swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: API spec for Microsoft.Security (Azure Security Center) resource provider
  title: Security Center
  version: 2019-01-01-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/automations.json
      version: "2.0"
  x-providerName: azure.com
  x-serviceName: security-automations
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  AutomationInBody:
    description: The security automation resource
    in: body
    name: Automation
    required: true
    schema:
      $ref: "#/definitions/Automation"
    x-ms-parameter-location: method
  AutomationName:
    description: The security automation name.
    in: path
    name: automationName
    required: true
    type: string
    x-ms-parameter-location: method
paths:
  "/subscriptions/{subscriptionId}/providers/Microsoft.Security/automations":
    get:
      description: Lists all the security automations in the specified subscription. Use the 'nextLink' property in the response to get the next page of security automations for the specified subscription.
      operationId: Automations_List
      parameters:
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/AutomationList"
        default:
          description: Error response that describes why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - Automations
      x-ms-examples:
        List all security automations of a specified subscription:
          parameters:
            api-version: 2019-01-01-preview
            subscriptionId: a5caac9c-5c04-49af-b3d0-e204f40345d5
          responses:
            "200":
              body:
                value:
                  - etag: etag value
                    id: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation
                    location: Central US
                    name: exampleAutomation
                    properties:
                      actions:
                        - actionType: LogicApp
                          logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                      description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                      isEnabled: true
                      scopes:
                        - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                          scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                      sources:
                        - eventSource: Assessments
                          ruleSets:
                            - rules:
                                - expectedValue: customAssessment
                                  operator: Equals
                                  propertyJPath: $.Entity.AssessmentType
                                  propertyType: String
                    tags: {}
                    type: Microsoft.Security/automations
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations":
    get:
      description: Lists all the security automations in the specified resource group. Use the 'nextLink' property in the response to get the next page of security automations for the specified resource group.
      operationId: Automations_ListByResourceGroup
      parameters:
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
        - description: The name of the resource group within the user's subscription. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/AutomationList"
        default:
          description: Error response that describes why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - Automations
      x-ms-examples:
        List all security automations of a specified resource group:
          parameters:
            api-version: 2019-01-01-preview
            resourceGroupName: exampleResourceGroup
            subscriptionId: a5caac9c-5c04-49af-b3d0-e204f40345d5
          responses:
            "200":
              body:
                value:
                  - etag: etag value
                    id: /subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation
                    location: Central US
                    name: exampleAutomation
                    properties:
                      actions:
                        - actionType: LogicApp
                          logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                      description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                      isEnabled: true
                      scopes:
                        - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                          scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                      sources:
                        - eventSource: Assessments
                          ruleSets:
                            - rules:
                                - expectedValue: customAssessment
                                  operator: Equals
                                  propertyJPath: $.Entity.AssessmentType
                                  propertyType: String
                    tags: {}
                    type: Microsoft.Security/automations
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations/{automationName}":
    delete:
      description: Deletes a security automation.
      operationId: Automations_Delete
      parameters:
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
        - description: The name of the resource group within the user's subscription. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/AutomationName"
      responses:
        "204":
          description: NoContent
        default:
          description: Error response that describes why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - Automations
      x-ms-examples:
        Delete a security automation:
          parameters:
            api-version: 2019-01-01-preview
            automationName: myAutomationName
            resourceGroupName: myRg
            subscriptionId: 20ff7fc3-e762-44dd-bd96-b71116dcdc23
          responses:
            "204": {}
    get:
      description: Retrieves information about the model of a security automation.
      operationId: Automations_Get
      parameters:
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
        - description: The name of the resource group within the user's subscription. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/AutomationName"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/Automation"
        default:
          description: Error response that describes why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - Automations
      x-ms-examples:
        Retrieve a security automation:
          parameters:
            api-version: 2019-01-01-preview
            automationName: exampleAutomation
            resourceGroupName: exampleResourceGroup
            subscriptionId: a5caac9c-5c04-49af-b3d0-e204f40345d5
          responses:
            "200":
              body:
                etag: etag value
                id: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation
                location: Central US
                name: exampleAutomation
                properties:
                  actions:
                    - actionType: LogicApp
                      logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                  description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                  isEnabled: true
                  scopes:
                    - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                      scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                  sources:
                    - eventSource: Assessments
                      ruleSets:
                        - rules:
                            - expectedValue: customAssessment
                              operator: Equals
                              propertyJPath: $.Entity.AssessmentType
                              propertyType: String
                tags: {}
                type: Microsoft.Security/automations
    put:
      description: Creates or updates a security automation. If a security automation is already created and a subsequent request is issued for the same automation id, then it will be updated.
