$filter": "PolicyDefinitionAction eq 'audit' or PolicyDefinitionAction eq 'deny'", "$from": "2018-02-05T18:00:00Z", "$top": 2, "api-version": "2017-08-09-preview", "policyEventsResource": "default", "subscriptionId": "fffedd8f-ffff-fffd-fffd-fffed2f84852" }, "responses": { "200": { "body": { "value": [ { "columns": { "NumEvents": { "dataType": "Numeric", "name": "NumEvents", "ordinal": 5 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 1 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 3 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 2 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 4 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policyassignments/3f3c4330183b4e218fe6fd29", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/24813039-7534-408a-9842-eb99f45721b1", "audit", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.servicefabric/clusters/myCluster/applications/resourcescachemonitor/services/myService", 1 ], [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policyassignments/d6be6bb37e5f4333baa95c2a", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/5948d091-78b7-4d3b-a404-cc6a0329b0c6", "audit", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.servicefabric/clusters/myCluster/applications/resourcescachemonitor/services/myService", 1 ] ] } ] } } } }, "Filter and group without aggregate": { "parameters": { "$apply": "groupby((PolicyAssignmentId, PolicyDefinitionId, PolicyDefinitionAction, ResourceId))", "$filter": "PolicyDefinitionAction ne 'audit' and PolicyDefinitionAction ne 'append'", "$from": "2018-01-05T18:00:00Z", "$top": 2, "api-version": "2017-08-09-preview", "policyEventsResource": "default", "subscriptionId": "fffedd8f-ffff-fffd-fffd-fffed2f84852" }, "responses": { "200": { "body": { "value": [ { "columns": { "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 1 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 3 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 2 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 4 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.authorization/policyassignments/storageaccountsku", "/providers/microsoft.authorization/policydefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1", "deny", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.storage/storageaccounts/mysa1" ], [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.authorization/policyassignments/da43b50031bf4bce84584faa", "/providers/microsoft.authorization/policydefinitions/1e30110a-5ceb-460c-a204-c1c3969c6d62", "deny", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.storage/storageaccounts/mysa2" ] ] } ] } } } }, "Filter and multiple groups": { "parameters": { "$apply": "groupby((PolicyAssignmentId, PolicyDefinitionId, ResourceId))/groupby((PolicyAssignmentId, PolicyDefinitionId), aggregate($count as NumDeniedResources))", "$filter": "PolicyDefinitionAction eq 'deny'", "$from": "2018-01-01T00:00:00Z", "$orderby": "NumDeniedResources desc", "$top": 10, "api-version": "2017-08-09-preview", "policyEventsResource": "default", "subscriptionId": "fffedd8f-ffff-fffd-fffd-fffed2f84852" }, "responses": { "200": { "body": { "value": [ { "columns": { "NumDeniedResources": { "dataType": "Numeric", "name": "NumDeniedResources", "ordinal": 3 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 1 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 2 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup1/providers/microsoft.authorization/policyassignments/0591f497c35344fcbaf7a393", "/providers/microsoft.authorization/policydefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c", 3 ], [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup1/providers/microsoft.authorization/policyassignments/mypolicyassignment2", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/mypolicydefinition2", 2 ], [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup1/providers/microsoft.authorization/policyassignments/mypolicyassignment2", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/mypolicydefinition3", 2 ], [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/5bc427ca-0089-4d0d-85bd-e98d1e40b3bf/providers/microsoft.authorization/policyassignments/mypolicyassignment3", "/providers/microsoft.authorization/policydefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1", 1 ], [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.authorization/policyassignments/da43b50031bf4bce84584faa", "/providers/microsoft.authorization/policydefinitions/1e30110a-5ceb-460c-a204-c1c3969c6d62", 1 ], [ "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.authorization/policyassignments/mypolicyassignment1", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/mypolicydefinition1", 1 ] ] } ] } } } }, "Query at subscription