{
  "swagger": "2.0",
  "schemes": [
    "https"
  ],
  "host": "management.azure.com",
  "info": {
    "description": "API spec for Microsoft.Security (Azure Security Center) resource provider",
    "title": "Security Center",
    "version": "2017-08-01-preview",
    "x-apisguru-categories": [
      "cloud"
    ],
    "x-logo": {
      "url": "https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png"
    },
    "x-origin": [
      {
        "format": "swagger",
        "url": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/security/resource-manager/Microsoft.Security/preview/2017-08-01-preview/deviceSecurityGroups.json",
        "version": "2.0"
      }
    ],
    "x-preferred": false,
    "x-providerName": "azure.com",
    "x-serviceName": "security-deviceSecurityGroups",
    "x-tags": [
      "Azure",
      "Microsoft"
    ]
  },
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "securityDefinitions": {
    "azure_auth": {
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "description": "Azure Active Directory OAuth2 Flow",
      "flow": "implicit",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      },
      "type": "oauth2"
    }
  },
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "parameters": {
    "DeviceSecurityGroup": {
      "description": "Security group object.",
      "in": "body",
      "name": "deviceSecurityGroup",
      "required": true,
      "schema": {
        "$ref": "#/definitions/DeviceSecurityGroup"
      },
      "x-ms-parameter-location": "method"
    },
    "DeviceSecurityGroupName": {
      "description": "The name of the security group. Please notice that the name is case insensitive.",
      "in": "path",
      "name": "deviceSecurityGroupName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    }
  },
  "paths": {
    "/{resourceId}/providers/Microsoft.Security/deviceSecurityGroups": {
      "get": {
        "description": "Gets the list of device security groups for the specified IoT hub resource.",
        "operationId": "DeviceSecurityGroups_List",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "The identifier of the resource.",
            "in": "path",
            "name": "resourceId",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DeviceSecurityGroupList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "DeviceSecurityGroups"
        ],
        "x-ms-examples": {
          "List all device security groups for the specified IoT hub resource": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "resourceId": "subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub/providers/Microsoft.Security/deviceSecurityGroups/samplesecuritygroup",
                      "name": "samplesecuritygroup",
                      "properties": {
                        "allowlistRules": [
                          {
                            "allowlistValues": [],
                            "description": "Get an alert when an outbound connection is created between your device and an ip that isn't allowed",
                            "displayName": "Outbound connection to an ip that isn't allowed",
                            "isEnabled": false,
                            "ruleType": "ConnectionToIpNotAllowed",
                            "valueType": "IpCidr"
                          },
                          {
                            "allowlistValues": [],
                            "description": "Get an alert when a local user that isn't allowed logins to the device",
                            "displayName": "Login by a local user that isn't allowed",
                            "isEnabled": false,
                            "ruleType": "LocalUserNotAllowed",
                            "valueType": "String"
                          },
                          {
                            "allowlistValues": [],
                            "description": "Get an alert when a process that isn't allowed is executed",
                            "displayName": "Execution of a process that isn't allowed",
                            "isEnabled": false,
                            "ruleType": "ProcessNotAllowed",
                            "valueType": "String"
                          }
                        ],
                        "denylistRules": [],
                        "thresholdRules": [],
                        "timeWindowRules": [
                          {
                            "description": "Get an alert when the number of active connections of a device in the time window is not in the allowed range",
                            "displayName": "Number of active connections is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "ActiveConnectionsNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of cloud to device messages (AMQP protocol) in the time window is not in the allowed range",
                            "displayName": "Number of cloud to device messages (AMQP protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "AmqpC2DMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of cloud to device messages (MQTT protocol) in the time window is not in the allowed range",
                            "displayName": "Number of cloud to device messages (MQTT protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "MqttC2DMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of cloud to device messages (HTTP protocol) in the time window is not in the allowed range",
                            "displayName": "Number of cloud to device messages (HTTP protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "HttpC2DMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of cloud to device messages (AMQP protocol) that were rejected by the device in the time window is not in the allowed range",
                            "displayName": "Number of rejected cloud to device messages (AMQP protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "AmqpC2DRejectedMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of cloud to device messages (MQTT protocol) that were rejected by the device in the time window is not in the allowed range",
                            "displayName": "Number of rejected cloud to device messages (MQTT protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "MqttC2DRejectedMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of cloud to device messages (HTTP protocol) that were rejected by the device in the time window is not in the allowed range",
                            "displayName": "Number of rejected cloud to device messages (HTTP protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "HttpC2DRejectedMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of device to cloud messages (AMQP protocol) in the time window is not in the allowed range",