      operationId: Automations_CreateOrUpdate
      parameters:
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
        - description: The name of the resource group within the user's subscription. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/AutomationName"
        - $ref: "#/parameters/AutomationInBody"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/Automation"
        "201":
          description: Created
          schema:
            $ref: "#/definitions/Automation"
        default:
          description: Error response that describes why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - Automations
      x-ms-examples:
        Create or update a security automation:
          parameters:
            Automation:
              etag: etag value (must be supplied for update)
              location: Central US
              properties:
                actions:
                  - actionType: LogicApp
                    logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                    uri: https://exampleTriggerUri1.com
                description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                isEnabled: true
                scopes:
                  - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                    scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                sources:
                  - eventSource: Assessments
                    ruleSets:
                      - rules:
                          - expectedValue: customAssessment
                            operator: Equals
                            propertyJPath: $.Entity.AssessmentType
                            propertyType: String
              tags: {}
            api-version: 2019-01-01-preview
            automationName: exampleAutomation
            resourceGroupName: exampleResourceGroup
            subscriptionId: a5caac9c-5c04-49af-b3d0-e204f40345d5
          responses:
            "200":
              body:
                etag: new etag value
                id: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation
                location: Central US
                name: exampleAutomation
                properties:
                  actions:
                    - actionType: LogicApp
                      logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                  description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                  isEnabled: true
                  scopes:
                    - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                      scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                  sources:
                    - eventSource: Assessments
                      ruleSets:
                        - rules:
                            - expectedValue: customAssessment
                              operator: Equals
                              propertyJPath: $.Entity.AssessmentType
                              propertyType: String
                tags: {}
                type: Microsoft.Security/automations
            "201":
              body:
                etag: new etag value
                id: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/SecurityAutomations/exampleAutomation
                location: Central US
                name: exampleAutomation
                properties:
                  actions:
                    - actionType: LogicApp
                      logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                  description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                  isEnabled: true
                  scopes:
                    - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                      scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                  sources:
                    - eventSource: Assessments
                      ruleSets:
                        - rules:
                            - expectedValue: customAssessment
                              operator: Equals
                              propertyJPath: $.Entity.AssessmentType
                              propertyType: String
                tags: {}
                type: Microsoft.Security/SecurityAutomations
        Disable or enable a security automation:
          parameters:
            Automation:
              etag: etag value (must be supplied for update)
              location: Central US
              properties:
                actions:
                  - actionType: LogicApp
                    logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                    uri: https://exampleTriggerUri1.com
                description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                isEnabled: false
                scopes:
                  - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                    scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                sources:
                  - eventSource: Assessments
                    ruleSets:
                      - rules:
                          - expectedValue: customAssessment
                            operator: Equals
                            propertyJPath: $.Entity.AssessmentType
                            propertyType: String
              tags: {}
            api-version: 2019-01-01-preview
            automationName: exampleAutomation
            resourceGroupName: exampleResourceGroup
            subscriptionId: a5caac9c-5c04-49af-b3d0-e204f40345d5
          responses:
            "200":
              body:
                etag: new etag value
                id: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation
                location: Central US
                name: exampleAutomation
                properties:
                  actions:
                    - actionType: LogicApp
                      logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                  description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                  isEnabled: false
                  scopes:
                    - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                      scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                  sources:
                    - eventSource: Assessments
                      ruleSets:
                        - rules:
                            - expectedValue: customAssessment
                              operator: Equals
                              propertyJPath: $.Entity.AssessmentType
                              propertyType: String
                tags: {}
                type: Microsoft.Security/automations
            "201":
              body:
                etag: new etag value
                id: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/SecurityAutomations/exampleAutomation
                location: Central US
                name: exampleAutomation
                properties:
                  actions:
                    - actionType: LogicApp
                      logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                  description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                  isEnabled: false
                  scopes:
                    - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                      scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                  sources:
                    - eventSource: Assessments
                      ruleSets:
                        - rules:
                            - expectedValue: customAssessment
                              operator: Equals
                              propertyJPath: $.Entity.AssessmentType
                              propertyType: String
                tags: {}
                type: Microsoft.Security/SecurityAutomations
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations/{automationName}/validate":
    post:
      description: Validates the security automation model before create or update. Any validation errors are returned to the client.
