swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: API spec for Microsoft.Security (Azure Security Center) resource provider
  title: Security Center
  version: 2015-06-01-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/externalSecuritySolutions.json
      version: "2.0"
  x-providerName: azure.com
  x-serviceName: security-externalSecuritySolutions
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  ExternalSecuritySolutionsName:
    description: Name of an external security solution.
    in: path
    name: externalSecuritySolutionsName
    required: true
    type: string
    x-ms-parameter-location: method
paths:
  "/subscriptions/{subscriptionId}/providers/Microsoft.Security/externalSecuritySolutions":
    get:
      description: Gets a list of external security solutions for the subscription.
      operationId: ExternalSecuritySolutions_List
      parameters:
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/ExternalSecuritySolutionList"
        default:
          description: Error response describing why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - ExternalSecuritySolutions
      x-ms-examples:
        Get external security solutions on a subscription:
          parameters:
            api-version: 2015-06-01-preview
            subscriptionId: 20ff7fc3-e762-44dd-bd96-b71116dcdc23
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/defaultresourcegroup-eus/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                    kind: AAD
                    location: eastus
                    name: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/defaultresourcegroup-eus/providers/Microsoft.OperationalInsights/workspaces/defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/defaultresourcegroup-weu/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-weu
                    kind: AAD
                    location: westeurope
                    name: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-weu
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/defaultresourcegroup-weu/providers/Microsoft.OperationalInsights/workspaces/defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-weu
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/cef_omsprd_barracudanetworks_waf_barracuda
                    kind: CEF
                    location: westcentralus
                    name: cef_omsprd_barracudanetworks_waf_barracuda
                    properties:
                      deviceType: WAF
                      deviceVendor: barracudanetworks
                      hostname: barracuda
                      lastEventReceived: 2018-05-09T10:30:11.523Z
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/cef_omsprd_virtualhoneypot_Microsoft_demovm20
                    kind: CEF
                    location: westcentralus
                    name: cef_omsprd_virtualhoneypot_Microsoft_demovm20
                    properties:
                      deviceType: Microsoft
                      deviceVendor: virtualHoneypot
                      hostname: demovm20
                      lastEventReceived: 2018-05-08T15:42:22.57Z
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/cef_omsprd_virtualhoneypot_Microsoft_demovm10
                    kind: CEF
                    location: westcentralus
                    name: cef_omsprd_virtualhoneypot_Microsoft_demovm10
                    properties:
                      deviceType: Microsoft
                      deviceVendor: virtualHoneypot
                      hostname: demovm10
                      lastEventReceived: 2018-05-08T10:38:53.423Z
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_omsprd
                    kind: AAD
                    location: westcentralus
                    name: aad_omsprd
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/defaultresourcegroup-ejp/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-ejp
                    kind: AAD
                    location: japaneast
                    name: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-ejp
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/defaultresourcegroup-ejp/providers/Microsoft.OperationalInsights/workspaces/defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-ejp
                    type: Microsoft.Security/locations/externalSecuritySolutions
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/ExternalSecuritySolutions":
    get:
      description: Gets a list of external Security Solutions for the subscription and location.