                            "displayName": "Number of device to cloud messages (AMQP protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "AmqpD2CMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of device to cloud messages (MQTT protocol) in the time window is not in the allowed range",
                            "displayName": "Number of device to cloud messages (MQTT protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "MqttD2CMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of device to cloud messages (HTTP protocol) in the time window is not in the allowed range",
                            "displayName": "Number of device to cloud messages (HTTP protocol) is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "HttpD2CMessagesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of direct method invokes in the time window is not in the allowed range",
                            "displayName": "Number of direct method invokes is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "DirectMethodInvokesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of failed local logins on the device in the time window is not in the allowed range",
                            "displayName": "Number of failed local logins is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "FailedLocalLoginsNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of file uploads from the device to the cloud in the time window is not in the allowed range",
                            "displayName": "Number of file uploads is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "FileUploadsNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of device queue purges in the time window is not in the allowed range",
                            "displayName": "Number of device queue purges is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "QueuePurgesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number of twin updates (by the device or the service) in the time window is not in the allowed range",
                            "displayName": "Number of twin updates is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "TwinUpdatesNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          },
                          {
                            "description": "Get an alert when the number unauthorized operations in the time window is not in the allowed range. Unauthorized operations are operations that affect the device (or done by it) that fail because of an unauthorized error",
                            "displayName": "Number of unauthorized operations is not in allowed range",
                            "isEnabled": false,
                            "maxThreshold": 0,
                            "minThreshold": 0,
                            "ruleType": "UnauthorizedOperationsNotInAllowedRange",
                            "timeWindowSize": "PT15M"
                          }
                        ]
                      },
                      "type": "Microsoft.Security/deviceSecurityGroups"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/{resourceId}/providers/Microsoft.Security/deviceSecurityGroups/{deviceSecurityGroupName}": {
      "delete": {
        "description": "Deletes the security group",
        "operationId": "DeviceSecurityGroups_Delete",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "The identifier of the resource.",
            "in": "path",
            "name": "resourceId",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/DeviceSecurityGroupName"
          }
        ],
        "responses": {
          "200": {
            "description": "Device security group has been deleted."
          },
          "204": {
            "description": "Device security group does not exist."
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "DeviceSecurityGroups"
        ],
        "x-ms-examples": {
          "Delete a device security group for the specified IoT hub resource": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "deviceSecurityGroupName": "samplesecuritygroup",
              "resourceId": "subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "description": "Gets the device security group for the specified IoT hub resource.",
        "operationId": "DeviceSecurityGroups_Get",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "The identifier of the resource.",
            "in": "path",
            "name": "resourceId",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/DeviceSecurityGroupName"
          }
        ],
        "responses": {
          "200": {
            "description": "Successful request to get security group.",
            "schema": {
              "$ref": "#/definitions/DeviceSecurityGroup"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "DeviceSecurityGroups"
        ],
        "x-ms-examples": {
          "Get an device security group for the specified IoT hub resource": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "deviceSecurityGroupName": "samplesecuritygroup",
              "resourceId": "subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub/providers/Microsoft.Security/deviceSecurityGroups/samplesecuritygroup",
                  "name": "samplesecuritygroup",
                  "properties": {
                    "allowlistRules": [
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when an outbound connection is created between your device and an ip that isn't allowed",
                        "displayName": "Outbound connection to an ip that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "ConnectionToIpNotAllowed",
                        "valueType": "IpCidr"
                      },
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when a local user that isn't allowed logins to the device",
                        "displayName": "Login by a local user that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "LocalUserNotAllowed",
                        "valueType": "String"
                      },
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when a process that isn't allowed is executed",
                        "displayName": "Execution of a process that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "ProcessNotAllowed",
                        "valueType": "String"
                      }
                    ],
                    "denylistRules": [],
                    "thresholdRules": [],
                    "timeWindowRules": [
                      {