      operationId: Automations_Validate
      parameters:
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
        - description: The name of the resource group within the user's subscription. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - $ref: "#/parameters/AutomationName"
        - $ref: "#/parameters/AutomationInBody"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/AutomationValidationStatus"
        default:
          description: Error response that describes why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - Automations
      x-ms-examples:
        Validate the security automation model before create or update:
          parameters:
            Automation:
              location: Central US
              properties:
                actions:
                  - actionType: LogicApp
                    logicAppResourceId: /subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1
                    uri: https://exampleTriggerUri1.com
                description: An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment
                isEnabled: true
                scopes:
                  - description: "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5"
                    scopePath: /subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup
                sources:
                  - eventSource: Assessments
                    ruleSets:
                      - rules:
                          - expectedValue: customAssessment
                            operator: Equals
                            propertyJPath: $.Entity.AssessmentType
                            propertyType: String
              tags: {}
            api-version: 2019-01-01-preview
            automationName: exampleAutomation
            resourceGroupName: exampleResourceGroup
            subscriptionId: a5caac9c-5c04-49af-b3d0-e204f40345d5
          responses:
            "200":
              body:
                isValid: true
                message: Validation Successful
definitions:
  Automation:
    allOf:
      - allOf:
          - description: Describes an Azure resource.
            properties:
              id:
                description: Resource Id
                readOnly: true
                type: string
              name:
                description: Resource name
                readOnly: true
                type: string
              type:
                description: Resource type
                readOnly: true
                type: string
            type: object
            x-ms-azure-resource: true
          - description: Describes an Azure resource with location
            properties:
              location:
                description: Location where the resource is stored
                readOnly: true
                type: string
            type: object
          - description: Describes an Azure resource with kind
            properties:
              kind:
                description: Kind of the resource
                type: string
            type: object
          - description: Entity tag is used for comparing two or more entities from the same requested resource.
            properties:
              etag:
                description: Entity tag is used for comparing two or more entities from the same requested resource.
                type: string
            type: object
          - description: A list of key value pairs that describe the resource.
            properties:
              tags:
                additionalProperties:
                  type: string
                description: A list of key value pairs that describe the resource.
                type: object
            type: object
        description: Describes an Azure tracked resource.
        type: object
    description: The security automation resource.
    properties:
      properties:
        $ref: "#/definitions/AutomationProperties"
        description: Security automation data
        x-ms-client-flatten: true
    type: object
  AutomationAction:
    description: The action that should be triggered.
    discriminator: actionType
    properties:
      actionType:
        description: The type of the action that will be triggered by the Automation
        enum:
          - LogicApp
          - EventHub
          - Workspace
        type: string
        x-ms-enum:
          modelAsString: true
          name: ActionType
          values:
            - value: LogicApp
            - value: EventHub
            - value: Workspace
    required:
      - actionType
    type: object
  AutomationActionEventHub:
    allOf:
      - $ref: "#/definitions/AutomationAction"
    description: The target Event Hub to which event data will be exported. To learn more about Security Center continuous export capabilities, visit https://aka.ms/ASCExportLearnMore
    properties:
      connectionString:
        description: The target Event Hub connection string (it will not be included in any response).
        type: string
      eventHubResourceId:
        description: The target Event Hub Azure Resource ID.
        type: string
      sasPolicyName:
        description: The target Event Hub SAS policy name.
        readOnly: true
        type: string
    type: object
    x-ms-discriminator-value: EventHub
  AutomationActionLogicApp:
    allOf:
      - $ref: "#/definitions/AutomationAction"
    description: The logic app action that should be triggered. To learn more about Security Center's Workflow Automation capabilities, visit https://aka.ms/ASCWorkflowAutomationLearnMore
    properties:
      logicAppResourceId:
        description: The triggered Logic App Azure Resource ID. This can also reside on other subscriptions, given that you have permissions to trigger the Logic App
        type: string
      uri:
        description: The Logic App trigger URI endpoint (it will not be included in any response).
        format: uri
        type: string
    type: object
    x-ms-discriminator-value: LogicApp
  AutomationActionWorkspace:
    allOf:
      - $ref: "#/definitions/AutomationAction"
    description: The Log Analytics Workspace to which event data will be exported. Security alerts data will reside in the 'SecurityAlert' table and the assessments data will reside in the 'SecurityRecommendation' table (under the 'Security'/'SecurityCenterFree' solutions). Note that in order to view the data in the workspace, the Security Center Log Analytics free/standard solution needs to be enabled on that workspace. To learn more about Security Center continuous export capabilities, visit https://aka.ms/ASCExportLearnMore
    properties:
      workspaceResourceId:
        description: The fully qualified Log Analytics Workspace Azure Resource ID.