scope": { "parameters": { "api-version": "2017-08-09-preview", "policyEventsResource": "default", "subscriptionId": "fffedd8f-ffff-fffd-fffd-fffed2f84852" }, "responses": { "200": { "body": { "value": [ { "columns": { "EffectiveParameters": { "dataType": "String", "name": "EffectiveParameters", "ordinal": 5 }, "IsCompliant": { "dataType": "Boolean", "name": "IsCompliant", "ordinal": 6 }, "ManagementGroupIds": { "dataType": "String", "name": "ManagementGroupIds", "ordinal": 24 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 3 }, "PolicyAssignmentName": { "dataType": "String", "name": "PolicyAssignmentName", "ordinal": 12 }, "PolicyAssignmentOwner": { "dataType": "String", "name": "PolicyAssignmentOwner", "ordinal": 13 }, "PolicyAssignmentParameters": { "dataType": "String", "name": "PolicyAssignmentParameters", "ordinal": 14 }, "PolicyAssignmentScope": { "dataType": "String", "name": "PolicyAssignmentScope", "ordinal": 15 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 17 }, "PolicyDefinitionCategory": { "dataType": "String", "name": "PolicyDefinitionCategory", "ordinal": 18 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 4 }, "PolicyDefinitionName": { "dataType": "String", "name": "PolicyDefinitionName", "ordinal": 16 }, "PolicyDefinitionReferenceId": { "dataType": "String", "name": "PolicyDefinitionReferenceId", "ordinal": 25 }, "PolicySetDefinitionCategory": { "dataType": "String", "name": "PolicySetDefinitionCategory", "ordinal": 22 }, "PolicySetDefinitionId": { "dataType": "String", "name": "PolicySetDefinitionId", "ordinal": 19 }, "PolicySetDefinitionName": { "dataType": "String", "name": "PolicySetDefinitionName", "ordinal": 20 }, "PolicySetDefinitionOwner": { "dataType": "String", "name": "PolicySetDefinitionOwner", "ordinal": 21 }, "PolicySetDefinitionParameters": { "dataType": "String", "name": "PolicySetDefinitionParameters", "ordinal": 23 }, "PrincipalOid": { "dataType": "String", "name": "PrincipalOid", "ordinal": 27 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 10 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 2 }, "ResourceLocation": { "dataType": "String", "name": "ResourceLocation", "ordinal": 9 }, "ResourceTags": { "dataType": "String", "name": "ResourceTags", "ordinal": 11 }, "ResourceType": { "dataType": "String", "name": "ResourceType", "ordinal": 8 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 7 }, "TenantId": { "dataType": "String", "name": "TenantId", "ordinal": 26 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T22:54:39.8128521Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff5d536aec743a0aa801c1a", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d", null, false, "fffedd8f-ffff-fffd-fffd-fffed2f84852", "/Microsoft.OperationalInsights/workspaces", "canadacentral", "myResourceGroup", "tbd", "fff5d536aec743a0aa801c1a", "tbd", "{}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fffd9357-fff0-fff7-fff4-fff30ce4c32d", "audit", "tbd", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/fffcefd2-fff6-ffff-fff4-fffa170eb1d5", "fffcefd2-fff6-ffff-fff4-fffa170eb1d5", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "fff21232277412542086", "fff988bf-fff1-ffff-fffb-fffcd011db47", "ffffb743-fff5-fff7-fffe-fffc2444f333" ], [ "2018-02-05T22:54:39.8128521Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff16fce53454b15a7ed803d", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fff0414b-fff4-fffd-fff5-fff79a89232c", null, false, "fffedd8f-ffff-fffd-fffd-fffed2f84852", "/Microsoft.OperationalInsights/workspaces", "canadacentral", "myResourceGroup", "tbd", "fff16fce53454b15a7ed803d", "tbd", "{\"allowedLocations\":{\"value\":[\"eastus\"]}}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fff0414b-fff4-fffd-fff5-fff79a89232c", "audit", "tbd", "", "", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "", "fff988bf-fff1-ffff-fffb-fffcd011db47", "ffffb743-fff5-fff7-fffe-fffc2444f333" ] ] } ] } } } }, "Time range; sort, select and limit": { "parameters": { "$from": "2018-02-05T18:00:00Z", "$orderby": "Timestamp desc, PolicyAssignmentId asc, SubscriptionId asc, ResourceGroup asc, ResourceId", "$select": "Timestamp, PolicyAssignmentId, PolicyDefinitionId, SubscriptionId, ResourceGroup, ResourceId", "$to": "2018-02-06T18:00:00Z", "$top": 2, "api-version": "2017-08-09-preview", "policyEventsResource": "default", "subscriptionId": "fffedd8f-ffff-fffd-fffd-fffed2f84852" }, "responses": { "200": { "body": { "value": [ { "columns": { "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 2 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 3 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 5 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 6 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 4 