                        "description": "Get an alert when the number of active connections of a device in the time window is not in the allowed range",
                        "displayName": "Number of active connections is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "ActiveConnectionsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (AMQP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (MQTT protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (HTTP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (AMQP protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (MQTT protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (HTTP protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (AMQP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (MQTT protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (HTTP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of direct method invokes in the time window is not in the allowed range",
                        "displayName": "Number of direct method invokes is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "DirectMethodInvokesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of failed local logins on the device in the time window is not in the allowed range",
                        "displayName": "Number of failed local logins is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "FailedLocalLoginsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of file uploads from the device to the cloud in the time window is not in the allowed range",
                        "displayName": "Number of file uploads is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "FileUploadsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device queue purges in the time window is not in the allowed range",
                        "displayName": "Number of device queue purges is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "QueuePurgesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of twin updates (by the device or the service) in the time window is not in the allowed range",
                        "displayName": "Number of twin updates is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "TwinUpdatesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number unauthorized operations in the time window is not in the allowed range. Unauthorized operations are operations that affect the device (or done by it) that fail because of an unauthorized error",
                        "displayName": "Number of unauthorized operations is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "UnauthorizedOperationsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      }
                    ]
                  },
                  "type": "Microsoft.Security/deviceSecurityGroups"
                }
              }
            }
          }
        }
      },
      "put": {
        "description": "Creates or updates the device security group on a specified IoT hub resource.",
        "operationId": "DeviceSecurityGroups_CreateOrUpdate",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "The identifier of the resource.",
            "in": "path",
            "name": "resourceId",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/DeviceSecurityGroupName"
          },
          {
            "$ref": "#/parameters/DeviceSecurityGroup"
          }
        ],
        "responses": {
          "200": {
            "description": "Security group was updated",
            "schema": {
              "$ref": "#/definitions/DeviceSecurityGroup"
            }
          },
          "201": {
            "description": "Security group was created",
            "schema": {
              "$ref": "#/definitions/DeviceSecurityGroup"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "DeviceSecurityGroups"
        ],
        "x-ms-examples": {
          "Create or update a device security group for the specified IoT hub resource": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "deviceSecurityGroup": {
                "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub/providers/Microsoft.Security/deviceSecurityGroups/samplesecuritygroup",
                "name": "samplesecuritygroup",
                "properties": {
                  "timeWindowRules": [
                    {
                      "description": "Get an alert when the number of active connections of a device in the time window is not in the allowed range",
                      "displayName": "Number of active connections is not in allowed range",
                      "isEnabled": true,
                      "maxThreshold": 30,
                      "minThreshold": 0,
                      "ruleType": "ActiveConnectionsNotInAllowedRange",
                      "timeWindowSize": "PT05M"
                    }
                  ]
                },
                "type": "Microsoft.Security/deviceSecurityGroups"
              },
              "deviceSecurityGroupName": "samplesecuritygroup",
              "resourceId": "subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub/providers/Microsoft.Security/deviceSecurityGroups/samplesecuritygroup",
                  "name": "samplesecuritygroup",
                  "properties": {
                    "allowlistRules": [
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when an outbound connection is created between your device and an ip that isn't allowed",
                        "displayName": "Outbound connection to an ip that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "ConnectionToIpNotAllowed"
                      },
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when a local user that isn't allowed logins to the device",
                        "displayName": "Login by a local user that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "LocalUserNotAllowed"
                      },
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when a process that isn't allowed is executed",
                        "displayName": "Execution of a process that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "ProcessNotAllowed"
                      }
                    ],
                    "denylistRules": [],
                    "thresholdRules": [],
                    "timeWindowRules": [
                      {
                        "description": "Get an alert when the number of active connections of a device in the time window is not in the allowed range",
                        "displayName": "Number of active connections is not in allowed range",
                        "isEnabled": true,
                        "maxThreshold": 30,