        type: string
    type: object
    x-ms-discriminator-value: Workspace
  AutomationList:
    description: List of security automations response.
    properties:
      nextLink:
        description: The URI to fetch the next page.
        readOnly: true
        type: string
      value:
        description: The list of security automations under the given scope.
        items:
          $ref: "#/definitions/Automation"
        type: array
    required:
      - value
  AutomationProperties:
    description: A set of properties that defines the behavior of the automation configuration. To learn more about the supported security events data models schemas - please visit https://aka.ms/ASCAutomationSchemas.
    properties:
      actions:
        description: A collection of the actions which are triggered if all the configured rules evaluations, within at least one rule set, are true.
        items:
          $ref: "#/definitions/AutomationAction"
        type: array
      description:
        description: The security automation description.
        type: string
      isEnabled:
        description: Indicates whether the security automation is enabled.
        type: boolean
      scopes:
        description: A collection of scopes on which the security automations logic is applied. Supported scopes are the subscription itself or a resource group under that subscription. The automation will only apply on defined scopes.
        items:
          $ref: "#/definitions/AutomationScope"
        type: array
      sources:
        description: A collection of the source event types which evaluate the security automation set of rules.
        items:
          $ref: "#/definitions/AutomationSource"
        type: array
    type: object
  AutomationRuleSet:
    description: A rule set which evaluates all its rules upon an event interception. Only when all the included rules in the rule set will be evaluated as 'true', will the event trigger the defined actions.
    properties:
      rules:
        items:
          $ref: "#/definitions/AutomationTriggeringRule"
        type: array
    type: object
  AutomationScope:
    description: A single automation scope.
    properties:
      description:
        description: The resources scope description.
        type: string
      scopePath:
        description: The resources scope path. Can be the subscription on which the automation is defined on or a resource group under that subscription (fully qualified Azure resource IDs).
        type: string
    type: object
  AutomationSource:
    description: The source event types which evaluate the security automation set of rules. For example - security alerts and security assessments. To learn more about the supported security events data models schemas - please visit https://aka.ms/ASCAutomationSchemas.
    properties:
      eventSource:
        description: A valid event source type.
        enum:
          - Assessments
          - Alerts
        type: string
        x-ms-enum:
          modelAsString: true
          name: EventSource
          values:
            - value: Assessments
            - value: Alerts
      ruleSets:
        description: A set of rules which evaluate upon event interception. A logical disjunction is applied between defined rule sets (logical 'or').
        items:
          $ref: "#/definitions/AutomationRuleSet"
        type: array
    type: object
  AutomationTriggeringRule:
    description: A rule which is evaluated upon event interception. The rule is configured by comparing a specific value from the event model to an expected value. This comparison is done by using one of the supported operators set.
    properties:
      expectedValue:
        description: The expected value.
        type: string
      operator:
        description: A valid comparer operator to use. A case-insensitive comparison will be applied for String PropertyType.
        enum:
          - Equals
          - GreaterThan
          - GreaterThanOrEqualTo
          - LesserThan
          - LesserThanOrEqualTo
          - NotEquals
          - Contains
          - StartsWith
          - EndsWith
        type: string
        x-ms-enum:
          modelAsString: true
          name: Operator
          values:
            - value: Equals
            - value: GreaterThan
            - value: GreaterThanOrEqualTo
            - value: LesserThan
            - value: LesserThanOrEqualTo
            - value: NotEquals
            - value: Contains
            - value: StartsWith
            - value: EndsWith
      propertyJPath:
        description: The JPath of the entity model property that should be checked.
        type: string
      propertyType:
        description: The data type of the compared operands (string, integer, floating point number or a boolean [true/false]]
        enum:
          - String
          - Integer
          - Number
          - Boolean
        type: string
        x-ms-enum:
          modelAsString: true
          name: PropertyType
          values:
            - value: String
            - value: Integer
            - value: Number
            - value: Boolean
    type: object
  AutomationValidationStatus:
    description: The security automation model state property bag.
    properties:
      isValid:
        description: Indicates whether the model is valid or not.
        type: boolean
      message:
        description: The validation message.
        type: string
    type: object