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T22:34:02.3475017Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/Microsoft.Authorization/policyAssignments/fff27f38-fff4-fff8-fff1-fffc84b8c017", "/providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6", "fffedd8f-ffff-fffd-fffd-fffed2f84852", "myResourceGroup", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName" ], [ "2018-02-05T22:34:01.6135357Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/Microsoft.Authorization/policyAssignments/Enable Monitoring in Azure Security Center", "/providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6", "fffedd8f-ffff-fffd-fffd-fffed2f84852", "myResourceGroup", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName" ] ] } ] } } } } } } }, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults": { "post": { "description": "Queries policy events for the resources under the resource group.", "operationId": "PolicyEvents_ListQueryResultsForResourceGroup", "parameters": [ { "$ref": "#/parameters/policyEventsResourceParameter" }, { "$ref": "#/parameters/subscriptionIdParameter" }, { "$ref": "#/parameters/resourceGroupNameParameter" }, { "$ref": "#/parameters/apiVersionParameter" }, { "$ref": "#/parameters/topParameter" }, { "$ref": "#/parameters/orderByParameter" }, { "$ref": "#/parameters/selectParameter" }, { "$ref": "#/parameters/fromParameter" }, { "$ref": "#/parameters/toParameter" }, { "$ref": "#/parameters/filterParameter" }, { "$ref": "#/parameters/applyParameter" } ], "responses": { "200": { "description": "Query results.", "schema": { "$ref": "#/definitions/PolicyEventsQueryResults" } }, "default": { "description": "Error response describing why the operation failed.", "schema": { "$ref": "#/definitions/QueryFailure" } } }, "x-ms-examples": { "Query at resource group scope": { "parameters": { "api-version": "2017-08-09-preview", "policyEventsResource": "default", "resourceGroupName": "myResourceGroup", "subscriptionId": "fffedd8f-ffff-fffd-fffd-fffed2f84852" }, "responses": { "200": { "body": { "value": [ { "columns": { "EffectiveParameters": { "dataType": "String", "name": "EffectiveParameters", "ordinal": 5 }, "IsCompliant": { "dataType": "Boolean", "name": "IsCompliant", "ordinal": 6 }, "ManagementGroupIds": { "dataType": "String", "name": "ManagementGroupIds", "ordinal": 24 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 3 }, "PolicyAssignmentName": { "dataType": "String", "name": "PolicyAssignmentName", "ordinal": 12 }, "PolicyAssignmentOwner": { "dataType": "String", "name": "PolicyAssignmentOwner", "ordinal": 13 }, "PolicyAssignmentParameters": { "dataType": "String", "name": "PolicyAssignmentParameters", "ordinal": 14 }, "PolicyAssignmentScope": { "dataType": "String", "name": "PolicyAssignmentScope", "ordinal": 15 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 17 }, "PolicyDefinitionCategory": { "dataType": "String", "name": "PolicyDefinitionCategory", "ordinal": 18 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 4 }, "PolicyDefinitionName": { "dataType": "String", "name": "PolicyDefinitionName", "ordinal": 16 }, "PolicyDefinitionReferenceId": { "dataType": "String", "name": "PolicyDefinitionReferenceId", "ordinal": 25 }, "PolicySetDefinitionCategory": { "dataType": "String", "name": "PolicySetDefinitionCategory", "ordinal": 22 }, "PolicySetDefinitionId": { "dataType": "String", "name": "PolicySetDefinitionId", "ordinal": 19 }, "PolicySetDefinitionName": { "dataType": "String", "name": "PolicySetDefinitionName", "ordinal": 20 }, "PolicySetDefinitionOwner": { "dataType": "String", "name": "PolicySetDefinitionOwner", "ordinal": 21 }, "PolicySetDefinitionParameters": { "dataType": "String", "name": "PolicySetDefinitionParameters", "ordinal": 23 }, "PrincipalOid": { "dataType": "String", "name": "PrincipalOid", "ordinal": 27 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 10 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 2 }, "ResourceLocation": { "dataType": "String", "name": "ResourceLocation", "ordinal": 9 }, "ResourceTags": { "dataType": "String", "name": "ResourceTags", "ordinal": 11 }, "ResourceType": { "dataType": "String", "name": "ResourceType", "ordinal": 8 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 7 }, "TenantId": { "dataType": "String", "name": "TenantId", "ordinal": 26 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T22:54:39.8128521Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff5d536aec743a0aa801c1a", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d", null, false, "fffedd8f-ffff-fffd-fffd-fffed2f84852", "/Microsoft.OperationalInsights/workspaces", "canadacentral", "myResourceGroup", "tbd", "fff5d536aec743a0aa801c1a", "tbd", "{}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fffd9357-fff0-fff7-fff4-fff30ce4c32d", "audit", "tbd", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/fffcefd2-fff6-ffff-fff4-fffa170eb1d5", "fffcefd2-fff6-ffff-fff4-fffa170eb1d5", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "fff21232277412542086", "fff988bf-fff1-ffff-fffb-fffcd011db47", "ffffb743-fff5-fff7-fffe-fffc2444f333" ], [ "2018-02-05T22:54:39.8128521Z", "/subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff16fce53454b15a7ed803d", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fff0414b-fff4-fffd-fff5-fff79a89232c", null, false, "fffedd8f-ffff-fffd-fffd-fffed2f84852", "/Microsoft.OperationalInsights/workspaces", "canadacentral", "myResourceGroup", "tbd", "fff16fce53454b15a7ed803d", "tbd", "{\"allowedLocations\":{\"value\":[\"eastus\"]}}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fff0414b-fff4-fffd-fff5-fff79a89232c", "audit", "tbd", "", "", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "", "fff988bf-fff1-ffff-fffb-fffcd011db47", "ffffb743-fff5-fff7-fffe-fffc2444f333" ] ] } ] } } } } } } }, "/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults": { "post": { "description": "Queries policy events for the resource.", "operationId": "PolicyEvents_ListQueryResultsForResource", "parameters": [ { "$ref": "#/parameters/policyEventsResourceParameter" }, { "$ref": "#/parameters/resourceIdParameter" }, { "$ref": "#/parameters/apiVersionParameter" }, { "$ref": "#/parameters/topParameter" }, { "$ref": "#/parameters/orderByParameter" }, { "$ref": "#/parameters/selectParameter" }, { "$ref": "#/parameters/fromParameter" }, { "$ref": "#/parameters/toParameter" }, { "$ref": "#/parameters/filterParameter" }, { "$ref": "#/parameters/applyParameter" } ], "responses": { "200": { "description": "Query results.", "schema": { "$ref": "#/definitions/PolicyEventsQueryResults" } }, "default": { "description": "Error response describing why the operation failed.", "schema": { "$ref": "#/definitions/QueryFailure" } } }, "x-ms-examples": { "Query at nested resource scope": { "parameters": { "api-version": "2017-08-09-preview", "policyEventsResource": "default", "resourceId": "subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourceGroups/myResourceGroup/providers/Microsoft.ServiceFabric/clusters/myCluster/applications/myApplication" }, "responses": { "200": { "body": { "value": [ { "columns": { "EffectiveParameters": { "dataType": "String", "name": "EffectiveParameters", "ordinal": 5 }, "IsCompliant": { "dataType": "Boolean", "name": "IsCompliant", "ordinal": 6 }, "ManagementGroupIds": { "dataType": "String", "name": "ManagementGroupIds", "ordinal": 24 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 3 }, "PolicyAssignmentName": { "dataType": "String", "name": "PolicyAssignmentName", "ordinal": 12 }, "PolicyAssignmentOwner": { "dataType": "String", "name": "PolicyAssignmentOwner", "ordinal": 13 }, "PolicyAssignmentParameters": { "dataType": "String", "name": "PolicyAssignmentParameters", "ordinal": 14 }, "PolicyAssignmentScope": { "dataType": "String", "name": "PolicyAssignmentScope", "ordinal": 15 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 17 }, "PolicyDefinitionCategory": { "dataType": "String", "name": "PolicyDefinitionCategory", "ordinal": 18 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 4 }, "PolicyDefinitionName": { "dataType": "String", "name": "PolicyDefinitionName", "ordinal": 16 }, "PolicyDefinitionReferenceId": { "dataType": "String", "name": "PolicyDefinitionReferenceId", "ordinal": 25 }, "PolicySetDefinitionCategory": { "dataType": "String", "name": "PolicySetDefinitionCategory", "ordinal": 22 }, "PolicySetDefinitionId": { "dataType": "String", "name": "PolicySetDefinitionId", "ordinal": 19 }, "PolicySetDefinitionName": { "dataType": "String", "name": "PolicySetDefinitionName", "ordinal": 20 }, "PolicySetDefinitionOwner": { "dataType": "String", "name": "PolicySetDefinitionOwner", "ordinal": 21 }, "PolicySetDefinitionParameters": { "dataType": "String", "name": "PolicySetDefinitionParameters", "ordinal": 23 }, "PrincipalOid": { "dataType": "String", "name": "PrincipalOid", "ordinal": 27 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 10 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 2 }, "ResourceLocation": { "dataType": "String", "name": "ResourceLocation", "ordinal": 9 }, "ResourceTags": { "dataType": "String", "name": "ResourceTags", "ordinal": 11 }, "ResourceType": { "dataType": "String", "name": "ResourceType", "ordinal": 8 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 7 }, "TenantId": { "dataType": "String", "name": "TenantId", "ordinal": 26 