      operationId: ExternalSecuritySolutions_ListByHomeRegion
      parameters:
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
        - description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
          in: path
          name: ascLocation
          required: true
          type: string
          x-ms-parameter-location: client
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/ExternalSecuritySolutionList"
        default:
          description: Error response describing why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - ExternalSecuritySolutions
      x-ms-examples:
        Get external security solutions on a subscription from security data location:
          parameters:
            api-version: 2015-06-01-preview
            ascLocation: centralus
            subscriptionId: 20ff7fc3-e762-44dd-bd96-b71116dcdc23
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/defaultresourcegroup-eus/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                    kind: AAD
                    location: eastus
                    name: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/defaultresourcegroup-eus/providers/Microsoft.OperationalInsights/workspaces/defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/defaultresourcegroup-weu/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-weu
                    kind: AAD
                    location: westeurope
                    name: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-weu
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/defaultresourcegroup-weu/providers/Microsoft.OperationalInsights/workspaces/defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-weu
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/cef_omsprd_barracudanetworks_waf_barracuda
                    kind: CEF
                    location: westcentralus
                    name: cef_omsprd_barracudanetworks_waf_barracuda
                    properties:
                      deviceType: WAF
                      deviceVendor: barracudanetworks
                      hostname: barracuda
                      lastEventReceived: 2018-05-09T10:30:11.523Z
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/cef_omsprd_virtualhoneypot_Microsoft_demovm20
                    kind: CEF
                    location: westcentralus
                    name: cef_omsprd_virtualhoneypot_Microsoft_demovm20
                    properties:
                      deviceType: Microsoft
                      deviceVendor: virtualHoneypot
                      hostname: demovm20
                      lastEventReceived: 2018-05-08T15:42:22.57Z
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/cef_omsprd_virtualhoneypot_Microsoft_demovm10
                    kind: CEF
                    location: westcentralus
                    name: cef_omsprd_virtualhoneypot_Microsoft_demovm10
                    properties:
                      deviceType: Microsoft
                      deviceVendor: virtualHoneypot
                      hostname: demovm10
                      lastEventReceived: 2018-05-08T10:38:53.423Z
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/unificationprod/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_omsprd
                    kind: AAD
                    location: westcentralus
                    name: aad_omsprd
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/unificationprod/providers/Microsoft.OperationalInsights/workspaces/omsprd
                    type: Microsoft.Security/locations/externalSecuritySolutions
                  - id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/defaultresourcegroup-ejp/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-ejp
                    kind: AAD
                    location: japaneast
                    name: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-ejp
                    properties:
                      connectivityState: Discovered
                      deviceType: Azure Active Directory Identity Protection
                      deviceVendor: Microsoft
                      workspace:
                        id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/defaultresourcegroup-ejp/providers/Microsoft.OperationalInsights/workspaces/defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-ejp
                    type: Microsoft.Security/locations/externalSecuritySolutions
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/ExternalSecuritySolutions/{externalSecuritySolutionsName}":
    get:
      description: Gets a specific external Security Solution.
      operationId: ExternalSecuritySolutions_Get
      parameters:
        - description: Azure subscription ID
          in: path
          name: subscriptionId
          pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
          required: true
          type: string
        - description: The name of the resource group within the user's subscription. The name is case insensitive.
          in: path
          maxLength: 90
          minLength: 1
          name: resourceGroupName
          pattern: ^[-\w\._\(\)]+$
          required: true
          type: string
          x-ms-parameter-location: method
        - description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
          in: path
          name: ascLocation
          required: true
          type: string
          x-ms-parameter-location: client
        - $ref: "#/parameters/ExternalSecuritySolutionsName"
        - description: API version for the operation
          in: query
          name: api-version
          required: true
          type: string
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/ExternalSecuritySolution"
        default:
          description: Error response describing why the operation failed.
          schema:
            description: Error response structure.
            properties:
              error:
                description: Error details.
                properties:
                  code:
                    description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
                    readOnly: true
                    type: string
                  message:
                    description: A message describing the error, intended to be suitable for display in a user interface.
                    readOnly: true
                    type: string
                type: object
                x-ms-external: true
            type: object
            x-ms-external: true
      tags:
        - ExternalSecuritySolutions
      x-ms-examples:
        Get external security solution:
          parameters:
            api-version: 2015-06-01-preview
            ascLocation: centralus
            externalSecuritySolutionsName: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
            resourceGroupName: defaultresourcegroup-eus
            subscriptionId: 20ff7fc3-e762-44dd-bd96-b71116dcdc23
          responses:
            "200":
              body:
                id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/defaultresourcegroup-eus/providers/Microsoft.Security/locations/centralus/externalSecuritySolutions/aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                kind: AAD
                location: eastus
                name: aad_defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                properties:
                  connectivityState: Discovered
                  deviceType: Azure Active Directory Identity Protection
                  deviceVendor: Microsoft
                  workspace:
                    id: /subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourcegroups/defaultresourcegroup-eus/providers/Microsoft.OperationalInsights/workspaces/defaultworkspace-20ff7fc3-e762-44dd-bd96-b71116dcdc23-eus
                type: Microsoft.Security/locations/externalSecuritySolutions
definitions:
  AadConnectivityState:
    description: Describes an Azure resource with kind
    properties:
      connectivityState:
        enum:
          - Discovered
          - NotLicensed
          - Connected
        title: "The connectivity state of the external AAD solution "
        type: string
        x-ms-enum:
          modelAsString: true
          name: AadConnectivityState
          values:
            - value: Discovered
            - value: NotLicensed
            - value: Connected
    type: object
  AadExternalSecuritySolution:
    allOf:
      - $ref: "#/definitions/ExternalSecuritySolution"
    description: Represents an AAD identity protection solution which sends logs to an OMS workspace.