                        "minThreshold": 0,
                        "ruleType": "ActiveConnectionsNotInAllowedRange",
                        "timeWindowSize": "PT05M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (AMQP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (MQTT protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (HTTP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (AMQP protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (MQTT protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (HTTP protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (AMQP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (MQTT protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (HTTP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of direct method invokes in the time window is not in the allowed range",
                        "displayName": "Number of direct method invokes is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "DirectMethodInvokesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of failed local logins on the device in the time window is not in the allowed range",
                        "displayName": "Number of failed local logins is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "FailedLocalLoginsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of file uploads from the device to the cloud in the time window is not in the allowed range",
                        "displayName": "Number of file uploads is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "FileUploadsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device queue purges in the time window is not in the allowed range",
                        "displayName": "Number of device queue purges is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "QueuePurgesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of twin updates (by the device or the service) in the time window is not in the allowed range",
                        "displayName": "Number of twin updates is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "TwinUpdatesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number unauthorized operations in the time window is not in the allowed range. Unauthorized operations are operations that affect the device (or done by it) that fail because of an unauthorized error",
                        "displayName": "Number of unauthorized operations is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "UnauthorizedOperationsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      }
                    ]
                  },
                  "type": "Microsoft.Security/deviceSecurityGroups"
                }
              },
              "201": {
                "body": {
                  "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/SampleRG/providers/Microsoft.Devices/iotHubs/sampleiothub/providers/Microsoft.Security/deviceSecurityGroups/samplesecuritygroup",
                  "name": "samplesecuritygroup",
                  "properties": {
                    "allowlistRules": [
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when an outbound connection is created between your device and an ip that isn't allowed",
                        "displayName": "Outbound connection to an ip that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "ConnectionToIpNotAllowed"
                      },
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when a local user that isn't allowed logins to the device",
                        "displayName": "Login by a local user that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "LocalUserNotAllowed"
                      },
                      {
                        "allowlistValues": [],
                        "description": "Get an alert when a process that isn't allowed is executed",
                        "displayName": "Execution of a process that isn't allowed",
                        "isEnabled": false,
                        "ruleType": "ProcessNotAllowed"
                      }
                    ],
                    "denylistRules": [],
                    "thresholdRules": [],
                    "timeWindowRules": [
                      {
                        "description": "Get an alert when the number of active connections of a device in the time window is not in the allowed range",
                        "displayName": "Number of active connections is not in allowed range",
                        "isEnabled": true,
                        "maxThreshold": 30,
                        "minThreshold": 0,
                        "ruleType": "ActiveConnectionsNotInAllowedRange",
                        "timeWindowSize": "PT05M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (AMQP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (MQTT protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (HTTP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of cloud to device messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpC2DMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (AMQP protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (MQTT protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of cloud to device messages (HTTP protocol) that were rejected by the device in the time window is not in the allowed range",
                        "displayName": "Number of rejected cloud to device messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpC2DRejectedMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (AMQP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (AMQP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "AmqpD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (MQTT protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (MQTT protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "MqttD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device to cloud messages (HTTP protocol) in the time window is not in the allowed range",
                        "displayName": "Number of device to cloud messages (HTTP protocol) is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "HttpD2CMessagesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of direct method invokes in the time window is not in the allowed range",
                        "displayName": "Number of direct method invokes is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "DirectMethodInvokesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of failed local logins on the device in the time window is not in the allowed range",