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T23:24:28.4444412Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ServiceFabric/clusters/myCluster/applications/myApplication", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fffc58b7db524a9799381531", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyDefinitions/fff79b49-fff9-fff5-fffe-fff49ab8b474", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.ServiceFabric/clusters/applications", "eastus", "myResourceGroup", "tbd", "fffc58b7db524a9799381531", "tbd", "{\"TAGNAME_1\":{\"value\":\"NA\"}}", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5", "fff79b49-fff9-fff5-fffe-fff49ab8b474", "audit", "tbd", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policySetDefinitions/fff58873-fff8-fff5-fffc-fffbe7c9d697", "fff58873-fff8-fff5-fffc-fffbe7c9d697", null, null, null, "", "2124621540977569058", "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff3809a-fffc-fffe-fff1-fffe57573195" ], [ "2018-02-05T23:24:28.4444412Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ServiceFabric/clusters/myCluster/applications/myApplication", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff044306c044a1d8c0ff76c", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.ServiceFabric/clusters/applications", "eastus", "myResourceGroup", "tbd", "fff044306c044a1d8c0ff76c", "tbd", "{\"allowedLocations\":{\"value\":[\"centralus\"]}}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fffd9357-fff0-fff7-fff4-fff30ce4c32d", "audit", "tbd", "", "", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "", "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff3809a-fffc-fffe-fff1-fffe57573195" ] ] } ] } } } }, "Query at resource scope": { "parameters": { "api-version": "2017-08-09-preview", "policyEventsResource": "default", "resourceId": "subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourceGroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName" }, "responses": { "200": { "body": { "value": [ { "columns": { "EffectiveParameters": { "dataType": "String", "name": "EffectiveParameters", "ordinal": 5 }, "IsCompliant": { "dataType": "Boolean", "name": "IsCompliant", "ordinal": 6 }, "ManagementGroupIds": { "dataType": "String", "name": "ManagementGroupIds", "ordinal": 24 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 3 }, "PolicyAssignmentName": { "dataType": "String", "name": "PolicyAssignmentName", "ordinal": 12 }, "PolicyAssignmentOwner": { "dataType": "String", "name": "PolicyAssignmentOwner", "ordinal": 13 }, "PolicyAssignmentParameters": { "dataType": "String", "name": "PolicyAssignmentParameters", "ordinal": 14 }, "PolicyAssignmentScope": { "dataType": "String", "name": "PolicyAssignmentScope", "ordinal": 15 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 17 }, "PolicyDefinitionCategory": { "dataType": "String", "name": "PolicyDefinitionCategory", "ordinal": 18 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 4 }, "PolicyDefinitionName": { "dataType": "String", "name": "PolicyDefinitionName", "ordinal": 16 }, "PolicyDefinitionReferenceId": { "dataType": "String", "name": "PolicyDefinitionReferenceId", "ordinal": 25 }, "PolicySetDefinitionCategory": { "dataType": "String", "name": "PolicySetDefinitionCategory", "ordinal": 22 }, "PolicySetDefinitionId": { "dataType": "String", "name": "PolicySetDefinitionId", "ordinal": 19 }, "PolicySetDefinitionName": { "dataType": "String", "name": "PolicySetDefinitionName", "ordinal": 20 }, "PolicySetDefinitionOwner": { "dataType": "String", "name": "PolicySetDefinitionOwner", "ordinal": 21 }, "PolicySetDefinitionParameters": { "dataType": "String", "name": "PolicySetDefinitionParameters", "ordinal": 23 }, "PrincipalOid": { "dataType": "String", "name": "PrincipalOid", "ordinal": 27 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 10 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 2 }, "ResourceLocation": { "dataType": "String", "name": "ResourceLocation", "ordinal": 9 }, "ResourceTags": { "dataType": "String", "name": "ResourceTags", "ordinal": 11 }, "ResourceType": { "dataType": "String", "name": "ResourceType", "ordinal": 8 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 7 }, "TenantId": { "dataType": "String", "name": "TenantId", "ordinal": 26 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T22:34:02.3475017Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fff27f38-fff4-fff8-fff1-fffc84b8c017", "/providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.ClassicCompute/domainNames", "eastus", "myResourceGroup", "tbd", "fff27f38-fff4-fff8-fff1-fffc84b8c017", "tbd", "{}", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5", "fffea587-fff0-fff3-ffff-fff0ae01cfd6", "audit", "tbd", "/providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8", "fffafdf9-fff9-fffd-ffff-fffa613e70a8", null, null, null, "", null, "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff890fa-fff0-fff3-fff9-fffd7653f078" ], [ "2018-02-05T22:34:01.6135357Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/Enable Monitoring