    properties:
      properties:
        $ref: "#/definitions/AadSolutionProperties"
    type: object
    x-ms-discriminator-value: AAD
  AadSolutionProperties:
    allOf:
      - $ref: "#/definitions/ExternalSecuritySolutionProperties"
      - $ref: "#/definitions/AadConnectivityState"
    title: The external security solution properties for AAD solutions
    type: object
  AtaExternalSecuritySolution:
    allOf:
      - $ref: "#/definitions/ExternalSecuritySolution"
    description: Represents an ATA security solution which sends logs to an OMS workspace
    properties:
      properties:
        $ref: "#/definitions/AtaSolutionProperties"
    type: object
    x-ms-discriminator-value: ATA
  AtaSolutionProperties:
    allOf:
      - $ref: "#/definitions/ExternalSecuritySolutionProperties"
    properties:
      lastEventReceived:
        type: string
    title: The external security solution properties for ATA solutions
    type: object
  CefExternalSecuritySolution:
    allOf:
      - $ref: "#/definitions/ExternalSecuritySolution"
    description: Represents a security solution which sends CEF logs to an OMS workspace
    properties:
      properties:
        $ref: "#/definitions/CefSolutionProperties"
    type: object
    x-ms-discriminator-value: CEF
  CefSolutionProperties:
    allOf:
      - $ref: "#/definitions/ExternalSecuritySolutionProperties"
    properties:
      agent:
        type: string
      hostname:
        type: string
      lastEventReceived:
        type: string
    title: The external security solution properties for CEF solutions
    type: object
  ConnectedWorkspace:
    properties:
      id:
        description: Azure resource ID of the connected OMS workspace
        type: string
    title: Represents an OMS workspace to which the solution is connected
    type: object
  ExternalSecuritySolution:
    allOf:
      - description: Describes an Azure resource.
        properties:
          id:
            description: Resource Id
            readOnly: true
            type: string
          name:
            description: Resource name
            readOnly: true
            type: string
          type:
            description: Resource type
            readOnly: true
            type: string
        type: object
        x-ms-azure-resource: true
      - $ref: "#/definitions/ExternalSecuritySolutionKind"
      - description: Describes an Azure resource with location
        properties:
          location:
            description: Location where the resource is stored
            readOnly: true
            type: string
        type: object
    description: Represents a security solution external to Azure Security Center which sends information to an OMS workspace and whose data is displayed by Azure Security Center.
    discriminator: kind
    properties: {}
    type: object
  ExternalSecuritySolutionKind:
    description: Describes an Azure resource with kind
    properties:
      kind:
        description: The kind of the external solution
        enum:
          - CEF
          - ATA
          - AAD
        type: string
        x-ms-enum:
          modelAsString: true
          name: ExternalSecuritySolutionKind
          values:
            - value: CEF
            - value: ATA
            - value: AAD
    type: object
  ExternalSecuritySolutionList:
    properties:
      nextLink:
        description: The URI to fetch the next page.
        readOnly: true
        type: string
      value:
        items:
          $ref: "#/definitions/ExternalSecuritySolution"
        type: array
  ExternalSecuritySolutionProperties:
    additionalProperties: true
    description: The solution properties (correspond to the solution kind)
    properties:
      deviceType:
        type: string
      deviceVendor:
        type: string
      workspace:
        $ref: "#/definitions/ConnectedWorkspace"
    type: object