                        "displayName": "Number of failed local logins is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "FailedLocalLoginsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of file uploads from the device to the cloud in the time window is not in the allowed range",
                        "displayName": "Number of file uploads is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "FileUploadsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of device queue purges in the time window is not in the allowed range",
                        "displayName": "Number of device queue purges is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "QueuePurgesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number of twin updates (by the device or the service) in the time window is not in the allowed range",
                        "displayName": "Number of twin updates is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "TwinUpdatesNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      },
                      {
                        "description": "Get an alert when the number unauthorized operations in the time window is not in the allowed range. Unauthorized operations are operations that affect the device (or done by it) that fail because of an unauthorized error",
                        "displayName": "Number of unauthorized operations is not in allowed range",
                        "isEnabled": false,
                        "maxThreshold": 0,
                        "minThreshold": 0,
                        "ruleType": "UnauthorizedOperationsNotInAllowedRange",
                        "timeWindowSize": "PT15M"
                      }
                    ]
                  },
                  "type": "Microsoft.Security/deviceSecurityGroups"
                }
              }
            }
          }
        }
      }
    }
  },
  "definitions": {
    "AllowlistCustomAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/ListCustomAlertRule"
        }
      ],
      "description": "A custom alert rule that checks if a value (depends on the custom alert type) is allowed",
      "properties": {
        "allowlistValues": {
          "description": "The values to allow. The format of the values depends on the rule type.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "ruleType": {
          "description": "The type of the custom alert rule.",
          "enum": [
            "ConnectionToIpNotAllowed",
            "LocalUserNotAllowed",
            "ProcessNotAllowed"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "ruleType",
            "values": [
              {
                "description": "Outbound connection to an ip that isn't allowed. Allow list consists of ipv4 or ipv6 range in CIDR notation.",
                "value": "ConnectionToIpNotAllowed"
              },
              {
                "description": "Login by a local user that isn't allowed. Allow list consists of login names to allow.",
                "value": "LocalUserNotAllowed"
              },
              {
                "description": "Execution of a process that isn't allowed. Allow list consists of process names to allow.",
                "value": "ProcessNotAllowed"
              }
            ]
          }
        }
      },
      "required": [
        "allowlistValues"
      ],
      "type": "object"
    },
    "CustomAlertRule": {
      "description": "A custom alert rule",
      "properties": {
        "description": {
          "description": "The description of the custom alert.",
          "readOnly": true,
          "type": "string"
        },
        "displayName": {
          "description": "The display name of the custom alert.",
          "readOnly": true,
          "type": "string"
        },
        "isEnabled": {
          "description": "Whether the custom alert is enabled.",
          "type": "boolean"
        },
        "ruleType": {
          "description": "The type of the custom alert rule.",
          "type": "string"
        }
      },
      "required": [
        "isEnabled",
        "ruleType"
      ],
      "type": "object"
    },
    "DenylistCustomAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/ListCustomAlertRule"
        }
      ],
      "description": "A custom alert rule that checks if a value (depends on the custom alert type) is denied",
      "properties": {
        "denylistValues": {
          "description": "The values to deny. The format of the values depends on the rule type.",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "required": [
        "denylistValues"
      ],
      "type": "object"
    },
    "DeviceSecurityGroup": {
      "allOf": [
        {
          "description": "Describes an Azure resource.",
          "properties": {
            "id": {
              "description": "Resource Id",
              "readOnly": true,
              "type": "string"
            },
            "name": {
              "description": "Resource name",
              "readOnly": true,
              "type": "string"
            },
            "type": {
              "description": "Resource type",
              "readOnly": true,
              "type": "string"
            }
          },
          "type": "object",
          "x-ms-azure-resource": true
        }
      ],
      "description": "The device security group resource",
      "properties": {
        "properties": {
          "$ref": "#/definitions/DeviceSecurityGroupProperties",
          "description": "Device Security group data",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "DeviceSecurityGroupList": {
      "description": "List of device security groups",
      "properties": {
        "nextLink": {
          "description": "The URI to fetch the next page.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "List of device security group objects",
          "items": {
            "$ref": "#/definitions/DeviceSecurityGroup"
          },
          "type": "array"
        }
      },
      "readOnly": true,
      "type": "object"
    },
    "DeviceSecurityGroupProperties": {
      "description": "describes properties of a security group.",
      "properties": {
        "allowlistRules": {
          "description": "A list of allow-list custom alert rules.",
          "items": {
            "$ref": "#/definitions/AllowlistCustomAlertRule",
            "type": "object"
          },
          "type": "array"
        },
        "denylistRules": {
          "description": "A list of deny-list custom alert rules.",
          "items": {
            "$ref": "#/definitions/DenylistCustomAlertRule",
            "type": "object"
          },
          "type": "array"
        },
        "thresholdRules": {