in Azure Security Center", "/providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.ClassicCompute/domainNames", "eastus", "myResourceGroup", "tbd", "Enable Monitoring in Azure Security Center", "tbd", "{}", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5", "fffea587-fff0-fff3-ffff-fff0ae01cfd6", "audit", "tbd", "/providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8", "fffafdf9-fff9-fffd-ffff-fffa613e70a8", null, null, null, "", null, "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff890fa-fff0-fff3-fff9-fffd7653f078" ] ] } ] } } } }, "Query at subscription level nested resource scope": { "parameters": { "api-version": "2017-08-09-preview", "policyEventsResource": "default", "resourceId": "subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResource/someNestedResourceType/someNestedResource" }, "responses": { "200": { "body": { "value": [ { "columns": { "EffectiveParameters": { "dataType": "String", "name": "EffectiveParameters", "ordinal": 5 }, "IsCompliant": { "dataType": "Boolean", "name": "IsCompliant", "ordinal": 6 }, "ManagementGroupIds": { "dataType": "String", "name": "ManagementGroupIds", "ordinal": 24 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 3 }, "PolicyAssignmentName": { "dataType": "String", "name": "PolicyAssignmentName", "ordinal": 12 }, "PolicyAssignmentOwner": { "dataType": "String", "name": "PolicyAssignmentOwner", "ordinal": 13 }, "PolicyAssignmentParameters": { "dataType": "String", "name": "PolicyAssignmentParameters", "ordinal": 14 }, "PolicyAssignmentScope": { "dataType": "String", "name": "PolicyAssignmentScope", "ordinal": 15 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 17 }, "PolicyDefinitionCategory": { "dataType": "String", "name": "PolicyDefinitionCategory", "ordinal": 18 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 4 }, "PolicyDefinitionName": { "dataType": "String", "name": "PolicyDefinitionName", "ordinal": 16 }, "PolicyDefinitionReferenceId": { "dataType": "String", "name": "PolicyDefinitionReferenceId", "ordinal": 25 }, "PolicySetDefinitionCategory": { "dataType": "String", "name": "PolicySetDefinitionCategory", "ordinal": 22 }, "PolicySetDefinitionId": { "dataType": "String", "name": "PolicySetDefinitionId", "ordinal": 19 }, "PolicySetDefinitionName": { "dataType": "String", "name": "PolicySetDefinitionName", "ordinal": 20 }, "PolicySetDefinitionOwner": { "dataType": "String", "name": "PolicySetDefinitionOwner", "ordinal": 21 }, "PolicySetDefinitionParameters": { "dataType": "String", "name": "PolicySetDefinitionParameters", "ordinal": 23 }, "PrincipalOid": { "dataType": "String", "name": "PrincipalOid", "ordinal": 27 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 10 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 2 }, "ResourceLocation": { "dataType": "String", "name": "ResourceLocation", "ordinal": 9 }, "ResourceTags": { "dataType": "String", "name": "ResourceTags", "ordinal": 11 }, "ResourceType": { "dataType": "String", "name": "ResourceType", "ordinal": 8 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 7 }, "TenantId": { "dataType": "String", "name": "TenantId", "ordinal": 26 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T23:24:28.4444412Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResource/someNestedResourceType/someNestedResource", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fffc58b7db524a9799381531", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyDefinitions/fff79b49-fff9-fff5-fffe-fff49ab8b474", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.SomeNamespace/someResourceType/someNestedResourceType", "eastus", "", "tbd", "fffc58b7db524a9799381531", "tbd", "{\"TAGNAME_1\":{\"value\":\"NA\"}}", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5", "fff79b49-fff9-fff5-fffe-fff49ab8b474", "audit", "tbd", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policySetDefinitions/fff58873-fff8-fff5-fffc-fffbe7c9d697", "fff58873-fff8-fff5-fffc-fffbe7c9d697", null, null, null, "", "2124621540977569058", "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff3809a-fffc-fffe-fff1-fffe57573195" ], [ "2018-02-05T23:24:28.4444412Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResource/someNestedResourceType/someNestedResource", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff044306c044a1d8c0ff76c", "/providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.SomeNamespace/someResourceType/someNestedResourceType", "eastus", "", "tbd", "fff044306c044a1d8c0ff76c", "tbd", "{\"allowedLocations\":{\"value\":[\"centralus\"]}}", "/providers/Microsoft.Management/managementGroups/myManagementGroup", "fffd9357-fff0-fff7-fff4-fff30ce4c32d", "audit", "tbd", "", "", null, null, null, "myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47", "", "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff3809a-fffc-fffe-fff1-fffe57573195" ] ] } ] } } } }, "Query at subscription level resource scope": { "parameters": { "api-version": "2017-08-09-preview", "policyEventsResource": "default", "resourceId": "subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResourceName" }, "responses": { "200": { "body": { "value": [ { "columns": { "EffectiveParameters": { "dataType": "String", "name": "EffectiveParameters", "ordinal": 5 }, "IsCompliant": { "dataType": "Boolean", "name": "IsCompliant", "ordinal": 6 }, "ManagementGroupIds": { "dataType": "String", "name": "ManagementGroupIds", "ordinal": 24 }, "PolicyAssignmentId": { "dataType": "String", "name": "PolicyAssignmentId", "ordinal": 3 }, "PolicyAssignmentName": { "dataType": "String", "name": "PolicyAssignmentName", "ordinal": 12 }, "PolicyAssignmentOwner": { "dataType": "String", "name": "PolicyAssignmentOwner", "ordinal": 13 }, "PolicyAssignmentParameters": { "dataType": "String", "name": "PolicyAssignmentParameters", "ordinal": 14 }, "PolicyAssignmentScope": { "dataType": "String", "name": "PolicyAssignmentScope", "ordinal": 15 }, "PolicyDefinitionAction": { "dataType": "String", "name": "PolicyDefinitionAction", "ordinal": 17 }, "PolicyDefinitionCategory": { "dataType": "String", "name": "PolicyDefinitionCategory", "ordinal": 18 }, "PolicyDefinitionId": { "dataType": "String", "name": "PolicyDefinitionId", "ordinal": 4 }, "PolicyDefinitionName": { "dataType": "String", "name": "PolicyDefinitionName", "ordinal": 16 }, "PolicyDefinitionReferenceId": { "dataType": "String", "name": "PolicyDefinitionReferenceId", "ordinal": 25 }, "PolicySetDefinitionCategory": { "dataType": "String", "name": "PolicySetDefinitionCategory", "ordinal": 22 }, "PolicySetDefinitionId": { "dataType": "String", "name": "PolicySetDefinitionId", "ordinal": 19 }, "PolicySetDefinitionName": { "dataType": "String", "name": "PolicySetDefinitionName", "ordinal": 20 }, "PolicySetDefinitionOwner": { "dataType": "String", "name": "PolicySetDefinitionOwner", "ordinal": 21 }, "PolicySetDefinitionParameters": { "dataType": "String", "name": "PolicySetDefinitionParameters", "ordinal": 23 }, "PrincipalOid": { "dataType": "String", "name": "PrincipalOid", "ordinal": 27 }, "ResourceGroup": { "dataType": "String", "name": "ResourceGroup", "ordinal": 10 }, "ResourceId": { "dataType": "String", "name": "ResourceId", "ordinal": 2 }, "ResourceLocation": { "dataType": "String", "name": "ResourceLocation", "ordinal": 9 }, "ResourceTags": { "dataType": "String", "name": "ResourceTags", "ordinal": 11 }, "ResourceType": { "dataType": "String", "name": "ResourceType", "ordinal": 8 }, "SubscriptionId": { "dataType": "String", "name": "SubscriptionId", "ordinal": 7 }, "TenantId": { "dataType": "String", "name": "TenantId", "ordinal": 26 }, "Timestamp": { "dataType": "DateTime", "name": "Timestamp", "ordinal": 1 } }, "metadata": { "generatedQuery": "" }, "rows": [ [ "2018-02-05T22:34:02.3475017Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResourceName", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fff27f38-fff4-fff8-fff1-fffc84b8c017", "/providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.SomeNamespace/someResourceType", "eastus", "", "tbd", "fff27f38-fff4-fff8-fff1-fffc84b8c017", "tbd", "{}", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5", "fffea587-fff0-fff3-ffff-fff0ae01cfd6", "audit", "tbd", "/providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8", "fffafdf9-fff9-fffd-ffff-fffa613e70a8", null, null, null, "", null, "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff890fa-fff0-fff3-fff9-fffd7653f078" ], [ "2018-02-05T22:34:01.6135357Z", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResourceName", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/Enable Monitoring in Azure Security Center", "/providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6", null, false, "fff10b27-fff3-fff5-fff8-fffbe01e86a5", "/Microsoft.SomeNamespace/someResourceType", "eastus", "", "tbd", "Enable Monitoring in Azure Security Center", "tbd", "{}", "/subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5", "fffea587-fff0-fff3-ffff-fff0ae01cfd6", "audit", "tbd", "/providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8", "fffafdf9-fff9-fffd-ffff-fffa613e70a8", null, null, null, "", null, "fff988bf-fff1-ffff-fffb-fffcd011db47", "fff890fa-fff0-fff3-fff9-fffd7653f078" ] ] } ] } } } } } } } }, "definitions": { "Column": { "description": "Column definition.", "properties": { "dataType": { "description": "Data type of the column.", "type": "string" }, "name": { "description": "Name of the column.", "type": "string" }, "ordinal": { "description": "Ordinal value of the column in a record.", "format": "int32", "type": "integer" } } }, "PolicyEventsQueryResults": { "description": "Query