          "description": "A list of threshold custom alert rules.",
          "items": {
            "$ref": "#/definitions/ThresholdCustomAlertRule",
            "type": "object"
          },
          "type": "array"
        },
        "timeWindowRules": {
          "description": "A list of time window custom alert rules.",
          "items": {
            "$ref": "#/definitions/TimeWindowCustomAlertRule",
            "type": "object"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "ListCustomAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/CustomAlertRule"
        }
      ],
      "description": "A List custom alert rule",
      "properties": {
        "valueType": {
          "description": "The value type of the items in the list",
          "enum": [
            "IpCidr",
            "String"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "valueType",
            "values": [
              {
                "description": "An IP range in CIDR format (e.g. '192.168.0.1/8').",
                "value": "IpCidr"
              },
              {
                "description": "Any string value.",
                "value": "String"
              }
            ]
          }
        }
      },
      "type": "object"
    },
    "ThresholdCustomAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/CustomAlertRule"
        }
      ],
      "description": "A custom alert rule that checks if a value (depends on the custom alert type) is within the given range.",
      "properties": {
        "maxThreshold": {
          "description": "The maximum threshold.",
          "type": "integer"
        },
        "minThreshold": {
          "description": "The minimum threshold.",
          "type": "integer"
        }
      },
      "required": [
        "minThreshold",
        "maxThreshold"
      ],
      "type": "object"
    },
    "TimeWindowCustomAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/CustomAlertRule"
        },
        {
          "$ref": "#/definitions/ThresholdCustomAlertRule"
        }
      ],
      "description": "A custom alert rule that checks if the number of activities (depends on the custom alert type) in a time window is within the given range.",
      "properties": {
        "ruleType": {
          "description": "The type of the custom alert rule.",
          "enum": [
            "ActiveConnectionsNotInAllowedRange",
            "AmqpC2DMessagesNotInAllowedRange",
            "MqttC2DMessagesNotInAllowedRange",
            "HttpC2DMessagesNotInAllowedRange",
            "AmqpC2DRejectedMessagesNotInAllowedRange",
            "MqttC2DRejectedMessagesNotInAllowedRange",
            "HttpC2DRejectedMessagesNotInAllowedRange",
            "AmqpD2CMessagesNotInAllowedRange",
            "MqttD2CMessagesNotInAllowedRange",
            "HttpD2CMessagesNotInAllowedRange",
            "DirectMethodInvokesNotInAllowedRange",
            "FailedLocalLoginsNotInAllowedRange",
            "FileUploadsNotInAllowedRange",
            "QueuePurgesNotInAllowedRange",
            "TwinUpdatesNotInAllowedRange",
            "UnauthorizedOperationsNotInAllowedRange"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "ruleType",
            "values": [
              {
                "description": "Number of active connections is not in allowed range.",
                "value": "ActiveConnectionsNotInAllowedRange"
              },
              {
                "description": "Number of cloud to device messages (AMQP protocol) is not in allowed range.",
                "value": "AmqpC2DMessagesNotInAllowedRange"
              },
              {
                "description": "Number of cloud to device messages (MQTT protocol) is not in allowed range.",
                "value": "MqttC2DMessagesNotInAllowedRange"
              },
              {
                "description": "Number of cloud to device messages (HTTP protocol) is not in allowed range.",
                "value": "HttpC2DMessagesNotInAllowedRange"
              },
              {
                "description": "Number of rejected cloud to device messages (AMQP protocol) is not in allowed range.",
                "value": "AmqpC2DRejectedMessagesNotInAllowedRange"
              },
              {
                "description": "Number of rejected cloud to device messages (MQTT protocol) is not in allowed range.",
                "value": "MqttC2DRejectedMessagesNotInAllowedRange"
              },
              {
                "description": "Number of rejected cloud to device messages (HTTP protocol) is not in allowed range.",
                "value": "HttpC2DRejectedMessagesNotInAllowedRange"
              },
              {
                "description": "Number of device to cloud messages (AMQP protocol) is not in allowed range.",
                "value": "AmqpD2CMessagesNotInAllowedRange"
              },
              {
                "description": "Number of device to cloud messages (MQTT protocol) is not in allowed range.",
                "value": "MqttD2CMessagesNotInAllowedRange"
              },
              {
                "description": "Number of device to cloud messages (HTTP protocol) is not in allowed range.",
                "value": "HttpD2CMessagesNotInAllowedRange"
              },
              {
                "description": "Number of direct method invokes is not in allowed range.",
                "value": "DirectMethodInvokesNotInAllowedRange"
              },
              {
                "description": "Number of failed local logins is not in allowed range.",
                "value": "FailedLocalLoginsNotInAllowedRange"
              },
              {
                "description": "Number of file uploads is not in allowed range.",
                "value": "FileUploadsNotInAllowedRange"
              },
              {
                "description": "Number of device queue purges is not in allowed range.",
                "value": "QueuePurgesNotInAllowedRange"
              },
              {
                "description": "Number of twin updates is not in allowed range.",
                "value": "TwinUpdatesNotInAllowedRange"
              },
              {
                "description": "Number of unauthorized operations is not in allowed range.",
                "value": "UnauthorizedOperationsNotInAllowedRange"
              }
            ]
          }
        },
        "timeWindowSize": {
          "description": "The time window size in iso8601 format.",
          "format": "duration",
          "type": "string"
        }
      },
      "required": [
        "timeWindowSize"
      ],
      "type": "object"
    }
  }
}