results.", "properties": { "value": { "description": "Query results.", "items": { "$ref": "#/definitions/PolicyEventsQueryResultsTable" }, "type": "array" } } }, "PolicyEventsQueryResultsTable": { "description": "Query results table.", "properties": { "columns": { "additionalProperties": { "description": "The list of key/value pairs for the additional properties, in the format 'key':'value' where key = the field name, and value = the field value. By default this is not populated" }, "description": "List of columns included in query results.", "properties": { "EffectiveParameters": { "$ref": "#/definitions/Column", "description": "Effective parameters for the policy assignment." }, "IsCompliant": { "$ref": "#/definitions/Column", "description": "Flag which states whether the resource is compliant against the policy assignment it was evaluated against." }, "ManagementGroupIds": { "$ref": "#/definitions/Column", "description": "Comma separated list of management group IDs, which represent the hierarchy of the management groups the resource is under." }, "PolicyAssignmentId": { "$ref": "#/definitions/Column", "description": "Policy assignment ID." }, "PolicyAssignmentName": { "$ref": "#/definitions/Column", "description": "Policy assignment name." }, "PolicyAssignmentOwner": { "$ref": "#/definitions/Column", "description": "Policy assignment owner." }, "PolicyAssignmentParameters": { "$ref": "#/definitions/Column", "description": "Policy assignment parameters." }, "PolicyAssignmentScope": { "$ref": "#/definitions/Column", "description": "Policy assignment scope." }, "PolicyDefinitionAction": { "$ref": "#/definitions/Column", "description": "Policy definition action, i.e. effect." }, "PolicyDefinitionCategory": { "$ref": "#/definitions/Column", "description": "Policy definition category." }, "PolicyDefinitionId": { "$ref": "#/definitions/Column", "description": "Policy definition ID." }, "PolicyDefinitionName": { "$ref": "#/definitions/Column", "description": "Policy definition name." }, "PolicyDefinitionReferenceId": { "$ref": "#/definitions/Column", "description": "Reference ID for the policy definition inside the policy set, if the policy assignment is for a policy set." }, "PolicySetDefinitionCategory": { "$ref": "#/definitions/Column", "description": "Policy set definition category, if the policy assignment is for a policy set." }, "PolicySetDefinitionId": { "$ref": "#/definitions/Column", "description": "Policy set definition ID, if the policy assignment is for a policy set." }, "PolicySetDefinitionName": { "$ref": "#/definitions/Column", "description": "Policy set definition name, if the policy assignment is for a policy set." }, "PolicySetDefinitionOwner": { "$ref": "#/definitions/Column", "description": "Policy set definition owner, if the policy assignment is for a policy set." }, "PolicySetDefinitionParameters": { "$ref": "#/definitions/Column", "description": "Policy set definition parameters, if the policy assignment is for a policy set." }, "PrincipalOid": { "$ref": "#/definitions/Column", "description": "Principal object ID for the user who initiated the resource operation that triggered the policy event." }, "ResourceGroup": { "$ref": "#/definitions/Column", "description": "Resource group name." }, "ResourceId": { "$ref": "#/definitions/Column", "description": "Resource ID." }, "ResourceLocation": { "$ref": "#/definitions/Column", "description": "Resource location." }, "ResourceTags": { "$ref": "#/definitions/Column", "description": "List of resource tags." }, "ResourceType": { "$ref": "#/definitions/Column", "description": "Resource type." }, "SubscriptionId": { "$ref": "#/definitions/Column", "description": "Subscription ID." }, "TenantId": { "$ref": "#/definitions/Column", "description": "Tenant ID for the policy event record." }, "Timestamp": { "$ref": "#/definitions/Column", "description": "Timestamp for the policy event record." } }, "type": "object" }, "metadata": { "description": "Metadata about the query results.", "properties": { "generatedQuery": { "description": "Internal query generated. Used for diagnostics purposes.", "type": "string" } } }, "rows": { "description": "Query result rows, each representing a policy event record.", "items": { "description": "Query result row.", "items": { "description": "Each column of the query result row." }, "type": "array" }, "type": "array" } } }, "QueryFailure": { "description": "Error response.", "properties": { "error": { "description": "Error definition.", "properties": { "code": { "description": "Service specific error code which serves as the substatus for the HTTP error code.", "type": "string" }, "message": { "description": "Description of the error.", "type": "string" } } } } } } }